Malware Analysis Report

2025-04-14 00:39

Sample ID 240530-rj6taabc6s
Target 40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe
SHA256 43dbfcafcbcf743e141d2ddf900b7e0bebe2993fc3ada567cf385e0ec122c443
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

43dbfcafcbcf743e141d2ddf900b7e0bebe2993fc3ada567cf385e0ec122c443

Threat Level: Shows suspicious behavior

The file 40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 14:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 14:14

Reported

2024-05-30 14:16

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\987af173d590e271.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{F4DF7669-184D-4D67-991D-8B1550DDF396}\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d8150b39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6273ab49bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f43fd1b39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b17f6fb39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fb6e6b39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ed03fb39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ae452b39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be65f7b39bb2da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\40b96cb50bec89717f18ea2223d79cb0_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 54.157.24.8:80 przvgke.biz tcp
US 54.157.24.8:80 przvgke.biz tcp
US 54.157.24.8:80 przvgke.biz tcp
US 54.157.24.8:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 8.24.157.54.in-addr.arpa udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 61.43.200.44.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 197.86.237.3.in-addr.arpa udp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 54.80.154.23:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 23.154.80.54.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 54.80.154.23:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 3.237.86.197:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 54.80.154.23:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 86.104.213.44.in-addr.arpa udp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 173.204.218.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 44.200.43.61:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 3.237.86.197:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 54.80.154.23:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 54.80.154.23:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 3.237.86.197:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 3.237.86.197:80 zrlssa.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 54.80.154.23:80 xyrgy.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 34.193.97.35:80 htwqzczce.biz tcp
US 34.193.97.35:80 htwqzczce.biz tcp
US 8.8.8.8:53 kvbjaur.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 8.8.8.8:53 rffxu.biz udp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 cikivjto.biz udp
US 44.213.104.86:80 cikivjto.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
US 34.218.204.173:80 qncdaagct.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 54.80.154.23:80 cjvgcl.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 3.237.86.197:80 neazudmrq.biz tcp
US 8.8.8.8:53 pgfsvwx.biz udp
US 54.80.154.23:80 pgfsvwx.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
US 34.218.204.173:80 aatcwo.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
US 8.8.8.8:53 ereplfx.biz udp
US 44.213.104.86:80 ereplfx.biz tcp
US 8.8.8.8:53 ptrim.biz udp
SG 18.141.10.107:80 ptrim.biz tcp
US 8.8.8.8:53 znwbniskf.biz udp
US 34.218.204.173:80 znwbniskf.biz tcp
US 8.8.8.8:53 cpclnad.biz udp
US 3.237.86.197:80 cpclnad.biz tcp
US 8.8.8.8:53 mjheo.biz udp
US 3.237.86.197:80 mjheo.biz tcp
US 8.8.8.8:53 wluwplyh.biz udp
SG 18.141.10.107:80 wluwplyh.biz tcp
US 8.8.8.8:53 zgapiej.biz udp
US 18.208.156.248:80 zgapiej.biz tcp
US 8.8.8.8:53 jifai.biz udp
US 44.221.84.105:80 jifai.biz tcp
US 8.8.8.8:53 xnxvnn.biz udp
SG 13.251.16.150:80 xnxvnn.biz tcp
US 8.8.8.8:53 ihcnogskt.biz udp
US 35.164.78.200:80 ihcnogskt.biz tcp
US 8.8.8.8:53 kkqypycm.biz udp
SG 18.141.10.107:80 kkqypycm.biz tcp
US 8.8.8.8:53 uevrpr.biz udp
US 44.213.104.86:80 uevrpr.biz tcp
US 8.8.8.8:53 fgajqjyhr.biz udp
US 34.211.97.45:80 fgajqjyhr.biz tcp
US 8.8.8.8:53 hagujcj.biz udp
US 18.208.156.248:80 hagujcj.biz tcp
US 8.8.8.8:53 sctmku.biz udp
US 35.164.78.200:80 sctmku.biz tcp
US 8.8.8.8:53 cwyfknmwh.biz udp
US 8.8.8.8:53 qcrsp.biz udp
US 34.211.97.45:80 qcrsp.biz tcp
US 8.8.8.8:53 sewlqwcd.biz udp
US 3.237.86.197:80 sewlqwcd.biz tcp
US 8.8.8.8:53 dyjdrp.biz udp
US 54.244.188.177:80 dyjdrp.biz tcp
US 8.8.8.8:53 napws.biz udp
US 35.164.78.200:80 napws.biz tcp
US 8.8.8.8:53 udp
US 54.244.188.177:80 tcp

Files

memory/1616-6-0x0000000000770000-0x00000000007D0000-memory.dmp

memory/1616-0-0x0000000000770000-0x00000000007D0000-memory.dmp

memory/1616-9-0x0000000140000000-0x0000000140183000-memory.dmp

C:\Windows\System32\alg.exe

MD5 afbc5825f6bf79b6021193d7ee3b3cb8
SHA1 33569f58cf3e99adcdf482be305cac40f7761369
SHA256 24740c8d2881db96d495880cfc96287b8ac572ee8f477d93959ec610ef6f02d6
SHA512 f116bddbe20cc75cf20d97026047758e40449ed637d23f36c6419f59d6c50749e6cb43b9f438472a6a17ab7069c98feb93863987533080b0d7c07dc8751e072c

memory/2960-12-0x0000000000710000-0x0000000000770000-memory.dmp

memory/2960-21-0x0000000000710000-0x0000000000770000-memory.dmp

memory/2960-20-0x0000000140000000-0x0000000140189000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 6c9cf0746de3224c3babcee3a5dc948f
SHA1 ba2f1c255e942dcd6be06fbab6b64a05e8565d57
SHA256 4b57ca565e42a362d0261e32ec0faad51b87cc9957765b88c6bd771600bd1d6f
SHA512 e9c7196dedc5b543e7c60344b917036a535a14b46fd7f3a121e8e2f8f907134129444305540e10c69a41d15eb72fa3125f1d48c15fc53b3dd945f973f705247e

memory/4752-26-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/4752-35-0x0000000140000000-0x0000000140188000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 d71f746acd31e252e2e4ef2bcec63363
SHA1 289c8f08f8962a9adcaf68b3d7f4e19260a4cc74
SHA256 8738b4fe4ebdd80710cdff9839b226408ceaf420f06502e6fd68323cb5adfddb
SHA512 87f292a3fdc781cf580e4ac806ea1cff0961f2a2a06db11093a63ce62717bb4acc8401f581ba15dbb0339c6c0a635b53382ee28c820f42151048f5956afb4c84

memory/3140-44-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/3140-46-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3140-37-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/2780-56-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2780-54-0x0000000000C90000-0x0000000000CF0000-memory.dmp

memory/3140-57-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/3140-59-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2780-48-0x0000000000C90000-0x0000000000CF0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 6d4410146fad7d6d0b8ce8c5774df090
SHA1 a650c41f721a59373b4966047540d023e1f842da
SHA256 d77ed7c30b5f490d1fe3c3806c6fcc33d58f7942d8ed55938c7bfd9d1aa506d0
SHA512 7d849aa4cbb1875deae3fa1cf670030bd148f512d7d84024c8e3a60d42fb2d026078ad1a509fdffc0baa13a27cf777591c0fc4d2662f1f3bb17a8f73574d1e8d

memory/4752-32-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 a8b8d7b6e87490f8639fe41e27db6d81
SHA1 234ef6a1b67ce6c0a46b4a550858aca79e3c78d1
SHA256 de961d52c9ea59e75637b2307d01242296bd2e40852b96f5a560862137c079fc
SHA512 01aabe4e0620da3f94fff3b782c307a9974a01cc2dbf0ec7554f5c7406da9fabb12e34656cd84f9734e40f71aa42abbb8f29f706977dcf5139262e0d133f1164

memory/1268-62-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1268-70-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1268-68-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b156dde24b12a725ab6646d96ca3d7b0
SHA1 ab9389313d395aa0f1050807a83f65ce01d769c9
SHA256 a314849c777dc48823728ae7afe0c39507e2a277452ff5df268799a9f6e818fe
SHA512 fd2e4449200e249601e80d111a0e18721ae64de6aa5a4d66a968b6741727baffd09a40d23c9d3bca416c54ba13ba11c9c1ea1b675d533db5f213ff624b269314

memory/1840-80-0x0000000001A80000-0x0000000001AE0000-memory.dmp

memory/1840-74-0x0000000001A80000-0x0000000001AE0000-memory.dmp

memory/1840-84-0x0000000001A80000-0x0000000001AE0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 3de3ea9c56f100a115b26e6e6188dbe4
SHA1 2c6fff9ee4c15a6d00c11975abda9bf1a2f30a34
SHA256 3d1b78137f9d5bcdb011634d640db2350fa122dd10a9cbdc9019d306510c9deb
SHA512 a706c77664068e9e7649d4ea2873116762ed1588a8a7c03b27c64c3177075e3beeb9d457d6ed5d1538ecc229a0c67816ab67be8ba86f296dab2af028419c88ab

memory/1840-86-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/2520-88-0x0000000140000000-0x0000000140198000-memory.dmp

memory/1840-73-0x0000000140000000-0x00000001401AE000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 10838feef04e70bde229d54251430df9
SHA1 0ec6515dae164654901e19354410c5e01efd9459
SHA256 ff542ae2b5373dc6b69f92f08f39b794624ea58089f58b0858d63f289f18019b
SHA512 cf1e709f4b8e584b62cbab81c871fe1f960ab78b89306d00f087ba27fade57029636b3433014eff4de1e9830e32a65617b1a2baea0f22eed012e49084400fcd6

memory/2096-108-0x0000000140000000-0x00000001401AE000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 c688854edd55a6480f88e511a6a5d209
SHA1 010b95c1ed7168c77a9256264369e7ce566b3d6d
SHA256 f886054b5acf7c3e789b616869835d9f9e05967acc648820e516d6f5edabfb67
SHA512 ba93c3fc641c630c1fbe7f4379351b82f06d235633322c156b9667fd5f3d068e87cf80aa1723c75dc102b1e36f14f64477aad464bfddfb16785e759b3c516746

memory/1036-124-0x0000000140000000-0x000000014018A000-memory.dmp

memory/2960-122-0x0000000140000000-0x0000000140189000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 bace200ac2b63ac21767611ca61e7c29
SHA1 5c20d81e2b627c61db423b933e29c1b650a3b62e
SHA256 820f66726e3b83feedd7a6144a97de652e4d99fcdbd684d0ceafb0845fd67dc1
SHA512 af91edb452d1035a9ccbbbb9d79ba7fbe251b98832cf85b05b2240933690f414ca8edfd4d8834914f3c4add33b717fa2656eb2849a20fc40d77fc46df93763b8

memory/628-127-0x0000000000400000-0x0000000000576000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 753c4491441bc52ca2c1abb2a51bf942
SHA1 45f5e4150049375c3e87bf5bce2f3e66ddc0528a
SHA256 ab629f83c5a58cdf530861091e8aa35c2d603e4f1235f05f6b12b67afd658b04
SHA512 4cd0b1b1b265f2cbd8e0a336f3ecedd50504b894832c3a4f019f1f9d125f2a0ac54d95db3e013ed67c1073da5a5c730a66305f15ae0b46a1b1d2fb489e700e11

memory/1784-137-0x0000000140000000-0x0000000140174000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 aefea694c76ea736f885da3f67f1c51a
SHA1 ebcaca717acaea151c64356e9ceff8ed9f23bcd1
SHA256 019028afa457a8c0fa8748d3b7387297408fbdf56b482ec69dd638f983f0fa4d
SHA512 b123397be3d368c3155c4fb151d7dd90f9d3993584ebc44db5b0ebc3aca76fcd6fca8e0065229c207baec3b5233e33fe64969921b85a57298dc7016287d2dcba

memory/3644-148-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 be75a55659582c8fa24a29d3e65fe456
SHA1 2948dee174a1f41c1432276cf799442f597a0f76
SHA256 a4b7dbc4f1cd618d188f6b10926013741dd8ec6c7afd281809e29bd9a3c9c6dc
SHA512 99d63c74328e96cac958d9993d45cca7ac4b5d970ff27a31cd043a7a704351bf0d992024fe696767b398b222e27bd5a226b3433125f15aeb09dedb3584041f82

memory/1132-152-0x0000000140000000-0x0000000140175000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 caec0321d5dcc5d6f6a86c1c82137e4f
SHA1 4e0b0aa74679b99219414a161b83960dbd813809
SHA256 c3ea54a419deb55a47f0480ec8d6ba7714b725b18dd4695cd1dc46b7559e667b
SHA512 c61159b0d6f332f623b6e0f151c4cf9dcb709a511d15be7f01e182f52f486d2620b5517b5773fc84c261a36cc3dd994a246c25acef0af2fc55f8bf06dec252e1

memory/2948-172-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2780-171-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4900-177-0x0000000140000000-0x00000001401E1000-memory.dmp

memory/1268-176-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 2a7c4b163b3897eb0ab508c7bd7782ea
SHA1 aaaea8eeec770c50555bcff2190efe726440c157
SHA256 36bde5e78d1175df01853e39587178630e39865e6cff79d52273c5cdf5fd467c
SHA512 0d41f5a7d4bc8a8d985980f4b005abe6745d4bfc6b7b205ae4ae1840b9bcc09f0174ac1cae7406496de95c908d7545d334906278d33be119cdc9ee0316b9b0e1

C:\Windows\System32\TieringEngineService.exe

MD5 b076e800f3721fd264604a509a6886bf
SHA1 1370058d4dd9aca4117528ef3e7bbcb30394a5c9
SHA256 1c97f9af45d7f3f43a0ac1e268a574adaf582f5a71c0926743b6fd852bc5915f
SHA512 54567472c789eb1ade76109187c0ca8ecae6e2bd851b4128d527a187696dfc1f4b333f3965c2f3bda564bd04162a51ff24606507b5f785c8f7cb7902b1c667e0

memory/3228-197-0x0000000140000000-0x00000001401C1000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 3cc28488d197560f2c92e6631f5e9685
SHA1 771b29327d7a922c2104631e6ef02b105ef76459
SHA256 cbdaaa0d31888cb6b3da7e0ad7460e5233455a1074783dd162d988091082bf58
SHA512 2ad45cfa274d814e444cd80a5853d467cc9f001f8dd6dd930f730d2bdfe713d52026ca1e164e631dd37d7363d43993c79fde648c27f12386b108d431a2718d30

memory/2520-199-0x0000000140000000-0x0000000140198000-memory.dmp

memory/3848-206-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3848-212-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 232e32b3204cbbe2f5478e96e4248b1a
SHA1 0f0ec639de7ca54f98f200b9a2052c419c4e3fd7
SHA256 6dca0acda2c1a368c43798faff3d2a4599fb4756c2c34efa2605edd0edd7d96b
SHA512 79dda39706c61c2c68a1eda4466acfb2272ed34d22b776ea683c9a6056f3295bc6ca9768a0457fcf8a246192bf3c872745cc8ea7fa97add5434e48735b67fda6

memory/2096-214-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/4856-223-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 fec6ce36421d49b03b3eeefcad63f6e0
SHA1 c3c1f8fb8ee0230a64c0499a266c04b05ee8fbd8
SHA256 5b7836065299d47ba73e5a4bd9fb00ac121ef973c2cf6f30b3c7eab54c15cea5
SHA512 1b80b40ac8fa17913305055b516772f3a8009ea476d10b3d730fa1a36be8a17c51c635a2d5097696b3de6462224ea74071a36f1b7069e2e79eb16f554672fe2b

memory/1036-226-0x0000000140000000-0x000000014018A000-memory.dmp

memory/5076-227-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 6b028c416057433e314c6f0219e1a7fb
SHA1 b9ed069abecc0a869e058ef138e63a09d6d9e775
SHA256 84c80c13d081660f662440cc44ee75b1b2cd14598d08b96ff5017fcfd0270ffc
SHA512 0ba45f1d96f87df7d50004604fa213340fb2ea45b7b5eb95d50342c5330bc7a4abd8429430eeb407f3b9933f768a8a5d9c22a1dfeb94f75e7e163c023dfaa4eb

memory/628-238-0x0000000000400000-0x0000000000576000-memory.dmp

memory/4804-247-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 e143096910da42b65a4929f5b29fb41b
SHA1 f0a24cba89e36af1c21425cefe9e7d35f960afb4
SHA256 156bb0c7ec614590f09f1fbe0c0bc46a8218c5fcc8a197c4a3209e1fba0615ea
SHA512 c5ace4184242774f6b4911172be94c279cb7a785a467ce986bfacef72513919dcd798bf8724de6f82b9cefefd0961f88df65e3ed2cb5ee89b30ec603c06c16aa

memory/2540-251-0x0000000140000000-0x00000001401A5000-memory.dmp

memory/1784-250-0x0000000140000000-0x0000000140174000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 a4f4e89ad41a7080d86de36214133ed7
SHA1 95852e3041144215fc6efcbe68291d20f1965038
SHA256 62cffb528e4a049b6d5a96cc75029d5a716eac44ddd4754c8b49bd7d5a5a5297
SHA512 2ac0ff402ff8fabe0b3ac264ba577052567ae8d9d354baaa47cc01e72f39d1f6737c368228d2e133fed2ea497ea088f1e2899c713a11c015e17ff1a151ee7103

memory/3300-272-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3644-271-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1132-443-0x0000000140000000-0x0000000140175000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 2c3d68469d0d8ac8a31ca1e0100629a1
SHA1 1d1f239bb640cbc38c0f0b3b74515f3914a50037
SHA256 372ae3f420345ff6a94796d0e74367abc90a7b95e50e12d040d79215af1945be
SHA512 0842d8487cebd623f3565afb18786b495d045e2ed1e12b4f8ebde10ad481619136f134688d8693fa437756ad55207cdacd896ca7219497fd064cca5d668421aa

memory/1616-471-0x0000000000770000-0x00000000007D0000-memory.dmp

memory/1616-470-0x0000000140000000-0x0000000140183000-memory.dmp

C:\Windows\system32\SgrmBroker.exe

MD5 7ecd7bc3f52b45892431eda47656f38c
SHA1 e228999b40c99cf61a5ca0e044356d9d0e0b38bf
SHA256 ea2072b7f0d9c4f7c0d32e8e81ff5b1588c22c6c6c8dafc6822f6535664ec87b
SHA512 47677cb0e4ddc97b6cd20dc0090077957c35f271107eff8a8ee30f3d66b45932a56e0bccfba1b4f45e262024e346ee2afc98b76fbefb4ef61df2dd60c81e77f9

C:\Windows\system32\msiexec.exe

MD5 3f53392ecdef0712bd12929af230bc6b
SHA1 3dac74a8fb25366ea095f83e00ce42c576c0423e
SHA256 cce273acc7878640f0648f601e2368ae3adad40b0c8c674d4d15072384069733
SHA512 660ef1cec5fe8f6bdcd4f1eda98338352021a24033648e6cb506f2b6db34645c1c9f19332f088b39d732696d345fd3bd30778a7b4d039b7a72485680e97cf984

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 7543b2345c1d38867eb0229528ef8890
SHA1 ede735aa55595fb99148815977792c477acbc2cf
SHA256 8158f79f6708004ca96e618d2dd731bd1a61519b2eba99318ff52464ddee281b
SHA512 8a2b25f07c8cd365798823dc374b34b85442f13829420fc339172104fc98cd319f36525c58252913d6a7c8754d2d059babfb7e31c55d24024c3e09efc89ea2a8

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 c03c31c6e1dfe962da9538eeacb37a97
SHA1 6106ca4278cda577a93469e334faf1ea6cf8d6b4
SHA256 484fe249163fb477474813795cf5cc7c6a59fc072d880c9f081f5667c14b7fce
SHA512 33a9075a0155346efff38cd9555b15dd81ef1fdd099d01de69e956b8dec6254abf49e2c4a0103e3fdc9c0ba7d9f410c06b0b161a0b58457ca0882dba589ddf12

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 9e892bec9b04ffd31ca2ae0a808360ae
SHA1 1de6aecd43958b1bb24e52746db3716be4b930eb
SHA256 61a4d1851fce6109a9d501030aba1063236a7e0a07685015dbfa24f1a5bb85d5
SHA512 11c42b1ef2b727e7a57ebf0abfac6de02a7d0e9e95d0eafe23989b7d270f5780bd497cd76a78ee591832f32bfb4c556754e01fbe137c1b8880d52080eadf7ed0

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 fd108f2b605b2e614624c254a9f97156
SHA1 589edc37c27ff94c98273af85c9350317405abb2
SHA256 9da8ec64d4a71628a49cb5d53c679b4672385ff916ddb9a9c985221f46cc9c36
SHA512 b7e2e97f3e13e04ce15bc2804efe95e49f69b0946da93e3004f13853b91c4d3235df5864f50ee71e50bae2dd5309dcceacf5c040d5e92c3bf5bb07208f5eaf3c

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 1441f73b402301aeaf20afd0375aa37b
SHA1 f42603522f2684d759187d51e58764c7a640956a
SHA256 4c4f47699f82d0edb61e6610b60ae5c7536810af5a04b54515757fde2afe4645
SHA512 1ba9c49d059128dd2bc99fc41f68c646043a49e2fda8e45d007ab07b753fe8440d5344eafcde168112f1a59a922a7150dfc044eac62ab1f9d4618b846465b5b4

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 21d08f45aa2eedd006e5aa416069149a
SHA1 83793b16ce3f4ad7a6b6f3ae1262af1f68f974b4
SHA256 cc7ff455f95c857c53a1a370ec3be100c7d449c39a9b3ba10349ed36dea635ba
SHA512 a01a1f05a651d9c98b2db0e007d6a1d40648cd1004dffcc7226bacb0eb4e52fff7f05a523bd0365c3710b409776aa563ff28e4877b6529c29d1c0c4465b07ef5

C:\Program Files\7-Zip\Uninstall.exe

MD5 95f4e5ea2e56642c62998deb1648623b
SHA1 1926ef294764d0aef81102ce5028ab3706235bb8
SHA256 f6e7ecd25c8f1782053e6a096cea7bf9f0b385246380513ae75178334050f484
SHA512 847081b3397388e6937ac3ccf651656c56660a2d6540b0c8efb2a51253e6952837107fd2cd9ab7467021ff17722692c22e8fb2d9adac719f013dfaa07550bd5c

C:\Program Files\7-Zip\7zG.exe

MD5 05b7efd098cc1a310b1d3d279705eb3f
SHA1 896a0de384cdeb63721044681c59856e85a51af1
SHA256 39b2b5bb617133edb6dc8ce4fa1bed271c9dae2c57177bdbc566bc078a865116
SHA512 ad4f08c1a554f3fa81c934917b5cb89865900cee2abed32cf478384e6299c833b6cec9732cb6f1402a0f6c4221da2fb148022df85ae3b0e0c87215a1383a4794

C:\Program Files\7-Zip\7zFM.exe

MD5 5592ad9740a8eab8854c8ec8b3a23dd7
SHA1 995ee2ad673f9376d0e33f3f044cf7fe823658ea
SHA256 100fcfd38de95f9014d15337c7d0ee753f2a20edd725fb7d48449c8ed3adb2eb
SHA512 24d4063cf83570be095ef2e7c9ea79bbf5d9d646144e066cb52c330d65b50cf2d931f54f9d3fb593c6a6ef27c6678611f1fee122a929fe077de9e89afa0f4737

C:\Program Files\7-Zip\7z.exe

MD5 499303c57b9555b0c884b6f8322c85b7
SHA1 ce30d88044d10a3a12f8a15fe99133f2c4dae7e6
SHA256 27acb6e053d231fe7ae1f40bbd2dc6c9f0c7533b2d9c84e30f57c72684eb0eae
SHA512 18d292cf83445f109ad964337013f4a815fb88f73f677645029e9e79f0f11cd83ca642151ac735e6d673d241f4d86dc255105744989aeeafc74f547fbeb870d8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 8d4f594c791f3296a8cff033a1b30833
SHA1 3d41ed00406d425bf0ebfe5a28d0d4b76c82de21
SHA256 e64a45fd77b50a51f4297b0859fe633b5355aba677b09a501aae5c15ffb40241
SHA512 9043aa04e6a7fbe3032d6b7cccd6bf63074ca7abd2efb91e122d8825ab141d8e8cbaf81c73fd58f491f7a45a04ab6d4485fa412c880fe0ef0a2fcf2fbe1df661

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 1b5021638e448a4c43328b484169712f
SHA1 1f334a378119f6b51c1b952c2dffd9aef148aa96
SHA256 4f50b37b28e891b9795c88bf022bcb65fddd3451e2cd06064198551da7f1bb82
SHA512 5abd110e5e756b08bf4c846ec8c7642bc0baf8ab895f0fc95db99f70d66e62949a9d00c9427e983ae467d0433ac3e42a412b264eb7def356b0536274a817af8a

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 6c18d71aa77e22a68211c95aee040746
SHA1 2e181b993c6d04ae2536153383223a599afa90a2
SHA256 097d70e8f9143fca8579bf0dcceb68436dddb210f9c5ab6c12c8162c05bb5425
SHA512 21dda6c04e9998f448d17c14027f1f9ecf5baab92cbb19c3a99f393fcdb5f954c4a05a69e57d1c6bf63a31d49dba10f222df56e347a19bbfec6430b989b5606b

C:\Program Files\dotnet\dotnet.exe

MD5 99d949b57d2904945fc68aa27658ed9b
SHA1 670c3acfe48216d47d0fa5e882bef9b32f9791d7
SHA256 9a82ec2c8ad774565466e671d3a44033007c8651bb870147048671e85fdea6eb
SHA512 ad0d5ddc5a9cf93f73702ec6101700e874a2825af13a784e010ae730edc9a648e2003833481bd24e245815c8dc87bd5d5218e02db0ba70f85cc2d89431a4fcde

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 b8167d19cf7b9001088f83f21488d024
SHA1 f040be35dc175c616e1479e94e2f6a02cb97c6b9
SHA256 ff34364a568f4e5efcca5d9d3e27b0b70f90e80fd3ffa0c2faf25c1fbdf7d2d4
SHA512 1c5b58e54358559967694c2e60ab6fcd8084046378af7d5f59e64e26e943cdc6dbe3500f6ae2e1257c86439a015be62901e96c2621d7e0f2e0edd51acd94222e

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 87344b33e9a2f22467fc6cbee8529348
SHA1 0c9ef9f5296a934841f266f1873ef73085b13cca
SHA256 5ef69a83e698c5cca114f255b2983f995644a1a54eeb827a8fe9a71b948ec2c8
SHA512 46693fa4797ab0ae798a7a65adc4b0c8e2dbda957dd1f5f731361c5895e7074298bdc08730d9a7e1bad3e6c66b9c94817e853d2bc9b20251db1ef28df572766e

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 aa52fc64fe582ac0104a91dfc4549277
SHA1 8acb830cbea232392ff43085d2b40ab7b0d2837a
SHA256 6529a3f3bebe2995544fc8246bf55a0b72d0634047dab3dd63f417029f559fe2
SHA512 b81989456afa1e5769c13dab944197addf47b2a252c06405d56f3573df9d89cc75a6f8b2828f162821054f2f5a921de2da5c67d1c6eeffee9d7cb93f6f6206cf

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 4edd3e33d0ed4afdd4ef1fa95670a125
SHA1 33b295733097bae8b0a3a415e7458aa1d03c4a80
SHA256 2ba36e9025c0daf63b4b59534c6f281cdc8edf300dc4a34c2d365b4264f0edf5
SHA512 e33f95c3fe34cd8c411abba1342b8fe43e052b793527ec072a53e43f438458099d0057a8e3168d3a3bbd1f63c497a63da8e0de80872cd5ad804fce83b4b3194b

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 4eac3a1826617bad8cef3612d4215562
SHA1 4b280b8660e96ede4e57a2d718a95ca01e14c744
SHA256 9b37c52ddfc1c79f6f8cd2f86f82bce137cf8b7d9b2f6b606a917d4147e3bf05
SHA512 46bfc89799c2773ef782d2da223f0ba316133cd44fb1ed8a87a4dc08c7404ad19a8f35249bc996b6182b384a687bdf2789e9a9744ceb451915fa2a7263b2196f

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 cfc3e656af3d496152a8281520cc5d29
SHA1 8d3f4b729fef2d56463da47f9284fcfc092d3372
SHA256 cb0c66bf598eccc64ac4ae32fe6d0f8ec0f663086e5ef2edc2299f4e64a779bd
SHA512 1b31f71ac6836a3e3864f8537d58e1cf2ac36c3cc4485fbd77b9b3daa64efcfa0d1d35e92341ead0b6aa5b189c320f9105d71e2a2843ee82f743e274a22e5de6

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 8096453b8b3a4d5291e9c8f6d6c1b7d3
SHA1 17e167570798bc4e70a7b961f5cbd576c86b9a07
SHA256 c49d019af76fd934ee11e5715d560b65a09ec9f2e9cf0272242cd6cdc6aede30
SHA512 2db9ce3884c2de53dee8bf2143dfb31b39a69d821a54bf9614bb24d73c7e2e760468d370d4c717ac37160672c6bbf892d5ed096be1d9ed68dffbd9e850338f31

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 bc8c55894adaeb2dbc4f7188e754866a
SHA1 c0209764701e55a4d8086212bc8369c7244b9355
SHA256 14b4c1fe0b0ed995d5fa963300bf808d1e1281d4e3d9e14663a369ad794a752b
SHA512 40092afa1f0f06efe9d0bdd82ae589332c732eeb8886de45d79eda6b7381e1883d329f4fedd9d93cd76fbb77fc174536ce93050b0a0c074f2b9adb74e9ea2d23

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 8fd6260e7ec88f3709d935df5698af27
SHA1 267c3d4b1f3a57bd379edb81d6977bebd914f439
SHA256 815824182f2f4346b64683c299c626a1bdf8deb14344916f4125ccfe60758b7f
SHA512 ff30695e7870b4652b07884a0c764de16935eee37736d766df4cd9878847ed3c8f9abf31bfcbab9bb12987d5eaca6a09846df55c0364bc2b86a82ebb3a04970c

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 de1d84816d93211328641d9066f3a042
SHA1 a18e54b6114f121b557cb824a0a9f33972a3be48
SHA256 cc055343908e0f282395c076b0254e1418a06dd49711323e7f99a12a0bc68939
SHA512 f308709b02fa500511f93913d3da9df9e44a637f808af44ca2cc5d07681ae58dcff887714c6e9c0151e8b176f6c274ac5225ecb605d696ba9a1f0c222ce683a1

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 43210e65dc0af55ed781d360b4177755
SHA1 0845bcf7663844d36bbd26b8dcd6d737a7b9ed1f
SHA256 0bdc10cdde2be1182da139aba343c913efbfa908de9cea4fd05333d30c414190
SHA512 86421f6f75b13fdf76eab44a0ff2fa0394fabae6a89491eb5e1bdc91aa2de7e9e141a3b050c1ca69b1ea45b5880f701ab606d454f6ec766bc53e7033c948b158

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 33e2acb1b95f1318922f1924362af40c
SHA1 d2b880f29e760216a6022d6cdee6b1b189a8c258
SHA256 3792abc369ece2c4184e3385680618720011524a097d194c623173f00cd40524
SHA512 af6f9473812c93644655655ba238eb9946329bcb52ea8cefb0184e812588c985d2b90411456572356baecc0d2135ddd5689ac98a72c5eef8efc9d1bbf5d04ac3

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 a8afad6fe7cfbc58f4e250ced64e83bd
SHA1 0337a39d6cf2d54ffed1411a995d13e241057522
SHA256 1a6d0f51345b29558a2a0503d8d8413b645472fdeff1372e15e2b171b1fe3309
SHA512 77625c7fb9827094a3f256cb119496a71505f5a6e7db02bdac361d74a5abebecf967a952122006366e3c9bf4f92b7936db5ff0641d7c0b2a5e34b6343dfa100e

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 2b4b42a9a870dba9561f090358d995cf
SHA1 6ec45a2111c1c7c620119b619b111d19bc5993cf
SHA256 cfae7562b8d8875287ca486f3184cb7e90609f8d5e93a48c71a87b01191af46d
SHA512 da11a618ecdd0f1d758cf252815e50bb418ce0278d861ad12c76f465605761056976d4a3f7aa83961af29c56eb59f42e799f9aab07568084dd5fc5a70aaa4c60

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 faab49642c28438f3fcb80685b940038
SHA1 64f372d21566719ba74461b37fb6cf3d17b4797a
SHA256 8a8bc67f5c73714b7a626bb9e623a2b8797384d09887f368eef764422df1d3a0
SHA512 cb80d1e241f4579cbddedef1d720858a384cd727f83e2bfdf5688613b471559d0153ed18d1c214e150ea319c3b12a234bc0cc9292ece0b2d33cf91c6bd228252

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 9e6eb3d3807e8007bb8c6764335528d2
SHA1 4849d2d32e6d0c02c371cce93ebf798dc474480c
SHA256 d06828c3d4f29e3bec40c5a2217af3a02a5edf05bad8a298d0974a19cb53b97e
SHA512 7b04d3b9626c44dc707dfcfa5a150431eb75b3719c6246c5de88465859ad0c8859017a7b038d88ee85abbc1b30526d845089945bfe97e1b8ba07fad0f3d041a9

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 48e7adea1d732c06db1df868fb8034f3
SHA1 44d2268d02639d56168c8cf83dc9f5e5a7092257
SHA256 eea85afcbb40e52b0df109fde31208c0448b462e46583c04ebf413dcab17d73d
SHA512 09b0970086e9762d119a26ccb62a270dbe5b84a4b9670309a903ff2de7c2fe637d6ece1f11845c1181ec7d5c981535d100b44dc0b494c51aadaacb1a5573b17f

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 641397c15f1a70761c66779306c478d0
SHA1 adb55e99897254b89226ee00653407a3ea5021fb
SHA256 99d8010b47cded5dbdbbd908f2cdf23caa3ccde5e4355868111dbc0715c6ce04
SHA512 76cab37a8ff4a8bc47327979ade1dda09f06feb6dcb19a3ec655aeb771296e40f36deed27f8453263f7757c3af944510c145f82f8dda6fcd191c21b992692be7

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 f1dd09725d10d688f442beb453e8e1e3
SHA1 19ed00948238713d9d0908ad83d4fe14b4bf1e83
SHA256 2027c6ef443ce6a1d2c07494492b79e39ae20b98f8e5bbbaf5a64a2294260c02
SHA512 fa9ed15dbc0d52418948241242414caa3baa562295a81c56ba97823752e235168810428b5c1413f93852aa05725a1c09a37b44046d167d811624f936c62bdff1

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 3a221014e282737f050b8cd0a90368ad
SHA1 74f50d9a062e1e5696648de29b4bc3cbdf2148d9
SHA256 d8529a7c2e02a8e055e40793fe3d1012ab584e0d05fc8e7cd6e746ba6e3294b8
SHA512 80c5955ea6d81b0ef2f15e02e9cd383f88ae99dc03c23a87368ec0665bee8808af11b3633f9a7fd37f4ab7e3c1960534d9a989bf9a59c5d09f43f489809f3052

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 4cb74aa95b17be67d893ebebbf0ae5bb
SHA1 01490d9d3bd5353dfa69e85cd29806b660c69742
SHA256 43655427fc3a39bc80ff8e3e8e9e32f620b74801dc442d89f319e4656afb69bc
SHA512 3e9d5cde8908994caf25e3cd36d6ce615ae2503247d262e25ace352ec83c556b5ae80814685dcd52a18ce0c54799f5d7f943d5e984f72c63795c8d52dcab4e45

memory/2948-607-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3644-612-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4900-613-0x0000000140000000-0x00000001401E1000-memory.dmp

memory/3228-615-0x0000000140000000-0x00000001401C1000-memory.dmp

memory/4856-616-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5076-617-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4804-621-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2540-622-0x0000000140000000-0x00000001401A5000-memory.dmp

memory/3300-623-0x0000000140000000-0x0000000140179000-memory.dmp