Malware Analysis Report

2024-11-13 14:28

Sample ID 240604-ag3keaec5x
Target 15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe
SHA256 9d87815401169d64cb8e075b09ef332257172e60324da20513bbd36db74e5264
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

9d87815401169d64cb8e075b09ef332257172e60324da20513bbd36db74e5264

Threat Level: Shows suspicious behavior

The file 15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Checks processor information in registry

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 00:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 00:11

Reported

2024-06-04 00:14

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\378e32b61ed82f9f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af4ccbd613b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7aa76da13b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b81adda13b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4d312d713b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d428f1d913b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c4ff8d913b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f639b8d613b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094eac8d613b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 54.157.24.8:80 przvgke.biz tcp
US 54.157.24.8:80 przvgke.biz tcp
US 54.157.24.8:80 przvgke.biz tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.24.157.54.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 61.43.200.44.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 44.208.124.139:80 fwiwk.biz tcp
US 44.208.124.139:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 54.80.154.23:80 deoci.biz tcp
US 8.8.8.8:53 197.86.237.3.in-addr.arpa udp
US 8.8.8.8:53 139.124.208.44.in-addr.arpa udp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 23.154.80.54.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 54.80.154.23:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 3.237.86.197:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 54.80.154.23:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 86.104.213.44.in-addr.arpa udp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 173.204.218.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp

Files

memory/936-0-0x0000000001EE0000-0x0000000001F40000-memory.dmp

memory/936-9-0x0000000001EE0000-0x0000000001F40000-memory.dmp

memory/936-8-0x0000000140000000-0x0000000140184000-memory.dmp

C:\Windows\System32\alg.exe

MD5 3971a113fe39a1f0cddb607bd016db62
SHA1 013f5f9ba75e3a911538b978aab6eabbca9e7393
SHA256 7a14028997e94404235346a33f42f8b7f154f026d404d05807401075f3dc5404
SHA512 2c5baf012d120bbdd1cdceea7e87dfb94989fcab1f8286c55433455df84d84323b9c0a93318245e6d271f12623d7f9e73c7d6155cea45ec3518f0a47c605676b

memory/1944-13-0x0000000000710000-0x0000000000770000-memory.dmp

memory/1944-22-0x0000000000710000-0x0000000000770000-memory.dmp

memory/1944-21-0x0000000140000000-0x000000014018A000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 683e248221023f61c4ff6d058e88c02a
SHA1 0ffb886c6a6758dbb25ba1d67dfa198cd280ebb5
SHA256 5cea2f2fe1905ac864e3077f6dc7d857307eb551f3e8ae95c785b6967cb0f603
SHA512 ea4930a259f03a8b39404b79a46dfdbec401b35979b2987a785cd9850916a3284c60c238f9ce62e32c9fd696f50e5a24c7f1a76482967d180845248985e4a9c2

memory/380-28-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/380-36-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/380-35-0x0000000140000000-0x0000000140189000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 851d0c37456d9afeefd120cc0239873b
SHA1 b78c96c4ccce2a0994354565458d7d4c0238070d
SHA256 c512d2279f868eb3060dd966e3006c6ee700b5f544cdeed23cf0535399ad8f92
SHA512 e8f18021ce2995abaaabc7eae1f30f27978fdb95d0c70d020ece3a00cb404be30cf28ff1a89c0a2f008865089ad8145c03421782b5cecb88fea69c1744b32cf2

memory/2368-39-0x0000000000810000-0x0000000000870000-memory.dmp

memory/2368-45-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 f396db4425b3ed0dfcc7e91098ac785d
SHA1 9cbc92b98c676eca997be8225cc58d4704b23228
SHA256 436822352f57765249a86a29c48867408190b3e053d1f640366c8ddd9c69f734
SHA512 4d5cae6e11c7d4d7d6daa2deb869e8c5bb04b2ec218cb9c4890a6044cf29ae1a871cf68d1a56841f132ce2bba7826539089945d8be06a98e24f1ea686e14142b

memory/1872-56-0x0000000000510000-0x0000000000570000-memory.dmp

memory/1872-58-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2468-61-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1252-81-0x0000000001A40000-0x0000000001AA0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 b9ef0f4c3bceeed385566347680824f8
SHA1 d1b70de79c21a5ae29965442679e86981d83c3cc
SHA256 f154c6fa729843c28bb152e7aa994eb77c4c7cc6242cde1c3b1db008f5833143
SHA512 fc7e47ff07325f7410fcd4d4b747454c75b5e861fbafb844c10ca7b3da06ceb917a302d1fd9eae5ddb3a0535f19c4ec618ce58240d0a506a7e5f69048fb39fc3

memory/3560-85-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 c1c98676edcbb70e5b53be4eaf290d8e
SHA1 f2449e63810d233ec395e54dd9bcc077bb840ff2
SHA256 2bbbe354d91fb5207ebc46d778f243793ac4b50524ccb055669c4905fd49552d
SHA512 fffa6d187597f063c8f1ec9cc0929d5601f83af2598167ea0859da1e9ec8bf40478a5a1f5a9adfa13938d2969e0fb13b1a1736194cccb48bae032af4512ba6bb

C:\Windows\SysWOW64\perfhost.exe

MD5 7fc71d25bbdc949a03353daff2d975a3
SHA1 500879f0cb930620400399c2e2f0a796f23f95b1
SHA256 0c741d5413a8ee16346cf7092747ee321cbf87f7b60360fe023889e647a889c4
SHA512 4c5cd1d79e8f8c6a83f27f9c43cf1d28551aa66b29a8a9afb34ceb42edc65924fb8151a230350aef351f87a400b71058475a255f27ecae0f9c34417e6039c3ad

C:\Windows\System32\Locator.exe

MD5 8e529b68a77097aae02914671c40e944
SHA1 f41213b4d5532b8c50b3ca6170bb20bea4f96e11
SHA256 a7ca391f5bc58a70eee7c4c3922da73083ea12807c315d08007cdef52283f4a5
SHA512 4fed16809f1ff0a591873dd8ea44dde3a58ae857261de030996c89fc3cb4711a1e719bac0b6ae2c9411894d55d6da033aa7a3897f227f3d0db9d9990e813d56f

C:\Windows\System32\SensorDataService.exe

MD5 bd59e26ef3236660f78e827cbee05a09
SHA1 3ea491c924f3d9ae6c0c543ca68361941abbc39f
SHA256 6a6a23223af6e9542852c1506071669e7737a5ea19eb8e6e299798b9409e6565
SHA512 e6dc2b030ddf0c5b96f9d06c11dd517aec0dd5845f8b12c1d6df9dff0e14f116b3d42f319d141fe87f31b8ba8f053e264217c2d515b4ed332ebc1534d29a2f35

C:\Windows\System32\snmptrap.exe

MD5 0f91bcc7c8c76041be2d1013843d1a59
SHA1 b931ce6011e8f17b711407052af193d918135d17
SHA256 72a52ce3a955aeed78e5c7bf1254b2478e15c49cdeb1cdde24950aa907e112f5
SHA512 1e0a82b98b70cf570646ea718fcf31d761281879af8bc924a1e333cd25fd9fd50d5d3f390efe43d6244892126d03eab7800870541044410d5488cac6bc36ca2a

C:\Windows\System32\Spectrum.exe

MD5 42d97e2af958879d9ee2fdd5f66d52b7
SHA1 5027c9f0aed181fb4fa9a070d2c3659eb3195054
SHA256 147ab2d770857125c53d9b57dfd8cf7d78e9d73036408c261a995fdb1ca7a727
SHA512 4c53d40de2770ed0100cfc5a11baf068253cc2da3de65dbf1df8e67cf63b9c57626822820d1e4e22d51edab4c4472647d3e12e8ec0579434ab288296e58db1ff

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 eeebc3a97d564e748ed6a15e44f5cddf
SHA1 fcaccca3ffb6f061ec801d4f17964db76722ffc5
SHA256 ac689ca6a8a9179fbe43f02e065aacf77082a31b6f2570f6eb82153d766750ae
SHA512 87bcf73df922a23d42c368057d70a008477ccfce75815847416940a068e512c5673a00b3b9f16b60a28b920a0b97f6568290b4fb6675ed6b514f1c11cea46277

C:\Windows\System32\TieringEngineService.exe

MD5 0c452b368d71a69a441d3041513e7fc5
SHA1 1ae02a37ec088a30376bf2645babf1bd705250c5
SHA256 b43067dbbcd4983b44ca89da73a0134acdd2da0e7a1b99e7bc378d201854a00f
SHA512 0320966c3200fded82f576b6cb3eced3bc4f3f4c47855a9f7a22295fcd71c0cdd0519d9f797be310bd255be619e3a38102b3fd7e1b498d3f0c4f9e94bde537a5

C:\Windows\System32\AgentService.exe

MD5 8a4013eed809b7615f5950e46d24971d
SHA1 b9ee68f01e8101c4b021dcde549e87322306f0d0
SHA256 0d040bfa11cb47d7593ba0bb45007a78420a0d2f94bc833fcb04e73ed2b84667
SHA512 568a49acc42f6210996603ac757d569214d4b56d04f4f07744133bef5d1bcb57831b480a7134baf4314450fd259f510b9f084af9a726b636b2811c865f07130b

C:\Windows\System32\vds.exe

MD5 95ca4966e64b2ac02b9f9bd777dd1358
SHA1 8c4eb07c91b762a5b3d3441fc485f114e2a5eb04
SHA256 a03bb6730f41960972bb10e0d8a7e0e30d4d9ea76046dd250fbfb0e752475aa4
SHA512 9aab94a4da63bbfaf825d763a6a089d22aa995a05de5a49a6db6071a8b407b3c1dca062ec543994e667c5f15630e5cb40a536bce7afd9d873e6d0ca8272bc6a1

C:\Windows\System32\VSSVC.exe

MD5 a865e6158b548a1204ff98015be0fb0c
SHA1 108a8b72893b49c9718422443869684bd5ca1423
SHA256 dba315b3fbc1ac03e649507d592b9bb2c23abf4ff3c710451ea08b88a25d9688
SHA512 b7c12aa49c928fe8fd47bc92eddc111fda66b63261471fefa63e8cd67e878f18e5f570d94d73bc054894377e3df5219dae77a616d557eb285cb6692c3cd0daaf

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 271aaec6aa43a8622dd5ea4e59d1e4b4
SHA1 6bb9aa928598ff10a077009dca9cb751dfd3c0b9
SHA256 0176bd809776a9c5ce806e16e2e629e62a983285900f335e0dcdaba72ce531a7
SHA512 ed087dc7fa8850959daac8b8c48ad9dd2f62e9ed017eddfa0dbc51bc9fa6e2a05ec6ed66c6b702ee2aca5fe07d40a8924ae37d1027c9f6b42fd9230a3f692154

C:\Windows\System32\SearchIndexer.exe

MD5 a9905c52591ceaa632b2a2bc263c7ebf
SHA1 1bd68afcd49bbcea999f94cf7a695d31cee46e5d
SHA256 4b63bd178786d8fc9e5180161d7251a4628e0185aa9e6a266e9d9e69b2bcfb57
SHA512 8e816aabe86301a30edfb4281783426499125d6f8fbdfdafd354020e4f46e24d6a273861b7219fa70e16275b63670b658ef91721c42a6c68fe8c4b5af49407c5

memory/2872-254-0x0000000140000000-0x000000014018B000-memory.dmp

memory/536-259-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/644-263-0x0000000140000000-0x00000001401C2000-memory.dmp

memory/1020-268-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4036-267-0x0000000140000000-0x00000001401A6000-memory.dmp

memory/2624-266-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1620-265-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2732-264-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4404-262-0x0000000140000000-0x00000001401E2000-memory.dmp

memory/4668-261-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2368-342-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3980-260-0x0000000140000000-0x0000000140176000-memory.dmp

memory/5004-256-0x0000000140000000-0x0000000140175000-memory.dmp

memory/4736-255-0x0000000000400000-0x0000000000577000-memory.dmp

memory/2680-253-0x0000000140000000-0x00000001401AF000-memory.dmp

memory/3560-252-0x0000000140000000-0x0000000140199000-memory.dmp

memory/2468-251-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 1245806c3a36ca8a101a35b0c4e89fba
SHA1 67927acc2dc3b80aea55c5a2700e666412145bb6
SHA256 0a0cfe3c61a9a5095308919a5b40f257231988e6c0c8b43e825dab68e936a907
SHA512 308ce25b8a84cd02709e768e90cf9e1567a9511461e5676f52b7b46dbba5fe946dc0326dc46fa1ace56ef9960e3da590ca72c7b5a8961575b9f1a4540d34638e

memory/2388-194-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 9dd867fef393a67d4ffa18231f596036
SHA1 df426dfbbaf140384b96dce8436b553fb86e1e81
SHA256 c7e7bfc02ff972aef94c32a72bcb3ae811e074c4758c3124979a40e524169d5d
SHA512 7dad3fdb851ee755196e0a850ed3b5a0e68d1d11187feaee023907d17b49f3e3dcbdfb1bb3e04a869d219eb268f334ab3885d50663d319406007b188d16ae8c2

memory/1252-83-0x0000000140000000-0x00000001401AF000-memory.dmp

memory/1252-77-0x0000000001A40000-0x0000000001AA0000-memory.dmp

memory/1252-71-0x0000000001A40000-0x0000000001AA0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a48f76e5673cda7d8577db3deebee609
SHA1 f9388a220ff282a554939b3eb7835df61fd299dc
SHA256 58399e5f8e3b19eb09811b227091aef310eeca6af316f87a1aa9e7bf4fde4e9e
SHA512 388b8b6d320c226ffbbac6cb13ba865be7d928b02a6ecbadd75a942d3f2cc1cdb636061b807e09511b34bbe965c78c95ab72bc79bd8c5d898c4bea9c16d93a74

memory/2468-67-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 afa27d060df712ed22eb63049a3fd286
SHA1 793bd17ef0e96f60e8c2c50198e6cf17f178ebd2
SHA256 0fe054bdcba82c8e72f88b9d6e55c66c684d7af380b096d3ce160f34fe0bd988
SHA512 d036b4f6fef539dc1611eeb3c47f2f6d3b8ac824954671a69a456e552b220000170fdc075f29e59da105fcb4d7dc271a68d4084a0b411938ecdf6f9901389d74

memory/1872-50-0x0000000000510000-0x0000000000570000-memory.dmp

memory/2368-48-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 e453a2269210495c3cd9bb73fb4fbe4c
SHA1 eacf976712add76a9f8f64f24e3247cfe2867bac
SHA256 0e80c936bebae1a462ff617f683486aa77c80559d544c5531dddc711d6994ae1
SHA512 155003daf2b6dab323df72e368ed94c2766f81ccf6ba9272d6e19ec0ebd5256fa7bd198c63557fcd89ce3a408d0cb8653fa2b537e42a80e415270b011f2a4bfe

memory/936-440-0x0000000140000000-0x0000000140184000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 c90fb9171bea74285e425d5e6af8ae4b
SHA1 c082dc9e31e09973a694ddbd39d0a20862c0902f
SHA256 9583e08a1a5b817cdc2406dbcb0f806dca6952f2d54ae5ddcd78d1daf1a9b6b3
SHA512 69a811f52f9ff2270ec690e041d888ab64305a2152b0d1670ddda7ac770ad438987ed550e4cc084b190c02807af0b70fb6f16a6573616679366b2c948bc1b27a

C:\Windows\system32\SgrmBroker.exe

MD5 d041b94c52fb11028fe08195c178d8d1
SHA1 095bcf825379faccebfec07280e763a60df5a1ed
SHA256 532616a23a360a711fbbd8addcf56b213106f81e22604da3c498fa5eee01851e
SHA512 2bdea29dd99243c0a2146994f0a1224033aa2ec4ec1794ce4eef38b0a82bc40f0003b2145d64d1d84625300883e3b87323d22a39b763fbf4cafec4a408341398

C:\Windows\system32\msiexec.exe

MD5 1413894615ba3aa058035c5080249956
SHA1 9e030802639e15e29c872b834f9bfb71b033554c
SHA256 3fb79c3159d638a5c5c5b86c834390f4a7c4bc26919747f4135084ca1ab3f4bb
SHA512 1ba6d83acf2a7aec60c8aca53f04425693d1f993f7a3f4543bfc500817b1c92a6840ca397f16233a1bb5061e6495d08a083ee82c94967caaca24dcecf20bd27f

memory/936-439-0x0000000001EE0000-0x0000000001F40000-memory.dmp

C:\Program Files\7-Zip\7zFM.exe

MD5 90f67aa8391cc69918328857c66b5e7d
SHA1 58906e80f414da40c1b757f555f1982002efdfb8
SHA256 1980eb470422524d52300ca32a04cd99bab164362b50d0c649178c00e5b25b56
SHA512 63a9e716cec9f7989aaa1b72a3ab05a43e5b45b4e7104660ad80f867acdce31ee22b9140e5bebb48f1e98ab47a40b25e21a3f0ff50b038ff50520e726ab26ef1

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 aff0b9106691e7e8830224535f286f7d
SHA1 47c5426398e9d0b498bf4e90b61cf73c464d7173
SHA256 06b74c2a7794f425b2a7e792abed79a595db3bbc71baf3b58fa9be23ee2fe98c
SHA512 55bc8d30fdc2f628039c08e2abe9646574bebf0b3046cf5a553a941bb87b909014e769f119f6bc6bc20a1541e46e2ca4942a954c22b5ac0dd33016ba069eb447

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 762f3557e19aa78ab4598d61892548a8
SHA1 4630e9593df75633ad9154e1bb99de0c3e986693
SHA256 225d963b03582987ae54decb80f37f7a0603d92cd329a9dce3938779ce8743b9
SHA512 23d335cc1f23c41bb0f9eda247b1c6711c924ed3e51e7b66208644ada1782dddd70257c4e6c2120f1b2c0a90a9495f9585b21f71fef78c4e28644b5c7a05d983

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 2bd0bc42bf99538315e521a3b6d263f9
SHA1 12d2284fa980a3a492cce7c12fa69660a19f502d
SHA256 d86641e6359d02c911342e85e2f56dfae51b7fe6d18a68d95f0eb982d068a3ba
SHA512 b2d3107d11514f0cc314f52dc82b899b41512ef43784b7b2c86c186e38485fc68aa9c78688461880479aafcddc38307585368de7ed270302e5e39b72c63cfbcb

C:\Program Files\7-Zip\Uninstall.exe

MD5 cb7f335dd9b247a869ea8cdd03d177c1
SHA1 5488aac0339af2cd836827f33a5edd7a13eade6f
SHA256 42f8d8c44f389f19c5231854b113379d7e8b1bd49cff6eb77f8f361c0b56894f
SHA512 6de13743a1f48d3bfeed50705e6ee2674b48a16697a1b2720f59885fec738a3db0ef2b93bbe6c3d5ae3d4eab7c64fcbc55fbc821e7189477be0f70b872b0625c

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 6026dcada525220e8dfd701dc869a683
SHA1 76ba663b7cf9f88e9bc937dfe49fb8182d88b5b4
SHA256 c9b0bde4683bcf23a8c638cfaaf95a15b8bbd7233e81ec5da994a4fec8a663ff
SHA512 7fd61d9f7cac7cf16da61b4d68d1803df5c4f817ff08d786cd7fd7ce6836b8b3b27ad2c0bc5b4b597597dbf59e0f716c2b9ea0606d151b1eff33868609dd6ba7

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 4a948272cadd5fbdca1b962276438148
SHA1 003c94c5e5dde9a27c1d8fe6ad76ce02ce0224cb
SHA256 e5a64b25dd693fe8ad2e8e8a5ecd4d90a0a3363e5da75302de983b44e2dddc36
SHA512 d87538de876d882334fbc3ec6201c15f09aebecf682cddf1bf8e6efa0be6423390553716e79c6fe42fb9f46e5df62de2b41e3aa6505a812a6bbf9bb0ba8f492e

C:\Program Files\7-Zip\7z.exe

MD5 d3bf40e5b37e4061dd6c3149407d1b79
SHA1 11f4af0bce610d8c803e5254b2fd4df13184b7fd
SHA256 de79b0f3685c9a521d49c4238d37a8113bb8abc3e2c4695bcc8d44216ed093f4
SHA512 b8ec9a655ebf7d63920110d715e9427e13506de591cc302d50feb033a24672bb56605e0b05b26284c3f463253ff5314a11301a5e7a0ec411f76260bc9eebc075

C:\Program Files\7-Zip\7zG.exe

MD5 9c89caeaeca6aebde9c307b5e35db5b1
SHA1 0d3af90a9bec5818d46e4ee653375ceb63f9cedf
SHA256 faec869b7bab8fd8000a787f4d97f088ff43769732dd8214e9c5e5a5824547c7
SHA512 c04b9b46ab25103b2be41dda8299630f096b0a9ff22d9f52a6d9947e04322617f099c64d7f67090def3eb65103eac50dd9a9ce332320221b9459af7b40488d0b

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 7b25e2757b1e1f6734c9e8eeba1570ed
SHA1 702e49d3a52d511155fe6a5c86467fc199db09f9
SHA256 8587c2a79eb1cad6f388c2a8e6c4f85cd0ab5d4cc27eb03fe2519b03802cb08b
SHA512 bd92314599b6b0379fa5ec17f1c2847c29607a68c5e9c5001c7f195aeb781f8f26b150fae3474e20871af79b3e473a7e011cfb9a75c070bf04907919546f4939

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 135cfab3c8d9f0ca7b48ab587cf17ab9
SHA1 ea615edb5f4063853cc0828fb7b88fa8fd904b16
SHA256 9696bdeb8dbc58e8e278bdaf6179f6a164d8281716a3461b41734fa2b155a57e
SHA512 eb9a0f72c27a72cdb65f520c5db8bb0551a7da7fd92396f906bc9fede3e9c32ff9c3ed5b167018f9f4159067fa05bb0bbc8160d696bc3b11a64b546eeb3b2d81

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 361c9e41cad612d39478c7c348a70faf
SHA1 4f1d874e389e58e7bed98b8602536d64a18334cf
SHA256 823c877bf5e6fe3be4c7e963fed163c14f7c8edf4a62ef5443ec9823466cb7fa
SHA512 dd4202ab72c4847a54bc8283d32411b0a059e5e0c9ac437fb2a93a1be1e054a2c76e01dafe189dd11402239f4af773476fc79db706e030159dd05e744a22dced

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 0855b9874bfa785ff5554770cce0d685
SHA1 f4687b4ceebb3118f315a70baaed65640039b0b3
SHA256 4b9c581d2ccfec8ae2914ef373cd169641ee9c9f057f536ba12046969587a4af
SHA512 4c4ac3db41ff09687d1a6386b0e343e1cd79f3278b8080fc2835a3d2f0736b54c9e4cc8e3f6232ac396afbe5bd2aee5a801677ac74c80fd1048af360a52ce235

C:\Program Files\dotnet\dotnet.exe

MD5 4b41a741e4d1b141d88af0511acbbd7b
SHA1 88f7de190023a43939b64816a42abc5c3415f289
SHA256 d01e80f31d8414cc3b12411be0524ef9662bafd3b5747b9866c96040f43ef9a3
SHA512 641b78cbf6b18d77d994dead989bfee918cf51d2082d8bbb3b6e012a6dd9bc7b2f2fad67eae3f3f578032d253f9d75fbc6cd3da2298a7b61fae8d5b587becfbb

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 b8a0e1491e9d81a1167071f64c12e988
SHA1 9766243454753f95a89f85f0a7f1cb15fea562ce
SHA256 acdfffc1933e8e403e9996f249aa1d7bbc0d93d2a1e9c1d84a402339a0d817ac
SHA512 35dd8681cfa347889ddfe3ef6f1ed09d824efffc3c56afebda4d085bee20831cacdd6a7ef933ef9d5cbcdeeaadbbc4b56b3089575721b0076aaa2caf841fdb73

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 09a71a6f1d25e65226b366c37a84bed3
SHA1 b524bb37bcd069a9afcf549d5c76e1a57dbd6ddb
SHA256 47c5aa2e56e0c3ea5687f0a505e92598abf406abcd606bb50e7893b942b13ec2
SHA512 bbf7c635e8ece5181097333fb9c3f51ba6fe01729dfb7cb36215161035863a9809bfd5e582c56ccaa88acbebf92f5d6c630226fc0c707c7b1f0b82bfaaa5bf13

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 8820199ccc699208c7604005a1d5283f
SHA1 49fc9a8a97178565385c46d4b81b07aa4fa03548
SHA256 64afb7050ba3e6913d9aa8a2f3a3d4c61a6a1b15048a5264586e13a6198707e2
SHA512 7748403030612334fb956acce401882bb3022dd85c1a765975c31f7ed665f32e0de5c9e6ad862163281d4c7f691bdc24976b551569fb6aca5dfe036f9f14ad5f

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 2bd361fce51a6eaad8eb15909af0189e
SHA1 c664470888e0549f23d8b0213d193c95c7fdee1a
SHA256 fd2f54ecf64550fa10c1a334fe9cecdc68eb186cadc84fca7c0c7ab5770c492e
SHA512 4d81eb663ab45ac9b0c2e7faa10e0eaa32faaa1632bd276ab062713238b48641e47a9733eb6e798ba227de3fbd7bfc4e7b007732a67a536cb3192140a713dcb0

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 d3a599e6b0dab56929e6f3e999b5346b
SHA1 850fec0d098aba5d2ccc4beeed81906a74523a7f
SHA256 ac5dc39748fea1f49c40da83f5ed0ec889d7d0f2eab9be00491131ba774240bc
SHA512 65272b541fcfbfa7738b5a7f6c370175c94403ca879afaa342910b19a12384229dda4084d32840932f6793dfe14b74ad13d14bf0536c09859098d1881f2e581b

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 f79eb23bc6db43573b95fbb07aad4c12
SHA1 afe60f8b4986170875ea730088d6b8113626289b
SHA256 07608ebc86efd59261c64d386e2f0b85dd9957579289d9463e8917dbeebec30b
SHA512 b09dee3da73a36cc6aba848439782433806232bb2f25734aaa68571a29fbec9d5679913a8664dd902763cff894cbe6218bc2c067c0e076f33ae583dca2b15664

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 5866078f9f0099445d8d1be670ebde12
SHA1 d274e8a0a006ce278fb4713f62c3479c2cf8943f
SHA256 816653a2c3983387b169d5260af6145485357417e321ffa753f38d2a16b0cd62
SHA512 655c0d7805e485656d81db9666f977962fbcfaef75fa6af5bd32316807ff0ebdde6b51b6d85371d7bc39ea0c24f0cce2e1ce93214aead974bb6b198a442e216b

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 c70034a7db67d8508e8b7de7d08ab889
SHA1 24e13ae2ec0137fccd477301a795cf3ec4a2c82a
SHA256 02577e1c3bb7db48f13f7a5206265d3880ffc7f05f62ca31d692706ab92c3cc1
SHA512 8de0d1f9fa7f4ff58c56a542d34c6fb0982077126f91b67079b327c5719af47fc81268f6cd1b6d57296658dce8ae5e15e50208e3fb78ad5dbcf4e6a905fe1bd5

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 49149e2497adb80ee50b2a43419cce92
SHA1 879104cba982da90efb1fa59c96a4fe5d64efbc7
SHA256 c0bb349887badef64c57ae8dcda6899623643ce641e5de6a3aa481039b8331f5
SHA512 6ae4fb22d082e15e17a5e1af2e79c0e07d35101c03fecb6e075cadb4264d8d0cac7c3451b81b057ea0889022e494cec95e39026ecb2c10ea9670edb024a008a6

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 15f6d6b0c3ebeeee6d585676535a87f7
SHA1 76ccca21479cdf6f74e9310d060bed664f8871cd
SHA256 9531b7daf42c4c61220882101bb1f96471bd3ddec9cc353378ce432c0aed02eb
SHA512 d483369fd571e4e77459553bf66ce5b3c685b752495a591a5d49ea4215c3c9eda92cc6989b8253413c70d2e978c33adf1a73c8c80754c398ffe6f9f2632e64a8

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 9ba7fd916fda2b194ce01d6ccae19d9d
SHA1 b29d3173c19e8c8a29f804ef91adf78502d4cd01
SHA256 b6f968b4b6ab356d229d76a903bd91a201cf59d88fcedd2002fede0e510df45d
SHA512 0e0624d9843ed9eef65218dc64b2ad1cef2ef2dbaeeb87c9ba0a9cee07d20aa826310c7d530cb16d9d1bd1ca8eebd2806769773d9a4a1ffe88f65279f08689f6

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 e1a0c96def54cd8f324180ba9945f4ef
SHA1 12f8546bb37a07b2eb00a65ffb9f719a94888a98
SHA256 84a5d01c4c43816cb1896ea6a8daf6aa183b48b30f51c968afa44f9681453454
SHA512 45a0ca38f2dcfb2fb8f67beb637ac533ed3acea1fe8fc31fbedda141b133c07bcb1250c4fe1cda54e4d5752d762a398be71c61f5715c2a36acff55233352cccc

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 3192f1118da7e936517ff1b840270230
SHA1 a0897c953522ba453facabe238e97b8658b47cf0
SHA256 0aeff19ba9d19612a09b9320a598697c3a891daeccf157cd17948a068f1df7dc
SHA512 45af3ace9e2cc085261cf767685d6e17c6ea8337c5dbc85d11b09c180c626f3f45374c067f10aceb32b450568b57d49a042fdfc4b33b22e34f1575cd7ce813bd

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 176363cb929f465abd1795679969648a
SHA1 8ed267a02f681b7dfa844980aa0f068c325e5319
SHA256 0a1ccc0c050c21e10d156d5bf3ce3eaa5692aae7651f2992863cbcb7b07b503b
SHA512 3b14c9bd6e5e5b765b9e0fa2002a18694f8d6a98fc67b3da8775449b04d3046f9ad4b37978bf62493b49ec060cc01c0352691d585aaa10d6951481e0a44fec13

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 ca422948c045d970a8242db35d0e2e25
SHA1 3e25aba83f3d92bbf0fdd4fe7816df11de930bee
SHA256 f6505c6667a9638396a350402c35ba15b92996f91cabe56ef8c3e2c9d6f519f4
SHA512 4dcddc7780c90436ecd38c077a7acabb281d985956204a1c2ded9d2e93aa4009ae504c37637719adca3b56c4ed2e101bfc9c574093a57334455a6f4855937002

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 ded31b1aa8670cfbc23d447ec367fedf
SHA1 ee130bb1a6830994de90e01bc824c6f1bf1d5605
SHA256 6180c09d243404b71825cc8c0583fa7156a6824d893875ed8d092ba80e76d86a
SHA512 fe30e7e7d40217247a8708fb0499855304b137cab1d97c7973e4394fe58810180487fbc94046b2560a220dcb2b5751118e011a8be0978c927c5a49fb90c18bb1

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 1f78f4f2c1870a4f13003c8d5773f19f
SHA1 dee8164d1a046f658e07cea3494a022eea2e224c
SHA256 6c79d4648b33479b7ba904ad301b35d9761867fcdce481b357bbc160bfd878a2
SHA512 e6568367dc0f820604e280f01d9c15261d3d83b8b826a167a6c37ad3ca5af5ae13052fdb90dcfac992212c075ec7068fc61689887d509cc75fbc4995988fc69d

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 bcf57c63e9b84152cf6413f939ee8fc5
SHA1 4485f9f5ff148c34cb7088440eeedace52afcf45
SHA256 e2cc348aed6c7aa0eb30fd0b13b30f20b6b7d21b54ac8efce20d6b3d662b6d59
SHA512 e5988dc5f6d78ee536a140fd1dedd90d290da925799cb430752a52d9283be2ffee3684abeb6c6dfdf27178f237a253646b6c0c2df906d5b2a603b3a042a47312

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 7d437ce01476a4d3a98f0249cae95165
SHA1 315ae9c9264dbbeca5e024efae2a0923dbc1b5d7
SHA256 b26187fb2c13e883f208ab51a5a22af800f3a7c7d2dddcadad02f56bf895fb56
SHA512 3d4100cfbcb8dc48a792baa7912f7ac77b23c68a0a6cd71cd4fe04c139cf50f1636da7f83c305fb5df409144699b998739ae296bea568d539f9fafddb603f6d8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 9fd8342aade606ba2b33938f992aa4a6
SHA1 0b5693fd55fd11ab7d7e006d169480b79fd20d3a
SHA256 69e21ea975d0454865cf60d7334d7dd87e0d0a2ce6267090e79d724fe0936339
SHA512 a8cd56c8d179389ea9f2f6bde5d3ed71747c0364f2a8d13c5438779cf2b615770ab291a94eb92a1d069e2fbee4ffa49ad8706ee04fb8f93354ff0ea39c025176

memory/536-497-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1944-578-0x0000000140000000-0x000000014018A000-memory.dmp

memory/380-579-0x0000000140000000-0x0000000140189000-memory.dmp

memory/1872-582-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2468-583-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1020-585-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4036-584-0x0000000140000000-0x00000001401A6000-memory.dmp