Malware Analysis Report

2024-11-30 04:19

Sample ID 240613-a8gr1s1grn
Target 51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe
SHA256 b3063154641c373cc96faa348b1144b4bdc4a6e11702e0e91d17f946179bf540
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

b3063154641c373cc96faa348b1144b4bdc4a6e11702e0e91d17f946179bf540

Threat Level: Shows suspicious behavior

The file 51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 00:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 00:52

Reported

2024-06-13 00:55

Platform

win7-20240611-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe"

Network

N/A

Files

memory/236-0-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/236-1-0x00000000004B0000-0x0000000000517000-memory.dmp

memory/236-6-0x00000000004B0000-0x0000000000517000-memory.dmp

memory/236-12-0x0000000000400000-0x00000000004AC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 00:52

Reported

2024-06-13 00:55

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2d94376e1ed82f9f.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008825663c2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081b7963b2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc56753b2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005118b83b2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008be7893c2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c72bcb3b2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009dc7e73b2cbdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\51927c83c4802b0ad4e5a34c6528cf30_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/372-0-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/372-2-0x0000000000930000-0x0000000000997000-memory.dmp

memory/372-8-0x0000000000930000-0x0000000000997000-memory.dmp

C:\Windows\System32\alg.exe

MD5 5986ad6e94f4070b855758eb43cb7545
SHA1 153316ec8a442cd0f02196cde2c369037fb141d8
SHA256 048ec0c5e6a48c1ff08375272d6264ded2d1e2f01bb3bc1235133d73552b71a8
SHA512 95b00e3ea202bc3db3455c614b2c67055537e4adea3b005dd36b55b0df75c87fd583063ae8bb2c142bc0e85cf9fd8b5023f056e2654fa9cafaa925f6bd872757

memory/2680-12-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 b058ed3ec968a1271dc1aef0a48cd9ea
SHA1 1e5b5f8744c7df57618059705ed68a69c49194f1
SHA256 287cce1ab0b9490dda3baad26dd17c9c7cb5f00efb630e839629e95af208b263
SHA512 90ceefd4a45f431fe59e2cc8f47a45c66894a41d53f6bfdc2bf98fb18a7a24134e57bacb408cfaf24b9c31c7ab79899d4e2ddcfe806a5f789ee9732c209d3d5e

memory/1680-19-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/372-17-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/1680-20-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/1680-26-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 7f1709259fdefccdae07a23ea7d6a346
SHA1 505c0086c72c3793cc5444748a39fa6fa531e213
SHA256 06466b22e482320dc81f7dda7e57a186654d441782c42d1b4c0bb4fbf806e749
SHA512 74b23c1b132ebbece8a13cbd97c42e57a326dcb3801cef0e54f0bf13b02d684b67655eb41bd1080af3658c99941722263db7bbc3cd6142926171b82258df3d70

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 733f626aa70756186db8ba5cb3fa59db
SHA1 1c113ded7a395dd05d4acb849fc36d74251a8b8d
SHA256 b72d9aedbed831968de99d784fcb5412a557be1d8b23cee1eb1094b467bc803c
SHA512 5a4862ed555339f0285545c53edebcb9be89f1ff117a58d175d0d528106f72bc3e99eeb06d41a06604cdc53f7179c93ded71f487367f046910bce0586bc02081

memory/1508-40-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1508-32-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/1508-41-0x0000000000D40000-0x0000000000DA0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 6ac554002149e73906519e4aafbdf9b1
SHA1 5c9525e0fda07fe8ba29011c30283d6b5cec6439
SHA256 2178e2ffa3b21d9246ec947a92a54a224d39b585232a46691e95f6dceba5bc1c
SHA512 e47a860d4180583cdc80c9bb518649254ec7eb8a8d9a5f31733b38a679dd8b4c8e9088d2a2216b8b83073a5a094a26e48ca8bd26cf058b535e389887370dc798

memory/3740-52-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 8b1184e55a8ac962f5c390a67e77a8bc
SHA1 d265a763ba95392127b7034dba94e3683743c64f
SHA256 5516dd9ff6ff4b9a149347f9d442bbb911e3b41c68de0f8a4eb642a8d1684f72
SHA512 a469ca3a53a9d48c91bf5c96837180b6d7d438de5e5cc1205f1fab717028f405875658afd2f3517b2368a8fb05c9a3c72f0aaab32ecd3e3fa7139f104b8657bc

memory/4656-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4420-66-0x0000000000510000-0x0000000000570000-memory.dmp

memory/4656-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4656-81-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4420-80-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4656-78-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4420-72-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 3dfffc5a0c725e0304b6ee77e07aa589
SHA1 85714bb43ce4419277df4a8ff1ddf5a9d55176cf
SHA256 624732ec3d79c5a8124744f6ece5468efee67e22937873a7ff2f583bcf6a571f
SHA512 fab21d05cb04d91af6da6063a5a7eb2f19b29e4a5c07434f55b650ae67b9c8e66551308389c3ed3d109df37cc7529696e0eebf5798d47e23c7c7ab02f2a38e72

memory/4656-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/3740-44-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3740-50-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2680-237-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1680-238-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1508-239-0x0000000140000000-0x000000014024B000-memory.dmp

memory/3740-242-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 8e50ca549349bab8233b168b2df7a382
SHA1 715ee5feb327da61562ab56263b2e1cb4638115b
SHA256 0e211ca5d80e22ea84d7639f2e5ae438ea7d0ae0d1f67a35ebc4ba8e45c038d1
SHA512 c82c043aded05b6a2e6e86945ea0fadf579606bd14cad7e7b1a470b89ac38ecedccbec86892ef9bc0887fa74f654820fcfaad7565f3a0e1fb9f58862afedc447

memory/1224-247-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 8fc178d8a1848aa35caa6fb4da7d2e24
SHA1 0e330153193e38eb8847b6dd818f1d5cc49b5f0f
SHA256 130f10888cc7acebbd9cedaf7f0b290f5f752214e840b1a4cf2f5a02a8561558
SHA512 ae466abc550eea819addf89825f3612a2683199f65d89d247860417837e7b165507aa9ca703398b10874cda712aa255921627e5b85eddaf96ff04fcf0b50eaaf

memory/2088-251-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/1224-252-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 09da06c549aeb71a589c2db344df860e
SHA1 eb7aa784c9f5831495ebe4b7ccfb40093d83ea77
SHA256 7457f6bc243173063f217326eb054c2a933758c83b0ff71ed8c6fef113daee1f
SHA512 82c0810eb238430be75f16cdda620679b2705549007975b4fa3dbb2f97fe9742ee806772583436dc0719daed4eec22750287fbbdc0af24cd0f98ecdb40558e56

memory/4164-265-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4164-262-0x0000000000610000-0x0000000000670000-memory.dmp

memory/4164-256-0x0000000000610000-0x0000000000670000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 713dc2b116110d07eed02c7f3cf37c20
SHA1 0418792acb40dcf4ab763fa0211d0c15320b01da
SHA256 cce54e95eedfc68dbf0af423015f16d62d14d74c68cbf29b672e549cf28595c1
SHA512 5c87bca6f29a011e71a5a3ce99f49a8008f35ee0a12cdb194046526d01cedab6477b0b245f25957f74d7282964feaf3ea57474266e681e388547122471989e24

memory/2372-270-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2372-271-0x0000000000630000-0x0000000000697000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 1f42b64e847f5a518025825dbecc41a3
SHA1 9881ce05659513fc2cd0bace8ae7457b21a4c100
SHA256 8113dda7479f3b3d39b9f2be2ebadd490497d37a6cc1511fdfa7a92d914aac0a
SHA512 762b71cc0855402affc718404c1a68eb09ebaf70fd6049a1285bf99c2bbabdcdf8cc081f465ca7b944b60a9ec840496223fe489286852f88151dfabb8149c619

memory/2228-280-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 4301d6ae63e73d5fa8833052d685b633
SHA1 a650ddb1cecceeeb45958a73a0bacb80d282d58f
SHA256 b12b74ecb77959d2ab5de2ec830fdc2bb7c56dfd46cda2dd1f3ec72abc710bc5
SHA512 62267adbd5387ad11dc25df4d1e8e4170dbf74986bacbed92d1de8667704c488bb26b8b47f2845141da1111027a8a395eeea79b148767902dc7c188f7e2af24f

memory/1912-283-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 982a5337904c784e234d092ac2a2322a
SHA1 82d5341ead3f6055c8327ecf52a29b81cf81fbf8
SHA256 2657e17b920ebab87775368be7f3af4751966267a7a248fb806835c19723aad7
SHA512 6b950873b4b3d4096022fa865089f0e33a096db5589b0e4763a45f9444893c9102220d12c2b9da0b19a26e6a638b29046f71447973bc0f837bb0335c04913974

memory/1720-287-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 bb546bc6bccea49073112ab01d9ebd53
SHA1 cc8ea17ff2d81bb5f21ed31ee8afc8032b42e01d
SHA256 026d368bfc739c317e079140e9cf3aeb92b50fbfaec7ce1f510eb480390dfe00
SHA512 a71658ddf567a1a565194aa936f7f1f947af66e823902a98300c96497f4fa599bf89576f41d0610a19f40c5787ea2dd3020f4d1e70f07c053bbdb6188c1bb063

memory/4592-290-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 5ca1fd22e6c23903a0381a1b8389c318
SHA1 462842d9fab4948b3e6d66e8125679d9885d9023
SHA256 319416308999f57b53350d632a1b3ff68831b3e060c8844d91a58f57f08cfbff
SHA512 cee37690e760e518c66795d02a17bf0aa339612737c0fb4755c0ae7fe450badd54190f1b5301c7b008cc5d41c06ab104dd9f65a8c870f7f78e64b04216036aa7

memory/4972-302-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 f4e5d0ac60d89bf0d804755357244fe5
SHA1 9e4ff885fc8480a9608116c9a06e8c6fa156992f
SHA256 82005fb9fe110e57a49731ec61af7e773f835d5bff75fdf95d613c9056bed0c3
SHA512 ba315bc23ad7bea963fcb227c90dbe4fb8a2073bec8b2588503413825bf7c8aebf6fc4bd47a9cb535f4847d37ec9009a539d8ddeefadbd3df21010cd407d812b

memory/2492-313-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 9673a8079ef9c2798408543d3470ec0f
SHA1 abb0f1138732c5e8f8a37ef6ec2194934e5ac381
SHA256 0bf623b795f893836320492c47bffd2c62b7d296de41cf0a2c546cdfef9a36d3
SHA512 33de05b6c40503622a6d72c405f1abbd1026ef805d9458959004a0fe73b27c88fc30255d0f11eec5d8c3705a98b5b856f6ecf9a98615922bda6fb2cc0f782785

memory/3024-316-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3024-318-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 cd1311dba972e09b5d86a4f7a26f7707
SHA1 d0d26c95592348c450f5ec5bcba24d70d472a5a7
SHA256 c7b3daa54c212d848e9d6c2d78109a44ce0eb63b6787dc50d0fcd96cc60dbac1
SHA512 515002e658a73c8705a81f44178c428d25c7842286b7385f5eab4ff5fe9bb44257449094e999d0829ed1e1eb15b84e9705f258f37f1275e76d750fca6a9ce665

memory/2088-320-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4300-321-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 1dc9dbadfc68c959c4b74a04f55efbcf
SHA1 c19ed7ff4aec4d9ac575426357b0c9dfd842b02b
SHA256 f950a3f515fdfc0f4499f1b610b71e1b60adc0314233dd3a04d85a3c3316e577
SHA512 46287e668a10fe405b6de1a8745b0742e8b0ca47f35c79d65145b15ebcbc42f51203249d79642f2f65e4dfe494ebd4c6a84ccd83602e9840e3ac6101fdf1e389

memory/4164-324-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/1664-325-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 aa889304e731cc7b1cbb5daeb2114b98
SHA1 f74e7e2af497551bd6f2fbd0d43c4332f3abb7dc
SHA256 f33d874acf221da66afa32726de40818f6acc48daf02b4450fd1f645ee0e1142
SHA512 e844325368699a9e5b4238370994c2db3300b97b7d93f0cc88744789130112c9a78690f3fe11cb2df364dc17959d298ea839da67795a6a99ac0cb861eb812789

memory/2372-328-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7d724d600c52554b6b8c25976c96f1dc
SHA1 f717c394be3a0288a9cebf12fd0755c378d7f2c7
SHA256 bfda36f39bcde355695b2a1391630440ee1dfad7a303708c4a4ddbb64f92c194
SHA512 32a5449a634a18f07a93f90e4a5d481d9b9694d76c944bb4c06696c3ed8d6b7361d8f797e0ccdb81c5fa20ad905c68600c527e3fff665f857435b1801551f656

memory/3060-333-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 d8d4a88cd2df3e5388ced89d6b4a219e
SHA1 ee8bcbc506393cf0715fad9983c384b9036e2ff9
SHA256 e8951608b140e4564c3f738c8f754134ed8f291401797cc00780bdc3d11b61dd
SHA512 8937b56b2ca2da7ad6dbde1e2f04844c4f3d206c6eb5263632d8c6b4a69780d37794a4a6c98a5546cf957a9bb39aab97a78261513530098559512052010746be

memory/4156-334-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/4004-337-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1912-336-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\7-Zip\7zFM.exe

MD5 c7088b24a269ad35f47471650edc8a59
SHA1 ff4b605182af2f6f149b3599be7009d7432395c4
SHA256 748842f126f1052b51ac97cc061d33faf420747d7a16ba243500b25993f0da66
SHA512 67450bc1c2053aa51699bc1053c38e3a33dab89ddab27c2d335c9ea3a9c84033a3a42f38d2fae1d31eb66ef5e0156192208b701c23ad9bf4ee3d16e0cf5eac77

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 a98375cfe739c39b8242d81b4433790d
SHA1 5c87d0bdb07b282936d3949b09bbe4fc15862e94
SHA256 19b1b941ceb60743672b93322ea514ee70db83fa2450e2e426ef0dc51f5a37ba
SHA512 05e4bf42b3c9f3b6ca00da2f136bf05ef4a88fc817cffdd8ce478cd1f98641a47ac69d1f0d829c0a3624eb36e3cb10978e660b3a34d975382e24049f79305666

C:\Program Files\7-Zip\7zG.exe

MD5 62d5f000059d11d2e038649b500fa014
SHA1 3446a7b8f38acd4430107c1791a311d1b5d05301
SHA256 0ab7a829b8316f63ed3c4407e15d07c6a33f41d00e05def47d5d8c41ddd499d4
SHA512 b2179d86df388d3bcfbef15cf0715f028e79b320f9786e1d8a5c0a3365b03f39b12f430cdc2f8c5286a5af82fcc4975d9a310154a0220b506e601df750c23adb

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 d49383f7547c4bdea880c44194cced2a
SHA1 1a33c8d27b672a8fb15947f366f9734607c32637
SHA256 dff7fc2d534a623736bf8e8d61a59ebbae233f588ab511ff206a6770d6269799
SHA512 c36718f27f1523de2514bf062eeaef843945a4b37e653e2b1b5627cceeaa0e75a65c363a12886be967a38b303a9456897ae8890594eb70ab62a0cb44b6b17ebe

C:\Program Files\7-Zip\7z.exe

MD5 dee98a4c747be533b18d46f2a78f83b7
SHA1 3aeaf4f2397407867c4ded5d249e86cbd1a321a0
SHA256 808f2d1a9f6772b2bb1f6a3e909312c5f9a7865b3829af431093e001218f0bf8
SHA512 c9eece34cdeee8999cdd9f58887ab3474dcba29798c4a2c6fea60ea39a83c1abc43fb977444f57eb30230e28b3cdd29810ad14ba917001c17b6640b1b61ae0f4

C:\Program Files\7-Zip\Uninstall.exe

MD5 5677f3a23633f421d236f4fcab6f2456
SHA1 46b9d6a46af85a6ee00fa814198b7890f66518c4
SHA256 7ea650aa9a184ead102b4a9fb4b2005040075aa87985bba5cad958f16fa0be44
SHA512 284c6da37afbc93ea6b79ef2de00c7eb605265e149f4008a1a08839d6c766e180ff0cb6eb75247bc8e9b9204ed325fc4d0a5d0c5773b5ef60184a30996dfb982

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 2c1a0b33d7c4dc94817aa095071bf29c
SHA1 92eeb9eeef05e2f24b58f3239d9211d938bef240
SHA256 9f7ba6c50b8e0d74d31eb136da02c8b0622359f1a03d9abd3448772863013ac3
SHA512 68c03be27419d74c8bff1060c19226ec18b61c580c7b0d7b1b5a8210469a61706b857b4af7d4d2055cc1905733d69d977506ab7820661bea59f3aa2f69218902

C:\Program Files\dotnet\dotnet.exe

MD5 e39a7bdd9dc6b92a276a1e74f1df256b
SHA1 8cc027d8f1e086691b12e75b42cbd4ade4542267
SHA256 e8b5918c14b4df38734cfec6b4c1fbebc3dbe49d0970ea15e9530d2bf756be5b
SHA512 57fae7648a8c8be6b60fe883aa43f362b4adefc5a12ff287ec64b8ee18fb033b302ff011fe24998aceb418f52ae5f0a6286a01e8a39af39703bf3b5f4462ac46

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 549ce9e703a2475b60a3727e2f532bcd
SHA1 98ee9ef704c0c6bfe52b76aaddf522c23bda6d56
SHA256 e8f0ea0935c975c800109d2d2b46791f84dfc61489226feb04bdaef8aeb1b22e
SHA512 ebaf534e25f636bf38d0fe793deb7c444f18dadb098e3e4a07c73a1702809ba351c8920a941603fc059a3c5231fc4e82c1ed7ff0b240cec7394e5d41dec0a7b8

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 d3939961f67348913765bdb37d68f9da
SHA1 faa2280c073ce552587b3b865cbcc7c8dec04dfc
SHA256 44ea0db72b7793a811fe86412095bb13f7e73c445276ffe5c8f74ec8d857f800
SHA512 9e76dd4977c79610c525d8016ca340b97041c99900db871c4f91d2619127c3e1651e5e241cd1ff3ac51e3900c566c8ff2d1d345809bfe1a70bad520fecbb797d

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 d1187356732d0bb1d11060df3270dd4a
SHA1 5c17d2fd34e1f63f783c20e9fe437d6d2e7f4b6a
SHA256 3032ce9879e9403205f95174a244091b6dd0f4d33ce6f7863b0bb3049ee8bb36
SHA512 b6bb329bbab770a55ada5f31eddede719d935441e61e2dca496ad85e0911a68d73a5e91fe0e73f4f5fe66589827d6bc9748f8a07ac2ea83e3795203ee651b89f

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 011cd0bc91ec4ca21b2b2009d0c33f1e
SHA1 4b45d0899dd9b97f3f2b2c163acfafdeb42f3160
SHA256 30116eaa14ce8784416883194fd6b07820dbd1a624ecdf0f3f7faad2334e10b4
SHA512 99add9d5f818e5660dcd448f8d146f0221c1d0cceb5e3a805713c7a1d0be232be7ff741701befddd2afa98a88f7276e41adbb0d53119e36c51725203a92aad09

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 1051615a5ca68c495e66342196016b06
SHA1 7ad4dd169a3021fa6272462a34a4c02d921c6f65
SHA256 c97700473eb34ac0923c0bf48133704eadf0d054c38863aa15823f2ff3bb18c7
SHA512 2000d6b726ab59098f576dd4c9b4a3eabb4d29e56fd9cc856fe54f4afe1076b07cf74f520ed8b59becd38f6242104c8a71a1c79308517fd79a3956956c8b84e5

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 3b547d6018939349aca346472fd21c97
SHA1 7d229e5ba3d7f5292a207dc2d7297f9c5086ac67
SHA256 2d5bbbca10f664aef5f30e41c1fa5e1a28aa39e141469081ffcc1585500a5eb9
SHA512 c223561a6cc117cc7eaa0cac29f9bb54e3775dae69178e6cae97217ebfbd3f1990b814798685bc2aef96c23e1f012036d3e04fe0a011942b5a7a6cd4446cb9ed

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 942052b1206a88dc1e6f4ac422bf27d8
SHA1 5145afeeead45c5b579433dcd002adc976c7500b
SHA256 d7d0f0ecf052f9e68e613f0736d290196be501b499b7bc4d950f3292d682c01e
SHA512 51fcb056d75e1e7e65ba8ae5aa5c8a1c911aeb4347cf45331954c0dfd8055ad2dbbb7abc6a2d4f04fc1b97e7f9f9c1ff4b3abd3b70d6e2edefd3bd6a552e5b6f

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 42df3f2309d9f74b13330eea772c61a9
SHA1 079dcb2642ce16b2227f9d23ce4f9badf25739a2
SHA256 f2836447bf8fa85427d10de723756070b70b73d0ad9fb92eae44a7fd627bc4f5
SHA512 0d4c6bd0bc3593bd629dda16ad412614072504f42d24d387ba2bc51ecfd2cbe527a70c5724acb1586ae1661ff31b2a8759dd9a446733f0285a5de4ecdb64a080

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 b577d33c1d52cc9b578d4ecd4831e3da
SHA1 022724e97978fcebc08344c0f3f754bc95c738eb
SHA256 48d8955fc606cacc2ab3b2b5e15cf84b2944207766b946a63d758319e32daca3
SHA512 f9debe9e706bd62b565196eda4e47ab16f27c380464faaa0fcd6ae92d78f013961ec85897231eb5f65c6f6ba046e41622917cb3ba6bf2d925f1981c0f5a32613

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 af42fa07df3dff0f2678932c7f54c0ae
SHA1 f1e0baa33651d02b51d5dd51aef8b93a65a87720
SHA256 c0996f1aa0136143f3cc81305fed0d7c43f00841660fe508f1bb9b820f77be7c
SHA512 273bafcada707a63b83a4d5a9e631da5db8d48250f24a14d3456a85ceb4a30f10d475627ad3e42db09db247bc3d65f3cb553a4993792781aed2a09286cda323a

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 5f91e3d758fc2b71bc6b30c5923037bf
SHA1 404095b0bc225110f71122d5bf37dd8f8bff069f
SHA256 7efab1fe2346c63a0bb55d40a3eff75476cc6cdfd9579774588ac7f4a795c3cc
SHA512 bb765fdf8a2c81726eb2bc28df74dbc1e5a839fa41327ab146152e00dec3274e8f39bef3cd3a2662ba15697dd6c26ca3b9e5be63680a8b05b5a115e31154be66

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 c44ef1822dd79c1cd7a5b0f7c4fef2fc
SHA1 7c83c81e3d76e1e5aab9891d95ef6bc8f2cc6354
SHA256 c3407fc062c43d0bf4fb0961e867a76135d32d1f38af700093eee5477e114564
SHA512 2cfb2b0f97610012f3a60b9cf59487d4131a6d46f3ab37a4acf7a5a2bf921c514b36d8670fb2843846a461527e3cbaa03358e428b3b69ccf0d924d93aa53f586

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 39a849a11f7454fb60d0b54e2e0ffbf5
SHA1 c12de77cb572869a60b3bbbe850b47b970daedc1
SHA256 5ff7f460673c74d6c60d26403a5f821cd64b106def2dba3a519a8f7847d14ac6
SHA512 f1a14ba2f38c3bdda7d12d84dde5e44999d0e4b3fb431f9cf585d8cdfa60930f6d3ae93474d79ceebcdaa84325ac7d59b4b1bae0231c4690a2000b1d2a179b9d

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 542b459805ebf320bf9c05da2143b7f2
SHA1 46c3b45d8ae55576828aa9acbdd83e4e497baba8
SHA256 5144c5903559b943adba45c5f74237448c2c546f400b485be2fb953a89eb96fa
SHA512 6d57d754f99c00c1dc315904a3632291a32bba7876c679f972a0455485127cf7352cb0481dd6f2ac91db572e24bf6869158671875af4fc8889550362528fa301

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 0e76c40785e7daf4be494a1e352e17b0
SHA1 b80dbc540573c849eb598e4dba65e8e8db11461f
SHA256 e4c9cb77aef55705165ce23b196ee3ca76541c7fe991a9ab1b650e3d3a574bc9
SHA512 81b6983a35a2b73f01be35b2a25a99fe6f4a2f683dfaea8781add03ab65d4d9324baa54e50de5c67fe4eb4d65e81733ee7b83230fed4688ad6188fe2a3361e79

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 6bf558aea0c287151297a2220d16302f
SHA1 fcf902043ff92e7dfe94d6293219542d0369c233
SHA256 a27ddd12d46b299d2f223431c1ecc2a28316336f3a987001c64e2e37d881bb67
SHA512 973a9d3b2ee355419ea637dcab92d00ae40460295471bf762ce3657ef2f42188ea10d66fcb3f4fa25c5b072aebd93eb7c5a59561637941447847485bc00cc282

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 2cccc0dbbe5df6951ba1292e469ba2ae
SHA1 cfba1a7d99cb6d112799c023132efd56b32ae793
SHA256 3636948247fb877cd87dcf16213a23184260c895d6d01afe117b4bee16fae08e
SHA512 6274dd5ee7b231499394a207e515bf59d06aa5a3d044140e8ad869b7f23feca21937f6a4c8771bdd351114ccbe9e0869a9bea38de42fa60aed13dcb4de073939

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 dc6aa2bb1ed057fdb9e38cd4af3a7a51
SHA1 7739f4bd53d5a77b8f003d81d7a46eccbc74ae57
SHA256 42bfb6e55395f8715836d7500fb02485768d33ab7c7eb0a6ccf2eab775b95a2a
SHA512 bc0ca33cf97ec2ab13b6c2344d1e1a528207f98bb98e5020c2c2f8e99bd683834daa9e6b310b68647d14987c3bc74ebd957582c1abcf01a71f1fdceeea0266b0

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 e67d6391df25700bd2b2466ebdd093c2
SHA1 bd9483accd4eeba220747a1dbab55233da013281
SHA256 4a2ee25300d1bb7a80b899335a90f1a396b0c781def1d312c81e5b995a461c79
SHA512 7ab1651441a8830de91c5ec8388961d0d60ef6f49814801d4bf8ab2f467d28f2c394ccbf0bd6113fac485c3218302d7c3944103a1fdebead78def5592e17715c

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 54aae42ba314cc2d7a7ec56d5ae5320d
SHA1 9f10e6baded3e81472c3d68acc0c9e4f72139618
SHA256 86f887ed1022e9683c38d731d583df7ba21dd55c6a3b952bb26be9e36d306e0a
SHA512 df70c04bae4ff393073f3abf92c2f82194e35720ba43925cacb3c21de3c19244e9f7a333dfb5436aa83569d3daec1a93860b652b8350eb50227eaba35b8482c7

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 6bf0cbc003172406e8c13e25666a0990
SHA1 642384cde3239b156772f2dc43b96fb23fc1cb96
SHA256 14e725348f300ed4cfe38d36d933d92c8ceb9646290f567b1ceb68c63ae730ed
SHA512 2e98113bcc0808c7f5f795d867ba9441cbce5e1bee5e5d4510f6a684b4875a166b9703b3e13fe17a910d6ff96914c32e37be7ec4368cbeaa5cdddd7842a892ad

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 f4412a13810e805a0d096f8499bfac51
SHA1 b91f2b4d0c9ba674462438b4c9706b8700f2ebb7
SHA256 b818aef5414cd3b81badbb0400ce0e087e17321ff1ed2f02eb204b2fd49ade78
SHA512 4089156a2d0298d3d5dd9cd4688c8acdbe9b331ba9850088f29b6872c41735fc97db5f075c0133d80dc886c1fccdc92a49ebbe2a04ce71522a81a9d5d2e3b927

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 be52a6ff18e1a468424ccec7c79fc0b7
SHA1 9d5a79cc834921d0df939d67894a9942a1dc9912
SHA256 5f03ff9f43b400d788e9700a418d7fafd6ec6d21d9aea22267d504eb268e859e
SHA512 1370f95396c8d64426101279aada550b010459938d42b0b492a2df13cdb4f247050df54bb06e008a1402308d77ec2c4a29b54b1b87ef8c039f3a7985f4ae2454

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 3abb834f9ede6f8700e0b46a027fe7ac
SHA1 fd1dafb151231310d66a4f110adef3aca64c46e5
SHA256 e1c1daa19a1b94e955ab98552da7bb0ccfe25fe8327d2811c2ea45fb699a319d
SHA512 04d871b33f585008f5c1393ad0b1fb6a77fe3d32aeb1d659c7ccfcf4c42cd259f156f77f48f0a6d6fddcb5afa7ee2924422e6f3fd2c6aa8a2df6dfa2cce1b769

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 0a0ab082588e87b424d430306703f075
SHA1 414746e2c382dd3798cc64632484e45046fba375
SHA256 01ebecc5783b9ec89a149100f1f071fb492a0fab0316f9fd6f37d965f2c0c40e
SHA512 27d02fb797a347161bd8591d0c45efb4ae1a25bf53229c16af39063f07121b7f0b5ec471b0cc93e8032fee78b54acfa91585037fd2e17423e59c486d7e177759

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 9d466aac758a32eb0c15befe727e31fd
SHA1 c639c43782cde77882de4c0a92e85d36683224e0
SHA256 43e02a10186d961851f6e0f17a068db6d962630230db489d47b60e1d08971414
SHA512 ac72963600f0e60a597aedad11fc39bba5e85222a60904f98de00463449774ed9eeffa378e95a6ead51cd792d18cafdc824090b270a86d9af6460b167ef2a112

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 e4ed2a8adc0d513e95338af6410dcc91
SHA1 53c357a303812244af7acf1d2132c03d1548139c
SHA256 2efa37ddebd6fe5b19ce6c0516fe30c17df9875838d1da50680a106aee8b5139
SHA512 f1b2c8c513120b5edea8b0a5a21a47e909658dc6a4f3905e42ec9ab98f83aa8104aca2b948451c17205ab3a7517ba7e81e9969d6a4a14a5f297991eaf0bad7bc

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 f1ac866a0a7342b29677b36848829051
SHA1 ae660b979a6409ba36471fda8cf62d1f00d547f8
SHA256 50dafcffe16fbb8d0a2eb95f928936138bb3140167c263fa2cbc92fbcbde684f
SHA512 01124b0749e060468501f2a09861528374ff1977a6a7543da8fe67d57c39b1180c302ed3df363bffdafb671a5145dee73b3c5d9784ebf801b00e8f0514cd11d6

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 bea3c056799a4c29f43657ef396f7806
SHA1 0a9efc44a0084dd34ba48fdb76436b126b701533
SHA256 7a0ee2e1ce9bf6b41bed4f3d2bc72ed3fb71613795e7b4dfb17680916b4e5cd7
SHA512 250865fb4e720df23acd4a3c38a7336e43848b3ca3cc26e0aba39176f99a71426fbb57952a1be15004a576969ede83a75ba1eff39adb46b03a11d801ed3d5573

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 e0af7585d742a2d4c1fee48e19c1b976
SHA1 569941c82cd842c8ded0b2351d75e251840b1808
SHA256 2bc00b25b53ec3f3ef7a3814d8b5e27603c4badc806a156c33e78db0ef585d8b
SHA512 7e047bd0953627add6408b83892270ba81fdb2fb4c904d3d5ef2b8ac23ecc3636be99fc638cdb7b51dd7ffd003c22795e86270284be68d69f7613dbe578c5c37

memory/1720-513-0x0000000140000000-0x0000000140096000-memory.dmp

memory/4592-514-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1912-515-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4972-516-0x0000000140000000-0x0000000140102000-memory.dmp

memory/2492-517-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4300-520-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1664-521-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3060-522-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4156-523-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/4004-524-0x0000000140000000-0x0000000140179000-memory.dmp