e0cca1f09a5c207cee7388e25d3e3670f42c9c56f3af4667b4e400bf26ced43b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
Size 665KB
Sample240613-rdv5lawdrm
SHA256 e0cca1f09a5c207cee7388e25d3e3670f42c9c56f3af4667b4e400bf26ced43b
MD5 8262f7b42a93e532b8a9445fe1c6bc30
SHA1 0f28ba852558b3974920d306b1b12c3101e2efc0
SHA512 678e0d71d3d7a84ffbf29d8c631c0614493aa475b00bc40c1df56ac12afba1729bc3ddd573bcc5653bc523c5270428dcc94c52297de43d3649084d30b1dd7238
SSDEEP 12288:3/nUHbC/V7QTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcL:3s7CuTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1960	alg.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
448	fxssvc.exe
4812	elevation_service.exe
4548	maintenanceservice.exe
1532	OSE.EXE
884	msdtc.exe
3808	PerceptionSimulationService.exe
3412	perfhost.exe
2572	locator.exe
3796	SensorDataService.exe
4112	snmptrap.exe
456	spectrum.exe
4936	ssh-agent.exe
2736	TieringEngineService.exe
2576	AgentService.exe
1764	vds.exe
3608	vssvc.exe
1152	wbengine.exe
2828	WmiApSrv.exe
3512	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92fcb0c84ba38143.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108875\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	1876	WerFault.exe	81

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000777e3cee9abdda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d65a5ee9abdda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007df1aeee9abdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3bb18ee9abdda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe
4812	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1876	8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
Token: SeAuditPrivilege	448	fxssvc.exe
Token: SeDebugPrivilege	3372	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4812	elevation_service.exe
Token: SeRestorePrivilege	2736	TieringEngineService.exe
Token: SeManageVolumePrivilege	2736	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2576	AgentService.exe
Token: SeBackupPrivilege	3608	vssvc.exe
Token: SeRestorePrivilege	3608	vssvc.exe
Token: SeAuditPrivilege	3608	vssvc.exe
Token: SeBackupPrivilege	1152	wbengine.exe
Token: SeRestorePrivilege	1152	wbengine.exe
Token: SeSecurityPrivilege	1152	wbengine.exe
Token: 33	3512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeDebugPrivilege	4812	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 1420	3512	SearchIndexer.exe	116
PID 3512 wrote to memory of 1420	3512	SearchIndexer.exe	116
PID 3512 wrote to memory of 1760	3512	SearchIndexer.exe	117
PID 3512 wrote to memory of 1760	3512	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8262f7b42a93e532b8a9445fe1c6bc30_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 744
  2⤵
  - Program crash
  PID:3868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1876 -ip 1876
1⤵
PID:1432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5040

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1048

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3608

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1420
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 2176eb032d50fc30a0d168b714c209576c32b0e0cf72d7ac2a970a6d795a43df
MD5 e824e5cd10ac1f46a0ef2db66956b014
SHA1 4e566b6053a35559400b0da52ef9ed2eb226a87f
SHA512 73ce6090f7061e83ecacbf16b94037f08744de55a60b666b8cd8ba022bd7ea1a722e05df2d744433698ceb9843e279169ce1df5a12717676158312de0c404f2c
SSDEEP 49152:ruYk3H5koUXfTqkkYLO/W2buywzMbOX+T7z5MpAHrVQ1/fSNvi:rPfTqi90bYpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 797KB
SHA256 4f1bd66bbd5c3558845caf3836c63dffc47a2efa4b3953c40d829756d860d17f
MD5 c24193cf1b8d51249af635e6cf755506
SHA1 cb530fbf7d096ce3703aba7ff95c90007aa54afd
SHA512 afb7ca1b064526ba81f77357543a3544743fe33a5160763ea3fd4f3fdf901d4b76677d279a1c0f0009ea401468954979c40564ce567044bc0bca5c89e2d36d6b
SSDEEP 24576:sidnBsuEfTduSZpUR0GHrVQ1aW4mSOgv3isi:nSuIpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8e0efa85022dc4021754b7ff6214a9c3075ca05b87fe05a207b015b1a86c0663
MD5 2c8bb856e9095b2f52426b02d418cc93
SHA1 64dafdcf0fdf90cf1b8c0374dc8d3f9f6537fcf5
SHA512 ad7e64993ae63ed56a671284534395d031619ff969bc59c086af104a29711d40344dbb2397df79d56677f93ebf1ccb308d0b113db0c828203519798bc88b2112
SSDEEP 24576:B+gkEVfh4CobTduSZpUR0GHrVQ1aW4mSOgv3isi:IgkExSbpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7fcebc056b7aeadee04c4bf16bd744f627dd6561640a2358bd38e58e8ac9a8cb
MD5 d8ea66f9cd815f7a0389e3137e836138
SHA1 9e641c7125d758df60382d55be4c910b73ff812c
SHA512 609ccc941267cb86f7fbd1bfd6428f349d343ff804f1c1be474b9211dfbdbc2b6d3646fccd6e9e70d21ec6e131d81331023bc4b9ee44ab003af5d368286a846a
SSDEEP 24576:cBpDRmi78gkPXlyo0GxjryTduSZpUR0GHrVQ1aW4mSOgv3isi:INRmi78gkPX4o0GxjSpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 946d72d6e0e319500c686b4b068c2f7059f7ff369e4cfabd15d5ac35ff633abf
MD5 5c0ef8573c05fc613368cfef89397880
SHA1 98de0e46c6494270f5af4c0deb89a4fa5245adf7
SHA512 ca7b9150892e31e7991461b95c81f43c6fa507fee18d2588639bed978bd4b873ec60a82bd8fdf2e4ea7743afc1f0ced4dfd03cbd89eb08df9aa1f040f6e309b4
SSDEEP 24576:eLOS2oyPIXVbTduSZpUR0GHrVQ1aW4mSOgv3isi:+/y6pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2ad16f3fa4ece570d928f03bf8347318e79ca39086fd1cbed2c8a27a9e03bb60
MD5 5c5b51fa7945c34e2998ffa5e80ad0f6
SHA1 a4c44cc8c39115376793a07f47f8c5d0199c82cd
SHA512 dfde601df1011b7916657c64a26606e30fd771246175a21cadca4d6d25402d6e8bccc11af918cd529b66bf8fe84d525dd05a35263f991d2d4dc0c182c9eb2e88
SSDEEP 12288:vfdTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:vfdTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4b7e78e4e34dfc06696c72c344d92011719e1660713e247ab4b52fdda1017b36
MD5 0e323ae185e28d30a0656ce68f3df512
SHA1 2ba032aedad590405da62617d4dcd12b53cdc323
SHA512 2b8414bdc53a35072a743c5e532ad3c10f4922ab07295f045262f8ab704b27f1838eb42f09857f119458044ed44c36990f6d442122df27da6e4fc2f6b53f3646
SSDEEP 24576:JJIUMTduSZpUR0GHrVQ1aW4mSOgv3isi:JJIUspAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a58ee1d62977577c051e3121a0f9ddf70a14006d1b4964516062eb53a348c5d2
MD5 2916755d424960a35976fc882afbba52
SHA1 bcb12d04e952dc92c967da371a5d4d7510abf659
SHA512 ef98c5b2bde219958bd8f325ef0dc669108f071ee22d8137662c3c8a79a201a346d66bd344891a0638d2094b072aaecc3a4c2e3bbe922ea4e9bbb8b6b9846682
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:NQvGAdlCEL8c/yRNw5CJpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 fc55acc9003c2b141000b12de4f16b1d38eb3f6c6aafbc42efd19b44452a9ae9
MD5 6cefe0ca999f62a5732fc13b69a3e5f6
SHA1 9ec08586de83e5bce27ef812fbda95d2c6b5f8ff
SHA512 f6b3fbac4bfcc872018fcb18e41cfd8b4953d27ce3c8da1dfb35e793377d15e3fed920ecf23a6b6279f064b71c20d1e2a31bcb19feb64ad6c43b409e386ff83e
SSDEEP 24576:NdewsAjKTduSZpUR0GHrVQ1aW4mSOgv3isi:jlj2pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 df09eef2e2170931b34297e6d140ec189358a1b6cbe6e8230d389073a22c0991
MD5 b51fe6270cc79dc91e485f0af8fc6934
SHA1 5622998a99c006e3c32211aba29fdf98c5c5a168
SHA512 153119788ec70a588e968876cc00fdb134cfef245de1c3381ca7660b4cc74a2c2629ecedc3987a8858c489aadb93da13311e84294a40a474248cba562485cb4f
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgUi:3UEtQevvqc2W1cpV2EI329
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 19b43626f68fabfa3daff6b412818e6d24737473e389f0372cd43f5e92d4ac0c
MD5 2a0c9fb6a1c682a5e27601d022bf2b1a
SHA1 2313dfb771cba7bd9e502aeaa0d0b297dc666d01
SHA512 77cd6a46682ddf2ae898da436ca95a7203de22402cd37d848f28b65cea6411952ab27209df60d548883e96405d57491d294e2f6c429db35ff6b9e94783c582c3
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/zWpAHrVQ1/fSNvi:roq2VjnmtpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e20a24de954d13a714885194052299e92aabe5b358805a03512963f603ae7afb
MD5 7540c0389149eae3fef4831c6224447d
SHA1 9635041ace8428d88e4236f73a9549f90578fcbf
SHA512 5867ece8efc7a14b18e33d35445ecf29d669b9673496dc06826d8a13167fa082a3c0633e2f07e6010093c9cc5a3d22196afc76b3cd00311b6673d11cc1b2b320
SSDEEP 24576:7AhGLJIFoiwtA5l7S53rTduSZpUR0GHrVQ1aW4mSOgv3isiY:7AMyFoiq59pAHrVQ1/fSNviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5720a7af6f722a7dc5d6fc2fdcd695b1a258a0525125b9ed6d51386f31ef6766
MD5 0e91e9113d94a2bafbbf083d02823b31
SHA1 319bee9b5fbcbc097e7ec7b7823aa83c00ee2490
SHA512 8e9a93111a6eaa63711726f0d4125a4f8867883fb8cff5da22dad751cec00a37c1b0f2440556f09d079ce2209f681c4180f22dde1be0e5bdaa1d25f95fa658c6
SSDEEP 24576:2wuoOW+TduSZpUR0GHrVQ1aW4mSOgv3isi:2wDOxpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 acd53115e3cea074a038e3989bdea9aec5d2047be2345d1ac1d668fbf0eb3fbf
MD5 c66b9ead6c6524d800c94c5fc900a1e3
SHA1 4a30f660d74ab4e19bf4b92c7fbabc37e0ce3411
SHA512 ab1e4155f41535c66088986d0895f2aeda3b0bcf8794d157171ffeaaf53e4570688ff4bd5f74a0c33f701177cde8a16f2cb3c096b803d5a7186d0e2063233b4c
SSDEEP 12288:DBZ1Iy6TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcu:tZuJTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Size 5.4MB
SHA256 90552e01f83fbd7650b398d6bb345797b7ea734a94c7b61645522a66da7cb01e
MD5 82f9b5a63520d734867bd372aef15f81
SHA1 d391b124c74451896c59f07fea2c66678468715c
SHA512 3496ecea3105affe34ae147a3052ddddc89ab95a07da1228adcd22c74c7e2b92a9e2089f6d80122781c88239ac0902ce59b3e1a2742f76e9e231574f6ff6bf9e
SSDEEP 98304:ZwfhY7g/rLd7yYA3awr341gFpAhQ1CNvi:778yhvUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Size 5.4MB
SHA256 2c598f22d413d0e4209d1efe162d3ff51534bd1d4fa1d8673f71ca637b4489de
MD5 59c52b5e1615720053be18bb36a4c5ff
SHA1 702990ecb2a10c8fc22db488640337d372f73029
SHA512 f577193fcd83d891657313375dcd6b499c4a5b02db6ac8bb03d7b0a2bb348eee265af9949c1fc777bc1d81ea1a7e5b20566b4bcc58d6d32224ca509c8bee80b6
SSDEEP 98304:vwfhY7g/rLd7yYA3awr341gFpAhQ1CNvi:178yhvUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Size 2.0MB
SHA256 97eb7b8bdfa1073041f2f3c6fca2272c88ec04747fe92a644e52d06a7b9ff603
MD5 d86bddc29324813bb2074977d5e69c53
SHA1 a69b21d0d76df15ca4d77cf509b182928e158522
SHA512 85c68602aa3ffa6425741e0e9c37967df80d841bc0b75b27fbe6175460ae70070cc70359c588974fd539ed1984febd1faeb718f2bb4de8d0b7272683d713c676
SSDEEP 24576:AcTyYv0FteQU+5I2kjgD6iQacA+TduSZpUR0GHrVQ1aW4mSOgv3isi:AuXv0Ftpn5606zO6pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Size 2.2MB
SHA256 a2970a939a2a018958c62c25faec34ef29af9338aadf331d8d5762e01bc8d025
MD5 0303af2939d0a82c5f884abc2edcb41e
SHA1 05d7aad486170957031ebde17ab7e0c672ee70c0
SHA512 7f333bc28bc237541324ac07aa558840a49dfb5c13545d47d6391afbd47c39eb02678202f73141649fed91ee05730dfeb85bb18e3f37bc2968e31501fa8a970d
SSDEEP 49152:Py7mTd0GxN8jyynxHjXKUyn4GVcbDSKrNTxYpAHrVQ1/fSNvi:6mYeyxHjWjMTYpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Size 1.8MB
SHA256 7bccf4ed3cb2bfad6831a2d19cb0870c0e9eff9ede21bfa0e84c94ee0ba1b84a
MD5 c43493183472a9393497fc128ac7af8d
SHA1 ca01fef07b659f56ffff1f5a3d0f647b61e1d446
SHA512 6e03e82056209de834c525e3b9813fa11e747d337fdcba3ae1e17cf30f9b5ae4097cba0f0c2f0545db7826126cb9bde8c4ef3c2e7127b29cf1497dfd33e47d36
SSDEEP 24576:f6drZn1WEci182IEUeNbJeRgUebgW816hTduSZpUR0GHrVQ1aW4mSOgv3isi:fWnDci18yNNUgbYypAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.7MB
SHA256 4d3851e92464b1f3ca719f414d5fd8eecdf0a39391474267ddd5ac760d57a80f
MD5 aca2f565ba21034c76a0aa91fbc6c28c
SHA1 bc028e327aed614bda6c12390be2294a89b65beb
SHA512 0c827e54655a0a3aa6fd4bd02b2e4a698d3cdbcc53f613142a48ba89dd69a6da8c6157afec2cf687a543e542765a9e8b16de3a36f4fb11c25d0f55a609837e81
SSDEEP 24576:Ok5lHW5EzMZupO80G2reD+melRgTTv/1nyoTduSZpUR0GHrVQ1aW4mSOgv3isi:YizMZm0GhamSo3pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 951ca841cc9af043a183f67a29c6a08eb6eecbec9648c774f4ec771e732205cf
MD5 709e9c936f8267d6a694f17f73e4c54d
SHA1 997b54508d65dacf30391ea7aea31b03e088b0eb
SHA512 78391b87a5eeb9d82bd945238c2e7ef66cd0ed7b16748292e40cff6f16b532b3b44db402348bd66ac8ab32f82d771f60087a9ef96527a5a4b283ca6d5a356374
SSDEEP 12288:YFTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:YFTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7f269c572f8d8d0ee76d957222e4d6c2d363dad876e80e07c16fafaf91bf1e69
MD5 2c510132919dac619b7107b0b9c73ac9
SHA1 ad1b2c876df435181ac37c7dca47cf65ba6ae900
SHA512 2b73fc1eee13912a811cd1c4b711f3b6abb8ac46bd45f7310a9c2f673f529b37672adfb3340e028974a88e3d0277c5afbc96b9ace58e8412a0b8573f664f9ab6
SSDEEP 12288:M2TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:M2TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 df5f0048a1a0094e46d326e3720bccf04757451e6dc190b77b84459f3d5e9dee
MD5 4d7d19931e03ecb6e075c468b801a7b5
SHA1 77239ada6ebf3ee59bb0aff910f7966f4b1b49e8
SHA512 9d40d9cf24d205ee4a53944604223c8ae7f06673807c807cf34f01bfc59dbdf6c07b410ae4472e03c821ff7742925336530d1c66562346c04ceb911c82a2f0d2
SSDEEP 12288:k0TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:k0TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f85af7e5ac86632c374ba58046b957535524d709b09e46db406d2074b1cda0e8
MD5 39c4c887df08deab90875be9e5e7d621
SHA1 6b2611b6424ba76c3541a8035b6db296a88a7b3a
SHA512 57ccbd5d6cf337420ad9d9243e4b58ed0e88e399c78013823fea61b7a8c928ec9e44e81e32231a83003dd2eb5b2d52e0a4ed6e9be894dc55c0c7189881b5963e
SSDEEP 12288:dVLTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWch:TTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a384cd4e3813f3c7e66c83f61a6f140c6f7a75d42b0e24ffd066dddce8f6e918
MD5 3cdc7067bb909f2a9d8b2c114c08ba76
SHA1 1651fbdc0da7a51830fb5e23ac915d8a624864b3
SHA512 9a872e05d7f5c64e10ce1500503cf25a4e7e81ee7abba871fd184cbdb2cd8f7c1897c4b5d4d7027d996999abcd147efe946f32a2aa87783b4131992ba9d0bc6b
SSDEEP 12288:cjTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:cjTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 85db5548d7c58130c7597729fb8f9b8646892ed1c42e8c0d43abc34f8553e7be
MD5 1796c162a16a8924e490891479dbd7cc
SHA1 e005ff5a6367d3e56ab0913da166498fcae5e27f
SHA512 71dd005b34a1d2307069b909dd59d09caeb1728c4988a97ec240fb0e5a62dcc80d19f03ff5995163b9686c3cebd8a548b494f73c1cadc2a09ae1eaf176c9b996
SSDEEP 12288:YyTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWck:YyTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4fd2755e2c3d6267f54b1654ccce1a25fee9ec20a6b17b95d93c66b6e76a72c2
MD5 8c11a9b83485d0f83ef5c3662109d74a
SHA1 ab0ad18639fffb91f4d4b3ef14aeefa5613f44cc
SHA512 c65720f1429092a792b30efe786f8b0bcd6135e2a1223d047abf8b69f2de8364038fbdf2a3407cf82444f7c8950bff0d7baafcdd1a6c9933c21818caa6c7295a
SSDEEP 12288:0OTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcs:0OTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 309b1c1163ae129a337c67e334278b3a678a8fbebf2c310627039e1976e9c90f
MD5 aaa34d767c2e5578af9d0a932e9517ed
SHA1 b7f79dff71f473376bd90a0d3edac8b53a833501
SHA512 3d8e7c9c2fa61fe31e544ee30587bc44c65a4137b5d3ad68ae71ae0bf736c2486ba642ce98bf535eaa5dec3867b87e9323c7abcd9cdcd020a1852bd708605693
SSDEEP 24576:dZMSzFVSOWTduSZpUR0GHrVQ1aW4mSOgv3isi:dZMSzfepAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 112bcf2dc0a3abedb81bef94b2ecdffd58c5d9daa79ac2815cc87d9347260421
MD5 fe18827a241a6d3b01448cd7c0fd06a2
SHA1 c85a19e646b11a57070ea3f5d1360891f51236b7
SHA512 9cb97acfc12621b2c2f83bce9468c8955134f429f6abe6358b13eb5c25713dd26e651330173f57e85083c2a8430b74dffcfb4fa2714ad852e80cfddbc04eee87
SSDEEP 12288:75TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcK:75TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 52dbb08409dde6790b2bf4a6cf15dc0616f979e11f4a268ce2bb07b80efb8847
MD5 627caaeebae7be196bbf0bcc4a229e40
SHA1 f0db25349488ec42c7c0fca0442aea8ae838fc55
SHA512 6a3beb4911270f705b81a3308b7454e268d160b640f7eee54e30d6ff36b84522580fc227d181c3cff6a080aadce1ac1d563082def23e107c46b6c78162490886
SSDEEP 12288:UNTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcK:UNTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7d8be6f605987f36e917ab53836978c643ede5b9c01bb2f600a02dc490e4f835
MD5 8ab963c7b51146129a8b75adf86e21b0
SHA1 c1b7fabe44a896590152b407000555a27aa12c4e
SHA512 f8562438f13749d490d745c18db4967b564131d759948f0844452c1887e32497737c3a9f69a7f364d0d54ac0fff584731b6714772da2a980ca8184a6e1a9f6cc
SSDEEP 12288:2yPz5L86TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc8:Lzy6TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 51e1f4b8f0c036de094a88678bc7ba6fb8d1c076c1422634af5f94fb154489e4
MD5 ac99b2421718304f42195d0b966abde3
SHA1 694099b53de63d6796da3fe806fd8146cbc762f9
SHA512 170876fcb679dd23e028af1c34957c0801f0dd42b26f81fa77d0b338e2d228d90446e05a86a464a7ada62a1237ab5dcb2cc3eba5559d9b91c2298a8b4d5d987c
SSDEEP 12288:E5TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcB:E5TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 25cdedb6fa0425c1c0563bd006fedc350e91fca84bde348ba92417d5b8ed5640
MD5 3c29064fb5787388138e85a5cfc4bf94
SHA1 6cd47787a485e3fcc1c9a5ad6162fa536033128d
SHA512 391cbc513504ac4443036ca50ad53b54ca30f5172c099a576056d58d2ba5fabe374a032ae8210dcbf7fa238913ec6cb25074b1d9c1ba518eae96b7258c995c76
SSDEEP 12288:c5TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcB:c5TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5a7ac5fbf8316732ff6928bd98a334507ec69e5fc00caf750a7b25d1b0f11ab4
MD5 99b0e655c3e71424d6cff6d30747486e
SHA1 5538394232aeef9591a6fa0c5879ccf97dde64bd
SHA512 313cbc1e787c8fc7af6bdf9122bdc737fe3a7e34502a7b0f22f008eca6d3d992c789c37307b6bcb8587d1786abcb38efd78338660b22565bd5821f42dc6784a4
SSDEEP 12288:VyPz5L86TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcr:8zy6TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d4043738c05f7be8974b98f9d6d8865eef7f1488a100a8462a1093790707a59e
MD5 ff3d68259c37f9d2d567fd1d51efa838
SHA1 3650778d6eaf0bd6d4b635194db005a44e189447
SHA512 5d2ed38950ae9b485ea64f3b30d6be3a98eedbe528357f9d2908d41b4d951063577d512a54100f85390cd4dd9de4f711076082f570940e00b4ce090690a27250
SSDEEP 24576:yTHaLl3z0zDETduSZpUR0GHrVQ1aW4mSOgv3isi:yT6Llj5pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 b0f2f173c2815985f760a17ab4bfa42bd4b8dac47d2a9a16c25d730a4ea6b854
MD5 3121d7d90f962c7258060d13fd48cb57
SHA1 c9f08594d144034815015a93e505dd80ec39b7c1
SHA512 912c12210ab550faec91500580365f31188a9dc98196359823a3200ef7dab3fafbc6ef5ba74fce0ac105752141af4aceab91f1ebf64a73a0ee4e5191d105ffb8
SSDEEP 24576:q37d9CHKy7GZgTduSZpUR0GHrVQ1aW4mSOgv3isi:M7d9CHKyaepAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3c0b1470733b292d5ac71fcea4983e34abb4a6d25627763363b1577e56307eea
MD5 c46c76cda6be8d3fa0b5098de1a8457a
SHA1 b8466ea238230690fc03e0971efe082eccea678c
SHA512 24a4de1644531eb5e429d978ddec981a263ff5f05d3524ad9763a8834dc98fc5be4bbddaddc1fd0197e1feb356558317dca91cc358c6e6b78a2971d4ccba4286
SSDEEP 12288:wUTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcD:wUTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3dd6b127c7683a607b6f8f10aa3e84084b9069224fdcbf682b016ef9bffb6032
MD5 35716ae479e3df88d20d74a5d115567e
SHA1 5f0da999fa292a67abcec04d164083ec8063d616
SHA512 018c9f7185e029524c817c9d104437d0213dbee2767815cca84b6e50d71423010e075e0f8bc61665e265c55cb1309db0043aa644a68c8a7b91f618003a7ce0aa
SSDEEP 12288:yaTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcb:yaTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5009aa3a269029211d6ece4214d0d36b0dc7b4b13e0340e0f71e1d294316f266
MD5 09e317c7dffa9b0f0b6fe3b5c7b78006
SHA1 2c55acd5bf95b90a3841254da5347fb74a5aa9b0
SHA512 0f34526792995be56a0915a9d1f5111d35d10178302f0c4b28317039f9a87e8b88f5e9e5e03584ad20a3df6499225147c9c170a72d0fc8a593b20e7acb1d74f0
SSDEEP 12288:wfTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcK:wfTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 8de3fe754ec2c322f7feda44b14239b34aa83adf1c9e7344483abe7717076719
MD5 1111400c2fdd83f3bd195e121affae0e
SHA1 dcdbc3c1c08ae3052af50f846ec4d5cc92332837
SHA512 46680689d470fb792b2f9233d54e7d35708d30d51c19855aef773df06abe40c99b6345fb8f31a53d219409a9f6c6f8ecda40e1db66a35753cb78a311bf2ba586
SSDEEP 12288:g5TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcK:g5TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 76b0fe2592a22a66cacb8d42df54199bc0a301088c91d0f42d46af24139d3018
MD5 9508c1265e0a78c9ddac403c5887091a
SHA1 f12b87b0cb797e75ed7ae6bb5aad01843310e746
SHA512 f415519746af6bc640bac4aa8e0a41ae745d42240f0d7a0d2a122ce04fd60590cb2f9f71a46a8f120317db33b8c0f0a15540cb33aedbe2c72936d88db070c1b9
SSDEEP 12288:4UFmDDLwTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcp:iwTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a8c48a2afc370f5c0fd7719126ced95410d9affb132adefd4e01f030307e0ede
MD5 14a2a0ccedb0ddea8887531b313f18ea
SHA1 131f593d39c3053e4001bb9eb57058e46a2116af
SHA512 6ec508c44ba1908e7b4562c87c0eabc0bea40f7f6ef061fab5c49b92c5dc10f417a025bc1b358d327423dc276794363330a7fa6287cee18efc67b95f54f2ab46
SSDEEP 12288:3dTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc/:3dTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6e8c94774cfbe73011c2548ef15fbd7f198311e0b0a60f7d91ea669aa66d979b
MD5 ee325e7e7249d066b282af9d7c074f34
SHA1 8c19d208843f88922dbcd12ade98492f365fcdd6
SHA512 12ed9ade3b5b9a18f92ff7aed60828c17e287f4bc390e0e709a5f8294c63ce70a3e1ab59422428e46f87fd51b528a63ffe52184a2bdb2a922aeb3ad03a0ef1f8
SSDEEP 49152:fa0h2GEkuAe73q3pp46zwwQBpAHrVQ1/fSNvi:fa0hNYG4JwCpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 ae0eee1e30fc7ca4ce1ffbe8874bad1d2fa1b060a04ac5e7bd64613950a7714d
MD5 41891ec835dc5a9d00617d4d048e6598
SHA1 5410031a5a86dc3be432a6a181239ed30d1be242
SHA512 1ba9d9ecd7f70beb2751b9a9e463aab38a3bb45cebf206493cd3e4ccd0c164beaa4c062fbcc826ecf9b27db64fabc9cafbe6d18f1ac1aaf32a8d19b6dccc7534
SSDEEP 12288:8hbHjfXsTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcJ:8hbHjPsTduSZpUR0GHrVQ1aW4mSOgv3q
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5cbc38f80740107485f1a371db5d1009af4e64d3c020ff6552cd34bfe9d699d4
MD5 42018217315665699f2dc2969256105a
SHA1 1337609d7ec6da5524cbeb9ed194e55801a3f442
SHA512 5c28f377116579d4ef8ce357a679fd33db8961defb3e701ac33a6518bdddadf0c6b54467b28d35354b7fe8d998ca5070da32897c42ee851efefec887f0f8188a
SSDEEP 24576:F3YgnJcRTk4yti+R5dBR/kTduSZpUR0GHrVQ1aW4mSOgv3isi:FIgnaTk46pBR/0pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 84ad8b36864f0db337f3680754ab2b12581f12b008e1c5af6b157a1a4f03a10f
MD5 cd28ba73af67530e323380821a7885f2
SHA1 cc232c361e485d566afc575fd6e6d5606ac5d975
SHA512 01ee1f55b66027ecf705913945034763bf7bbc18678840d8b10c356df32980a7da313b415469474d02160ca3555ac71621e6986b4b5098febf7652380269e7f7
SSDEEP 12288:HxTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWci:HxTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f6d0d81105861585b8a09740a695827f27a21a964cc01f7300d8dc3bbc6e6f21
MD5 e514f3502e4dcb2e0b7f640a23218f14
SHA1 bd4cee84df28b67024907c3a4ba801c042497c6f
SHA512 8ecfa50c248b20bfbe40f4554da3b1408596481216821dd1596d7e2481c254361461d2a673ddbdb051d95549c045b72ed91d4bb6915411e6ea9b9fc89b0b0d9f
SSDEEP 24576:SpL3UTUTduSZpUR0GHrVQ1aW4mSOgv3isi:SpL3UopAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 fa095991d9ef6b46bb8cc0f7a6ed81ceb18951751b64fb86e55bba4151b5bc73
MD5 64adede051f316b3bed0f90b493de817
SHA1 6848f4f21cd0323ea0e1d87c958e17554b773956
SHA512 3acc1ee5b0414089d7dbf827ede46309b5db465572032157f14ad21f93e18b5452a2b975b438ed5ff311ba5cd96450a5206df02a0a70dbc40f9030f2ffbf8324
SSDEEP 12288:YpFtpOoTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcW:qOoTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6600503b20f9561f3dcbf7576ce593b062300a67c35a615793ed6472de4a5e7f
MD5 6921b62c526a8577a292e17e00499786
SHA1 188f071030688b4285c8ce93b374d4ca18709a68
SHA512 20c04dc9f1aa89f17db4a3cb9d04fe18b678b9b7ef2bbe88097e205d39558af03f244859625e84967e323171312ff9c7ba11de40db6630b8623094d37e8a7874
SSDEEP 24576:d7NM9YqZqmWMUkPjZM48Mv6bEhsNTduSZpUR0GHrVQ1aW4mSOgv3isi:d7cBWMpPjN8DbEhWpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fe45272a229860b3070e13f5838346085502ed6fa8bff12d19caaad41fc249a6
MD5 c4177e045be37f4221f4a070fe732108
SHA1 9299b3296e2fb4aab0fe953c463dc800acfa387e
SHA512 9d924a472be9dc9d62413b5230f6c6342eb264e1723645926e3cbebf5c309b967d659b36f7b3895a8914da09a854ccd681001a42c64fac0eb7ef3d140ec4199f
SSDEEP 49152:7F2YuHNETovAvNYf8kmrpAHrVQ1/fSNvi:a6BCf8kIpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 40dce7fe2ce7fbd65745437f0a6d183181014cb6846913ab75a57ce6dafa7b81
MD5 50e89cbf9d68f501cdfc1a8722c5209a
SHA1 4f656d8001772c3c69818acafa6aa56bc6d7e601
SHA512 2d5cd0fba752c9abd8cada9540da5379a6449c5407c64e38ebe5374158fca6b04d1f15e879762d4b977ca3bed08050bb85f8aed7fe176a487dad8c54a60c13e8
SSDEEP 24576:ZAFs06+Omlf3NXEbTocTduSZpUR0GHrVQ1aW4mSOgv3isi:eFs060lVXuhpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 a210a97c09e5a55b71b097ef6edb96cb01b79b7b246b83cf1bc107c915e3ebb5
MD5 b16e26c3a32398567fbfab68cced416d
SHA1 30ac30ad919e434971353f0dbc59d3f776f85fa4
SHA512 11bb1886acfa0f406c4c6335c68af397410f113a9ae80fcef11b0db403863c7f282924eab0d744e7b43d15f5e81a66660ec00c6d96e79cdaac64a4997d8301cd
SSDEEP 24576:KJnJ5D3WXfTduSZpUR0GHrVQ1aW4mSOgv3isi:KJnJ5DGXhpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6ed692982746ddfdfea7c48d2d9e1abaf0d5623ecb5077eaface256bea705380
MD5 c51e2a8a4608fa7611a4d6af17ea1746
SHA1 f7b984f821d2c43cdde3396b1f72ec2748ea38c1
SHA512 916026d55b0f75595b8b54103ca2857e09a564a8497cebe9461efd421e483113e0f373dd623930215c42d203a55c3d9f660661ed33ea80600d45b0b25142f99d
SSDEEP 49152:zg06DIKdwc+eQnSt65aVHpAHrVQ1/fSNvi:MNpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 fad3f2e84cfac8abb65ec0d82724bd2813847369f49812edf4a81b51b9fa7a65
MD5 87b58748b4a5b1213cc143eaf389fab4
SHA1 c4257598258c186666f6efea65b142996e262f0f
SHA512 d5ee4c760f3641d79c2778f0ab310de332efd74fbd8dfc5bbc0e528765fd34904f1381031c2e1b63a15238812891fc3e24d8fe02d9ccc523d6d7cb1dc5011196
SSDEEP 12288:MEP3RnpTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcC:HnpTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3599441f138da17c6a67486ea30c2338d30b0739a4f106dbfecde2c5970fa987
MD5 3bd96d3f87789f758084371c15b24e41
SHA1 b2d7c67a7e9c3a17ebeb632f19eb59d3c37499bf
SHA512 f9e321a6091178a1020c8dcb747627e2f0692d6383a006d23c6c54690d34e2d178514a9173be1c6b15a06fc771b62e3647a3998112401525e8ac52ec62eec078
SSDEEP 12288:YjkyaTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcG:YIyaTduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 b5985f2adf59fc9ca304cadc331cc2b8e8c5f1278794fac438394a931263154e
MD5 17f826d7b4e77d3dcb8933b085d2c173
SHA1 d86b5a89aafcb3a53773f1bdbc1f687e9312f20d
SHA512 9f8b3dc93b29782ed55e84ea40551ae127ae3d9fbaafac9d60e72c5dc1e732bcad59d68ee11918b5eb597e2ad6d17fe0991ea35b78bb4237da50ae80be28044a
SSDEEP 12288:sy4TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcI:Z4TduSZpUR0GHrVQ1aW4mSOgv3isi
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9b2783f80b4b61d0d514cc0176dac6100aee8ed3a33a6f36ffece53ab7c678f5
MD5 0c08800c98e8376797c9ecf10d19a131
SHA1 c7829d15294f5b82206ff0392e4d622b3f2f4b13
SHA512 56261cc111da01610cd424fa15e19a3d79a20b1840df2aa7627d9035bc3b18d7f4e0bdd7bfae0efc1f8f3925d1a6907b617af093327ac38300ccc1e7b931ca5f
SSDEEP 24576:sQ9MxZKdcz9dw3VTduSZpUR0GHrVQ1aW4mSOgv3isi:sVKZjpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 3b00675edfdd09bc0e1caa084f1d7e50f8c1a0a8a39cca695e9843db7aa5ea42
MD5 df4a86ca9d2e063190bf91c8b62560f2
SHA1 00b5a265361b6716becfeb67fa27469adb26c86a
SHA512 17a5b41daa3e1c387a7f8c72886108c4e9eda5ceda597881f22d2e6eef02c49826f8f5d79df2092b225a97b8bd857c902fc121639c50680399cd61d5f9e95262
SSDEEP 24576:YyocDAp+TduSZpUR0GHrVQ1aW4mSOgv3isi:1ocDAp6pAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 62ee522f3aae11b30b0fccd8d2336016b956a93e524ef9e780b102947ccae1e4
MD5 dfb9b4a2b30a6ec48128f9f43e15a85b
SHA1 3a07cd3b79498ed74801b9b0059a0b49b4542338
SHA512 08df80ca525cb59a9350a9cd307b6f33a8f270f59410f1ce0f3f2c70758d0f92bb5fc918ad56c124dff32135a092689e82465128c71f37848b0f5adb3cf74d0e
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK6pAHrVQ1/fSNvi:U0zuNIEpAhQ1CNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3bd77b4f16470da7002e6faf8dba1846d4e3e944338fd6b5d7dee14bd2ffb108
MD5 97b19a434249f783db30fb7fd343113f
SHA1 c35b305c9ff4345754b953a5e16c10b9fcf9bcce
SHA512 0bec678a3fd5f40788a2a2671215d4eb12636bec153d8bb3c94653efa12d37aafa77a41f5626e7fd2d1a3443a93bf217ef82f9e06dc5b5ed0ad8d9fd81efe385
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYtjMqbpTduSZpUR0GHrVQ1aW4mSOgv3isi:ITDxR+N5YzTfjMSpAHrVQ1/fSNvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/448-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/448-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/456-280-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/456-279-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/456-484-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/884-309-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/884-241-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1152-491-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1152-318-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1532-64-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1532-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1532-65-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1532-72-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1764-489-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1764-310-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1876-6-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1876-0-0x0000000030000000-0x00000000300AA000-memory.dmp

Download

memory/1876-1-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/1876-45-0x0000000030000000-0x00000000300AA000-memory.dmp

Download

memory/1960-231-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1960-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2572-481-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2572-269-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2576-305-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2576-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2736-302-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2736-488-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2828-333-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2828-493-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3372-15-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3372-24-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/3372-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3412-332-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3412-259-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/3412-267-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3412-264-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/3512-494-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3512-334-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3608-490-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3608-317-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3796-482-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3808-245-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3808-256-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3808-316-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3808-251-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4112-276-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4112-483-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4548-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4548-50-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/4548-56-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/4548-62-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4548-60-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/4812-31-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4812-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4812-38-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4812-234-0x0000000140000000-0x000000014024B000-memory.dmp

Download

memory/4936-487-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4936-299-0x0000000140000000-0x0000000140102000-memory.dmp

Download