Malware Analysis Report

2024-11-30 04:14

Sample ID 240613-akhpeawgqf
Target 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe
SHA256 fd7f711ff05220509dc80eb9676fc84bde6db70b6421dcc572b5177fd36f4652
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fd7f711ff05220509dc80eb9676fc84bde6db70b6421dcc572b5177fd36f4652

Threat Level: Shows suspicious behavior

The file 4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Uses Volume Shadow Copy WMI provider

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious behavior: LoadsDriver

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 00:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 00:16

Reported

2024-06-13 00:18

Platform

win7-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\system32\SearchProtocolHost.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\34dfb8a943e3c333.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPB867.tmp\ehiVidCtl.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPBBA1.tmp\stdole.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC311.tmp\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP8C19.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPBC1E.tmp\ehiActivScp.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7D0C.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10056 = "Hearts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101 = "Windows PowerShell ISE" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000305c101127bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\FXSRESM.dll,-115 = "Send and receive faxes or scan pictures and documents." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10310 = "The aim of the game in Spider Solitaire is to remove cards from play in the fewest moves possible. Line up runs of cards from king through ace, in the same suit, to remove them." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-308 = "Landscapes" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000705f621227bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10060 = "Solitaire" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Journal\Journal.exe,-3075 = "Create notes in your own handwriting. You can leave your notes in ink and search your handwriting or convert your notes to typed text." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\TipTsf.dll,-60 = "Enter text by using handwriting or a touch keyboard instead of a standard keyboard. You can use the writing pad or the character pad to convert your handwriting into typed text or the touch keyboard to enter characters." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Sidebar\sidebar.exe,-1012 = "Add Desktop Gadgets that display personalized slideshows, news feeds, and other customized information." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\System\wab32res.dll,-4602 = "Contact file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\DVD Maker\DVDMaker.exe,-63385 = "Burn pictures and video to DVD." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\OobeFldr.dll,-33057 = "Learn about Windows features and start using them." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505 = "Sticky Notes" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09271\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000005a4b044390349e563b3d8627d49564071ab66012d64953f0285dc7e189308173000000000e8000000002000020000000a712967f3784af4ae01ea8523a8a8744872ef9c57b7ac82c589150ff3f31db07f0000000cd57151a8810e8ff03a50d35b04a20e11e2d8707e9c3d8067ebb0372be6b53400f5818e0192823720704e5380d27e6fdbf9a28e16d7cc041c131b07141ec825e5a8d7da92fee19c824bcaa5ef140e8d94a1a4b9d53a98b5e3f8f02395854adcc53759cc1077e7b4cf0afba845b6e341a7b66d9fc9c0fb593b7d75b78691ad80c6cef889908a3bb57feb8895b44ad744a802ddc426264330901d23460cfdd65fee726c53a1ebe1e2513bcab8bdd9d56061709deb92c8f51e1b271b0d14a2b144f6a165bb861ddbf51177676296a8bbe1d2a33b78e07281701a38e60528aade46b21af484811ed20f2587ee40986a6633a4000000033f213281f5657db70553c7116daf90e1fabfdc6b280c4a4a613233f8329161b8f1f37d711cfe591cfff05c2edf0e4715d9870c3b9263bad4a8c5adca55edf6d C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09263\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b0400000002000000000010660000000100002000000012a78f0be709c1bc7dfae11ef27b789cfa261b527f8eb9d1c3af38814b938392000000000e8000000002000020000000940e0f5172a77a1abaca864fe001f26e7c2b28c6d33151cb607f64d430823e05f0000000cf8cf43ab26655388b894e3f1a14a7f150de81dfe3240cc4416c09c07b74f403a63cbca555598ea31128303aa43217be39c580600fbb95571b3ca9343fb18977c4cddcb5a1d7d60fcfc27629a15bc7c7de4e2933e0fb8f00def0009163be30a84baa39890bb415e6fc238a3259486cad59597069f264ef8c94bb41d70e1a6d1d360fa77449e33dc28f6a7f0579330d1c3dee8f1203552524ef9aa4b73e4c040cbdcf74d8c9a30539e27151ca7a7531dbdb52508297f38f0722db10d6d5eff07de01a72ef3748c08a82fe02faa6c5dc9cdda6450290b4413fdb0a2c09a6af81a6c4220d1795ded000a3707da86bf24be1400000005ad45e4c9abaf0950278b8343b16393c99e52407ce00899374bceefff3f1ecc84ad6d57d19718652911b8853818e6d89f6a402cf8cda0ec9f6590a8382742132 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09280 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09264\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000002b5af32bec013903a76ff93ab3bf79d68437dd02f602846f9088e49b44e77b55000000000e80000000020000200000005c6f2f19bdeb168ce924a3909c00b3f1038aaef94c4ea1406fe0a7a69fc8b200f0000000858712e6f701adea90a1af30362aaf950ed3afd45ad67a23eaa49a117ca1441f3fd7044f63725931c1de86f01a8d604cb58ab3a536d2bcd4ff7df5cf90daa62ba7a0d4838c4cd0c5bef9315697defcc15340c962ed3f8fd7c1525a3f0440e398cfbfd1ebe12ef73c417be4e0f162281291dffac9c0ea430451625d9a0abf1b0c66bbcfe47a86e8f3b6a5361287a767b2a5545e924c349661548e86a2d3660a82be9c4472338042496ae3448da4e5cd63a54744c8f08e5b2c6637527e7b2676b76fa5f946aa2f7f01772b60330b5a7cb42db6e7e0145c4a98450d0000b8a04b992e0ba6eb2c026930a582d107a910381a40000000bba538f5cb271648a85c8350e78c539a7caad7d8b613539691d2de369ec529a349dfd86838c7bde709ae818e3dc915cf194f890bdfe586e4471475f4e79f8b49 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\0bcad\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b0400000002000000000010660000000100002000000087e61428524689253634c7baccd982eb52ab138ce79678ee3e3f7dd883041f0a000000000e800000000200002000000090ae0c0d415b0ccc403df3c1019c162cf38ab1ec343858fd0ec977737ba3f69a50010000edea794395be4ed44967eb931e78ef39ec4f45f2f4001d06944cf200e35ea07f62eae8e868300b1177a2b3d1796384f10cd36456953ea1374fe1390f31bd0f2da8c24cb7c1703638580e56ae9ee4f0b811a0e0619211a44c69967a687119b46a395a06aeb4c76c0c600e68488a525e12cc3d69bd1964a34be1e16cebe209f925e2becdedee96d085f6f69a2bcdae69b703048f72435a7bd6fd55416c6f4ac2451d3f4029ad9177df18fa3d662ecb1fbe99a02b6c6a529459a1e0ac49a503c61fe20c57f65745e6cd84d99ab4244a59bec74ac557a620815286b07312591672153b98efd72956dd70c85ab17ef193479dde4bc51807a2ba306452a081de193a45f1be00fd93b9074ab0705a8a113931bb14df6f47f75a4781d7defccc151703b64bdba4526dda963022af82efa3951dcb3b4c06cd6927c1e9072e715076905bbd5ab866b0ee4b0d7e15c304b5467117ba40000000bae4c7bba4decd8d70c9f796ffe368b0daf32c5c9c88aed7935aa6818bf442c03803da76a59c50721c1e73da4af2894337895d5ab5834d629c17e168cfe3b689 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\ = 480affff430affff3e0affff390affff340affff2f0affff2a0affff250affff200affff1b0affff160affff110affff0c0affff070affff020afffffd09fffff809fffff309ffffee09ffffe909ffffe409ffffdf09ffffda09ffffd509ffffd009ffffcb09ffffc609ffffc109ffffbc09ffffb709ffffb209ffffad09ffffa809ffffa309ffff9e09ffff9909ffff9409ffff8f09ffff8a09ffff C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09265\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000ade369687680f6a4bc49fd60360485fd297687c8426c3bd145de8ca6df689ac7000000000e80000000020000200000008ee3d21b097b237cec257743a7d8e3d5b003f699d8def32a2009428463476450f00000003a37910464b5fa325ddd058d43178d45414ff9f2f79748de365c86d32c39f3d73ccfcfdc38e2e0049fffebd0eb337a528658f8021c610cdd66a5d01a24d94c2b60d7f318761834677e69d056d80cdf7d64d20ed4b48eb785760922cf864395ba54e71947e635e661bb0149739bbe3793a6fe359eb6a89ff55fb119ee02a86dbbe0ac6a0dc0ad8552ae3d4fac8a85f6a706575506ae7c5d61e1a73bf3509e88b4ce7dc0badd539a1e1b3cd75201376b594c3f6acaa2b7ffb1e6b394dbe0f9a7e5432e085f4dc215af8e2d579d6e75dadc9f4d9f7e172112dc47cb8810e4fbbb93ccf182235434b30c25ddef928c6b65bb400000005585561f7cf005173e5afc94a28a7969b40ca8dc1c83476be7cab75016b0c2668bd1df01af3c410713ca2258eb1b256cfdb807532f15cfac0d393456e0a8f725 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\0bcad C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09263 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09279\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000005726322d02eb4bc7b49012027e8bfd43804a0990651e648346256c6daa16fda4000000000e800000000200002000000097cc66f0c1b9e1d2abe4f632e578e30a8204dad161149f35e13b2a3ea61a4feef0000000a77f4549fb5d49e275a216dcc340c76f921f455e82035301fe71f6d2ce4b647200825e114176e5ea6aca802fb2d28130f131d39010839b6bd0e93061615ba951cfd99948422d9018a04a892becab354aa8168aad177aed71bf77b40c566085b95ed80140ed3b6446bd70e985d882fb063efed80cbe853eb7d90e92059e3fa200394783f8954137146cd16d80dc5aedfed7240077b428e770137d13696c1d429042168be04eb09ea932059b21f948ed945b90da815067a45b21c5cb7d43b6450f51398197c66f23d9e28059e45948e711f00041e913f88a4cdac2cccbc11fd9fff35653a62805380251e8e91762824e46400000008973d341d443fc35bf24ed5e959d6a01bd9df656ab6c410f089431492b8f58dbf223f65432fa1422c361e7fba7124708bf644b3eeae82e3fbddb3837920f2b3c C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09277\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000d24822d2220698e3049fd0436267428fbc71c6e139e72147d20bdaf1a18bb0ef000000000e800000000200002000000015b0fd89a6656804a58f2d599fefc248f9431471d583ec5f60da9a857b4afb97f0000000471b7c70e7c01622af7f57fc372faaeb5ad5c57efd3dda8b21a5ebd1840468fe37227f8760b5c40b0708d0a7eb60e178c2c8947b3aa7a93211783cf7e58ea294551708deecca91dfb42e4500a9064df8419874bf4cc2df5e9c264b6d1f38160fc85d300bb9225073172efaab053ca230cd83557daca3b09822fdcfd9b8534d2971572e501741430a6e302fa7de6619388e423986f65b08ce9db2f4c082304dfc694a5557f7413b6084b43035183be657351c813ac92030df6cb7a05a26a3489c10a3e36fefa3348ffeb9fd99718ca1413cb864feda43e8f27a0a99bdb65d767bdec8d279e5f2350e2f135140d22d638640000000cb4d50eb1a426068d80a7fe47a4b49938a9d81f7de16d7e58d6d253450b7af4d40368336fb2cdf219d5f888a966c5d605254f5208cbbb9977cc03d479ec97b53 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09275 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09275\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000ac56f447f4dd301ad1f4145346b6c819f86365773a739007cecc09be38f4ce17000000000e80000000020000200000008a6b6947dd5ab5334a78ce48b99a74000bba34f1da3b37836236c2257e0753ccf00000000f18331e2e83d2b8e910cc8e2fc50fb96299fc1ee88e074121c5f65b990d521bb372b179d785677ec04edb72eba0e3efa56e7705ef8468e7af7e1013784f0a253480dba457309c7ea6bbbcc302058f61d51124a1145e9929444f8282a641ba15fca55a94ffa3c257f4d6328efa3a60203b1efef971e9688854bc210ac03d0b8c51a0efa07fd748f46da16a94d36e1a175503226fa6d8789c0ba25b431d4d7471c1d6414766c091159982c0920406ee1ed855e05095ecace23771f92ef8b95b7452adc0a6d990255789f6ebc84c3161f976604168606c4f7af2b670a6dbbfa56d6b85f799d6d34d23b554bf86709a886240000000dc5b2c20f18173439629a088058baeee419ec7814d9b4037978bdebe21200827e0593de249ff8f416275f1871189536b80163009672a9dac763bed8dc69f768f C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09264 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09265 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09276 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09277 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09280\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000006036c13fd084d6e3bb262c1ad5770ff13a715c66e1c52258bf97d24c3cb5731c000000000e8000000002000020000000f19f42b8cc767971243055073b6c9c1ad824ccf149ae141d9574f7bb5e8297c6f0000000e65c7b0f982728095f7f63f74ce2be3f2623ed106bc71188aea7fcf6bc32edcc07ec16193bb7dc83057de1904405540e0255e670e3ffa9a82652722e66d42713b085cea310a4968e4b752fa20d1f7675c6f21545a1c071d7ec9392ae744dea483e9e96d6727afce7f9d07d601e8e845fe4b88a92ab2f7f71b47a59bf68a0daf195490c037ca2c896873a73e335ed25182a1ab79430c234f1d9f82999a8e19df953bd0d29be33b4a0158b3e186bb26c339f4f1f07b7cac49bf2462fdb1d016b9879509d48fe96342956b3c3a876ba0e984c221e38ea2b392e3e1ecf1370c6a81c89406565821f480b79cfc753debb100d40000000d02ed83f53bf8a1d3cad948addd453c0fc91c4efe39d898061a26d1f8c97539d1bcb7aea75eaea98b0dc1e8e64b28e03171af5e3384cd2fcaacd706f68712803 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09260 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09299 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09299\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000bc240bcbd8231edd702ac7f8611d721f53c9becee457cf1ddf441959b2e69a1b000000000e8000000002000020000000e01d4bac9a79903b08511773c9d8cbf70d56dfe62b5f3f921fbe5cefde0bb5e0f000000011a98daff964b2862758b84928636df6df5a12331bf33cb152cccecc901999c956e704270bda8fe962cac24654544c49a918b4e320aa8abbf254bbf64d4054e8d0c9b82870a7b4754c3b094e527864e532583fa0eb308a8f18cb51c8f1ea996367697032606f748b7884b90b59b8b16ec8f7d397a3b14a40b56801bb8b53f49f770c15403b00252995f4db0163a507328245bcb3d43a642fee5ef8a98b106b98edc94c21977694b30e04708050db6381cf2b024a6a454388dee393fe62facd942cd08b9bfb824171fedad50075d48519ae0d94a3496f1e0bd8707c2f6fbdd35f7cf2888b852d9c03ce8671f8c3fef4cb400000006ae91b4a3552970bf399c769a0fb5025fec77c32e6f4624ad88644262054442b1d39bbc5b33b75d80ca01a3da33ec10be72ee6640a0b653500a2de5b2e8280bc C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09260\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000c44ed6e61df992c07d45cc4eeff92c7f2d609e4ef1132c7accfa24a7cdd982ac000000000e8000000002000020000000c017f157c33b3b1cecdbea3bfe88cae0d8ac125ca8d16688c8847e48f1502685f00000009d6ddb72281d3bbd8386bd50c2ff7ce7fc807f590b126779ea4d051f703b293c1ecf40b3e11ebba0e85d38e6a74c073a5d345ecf1c0a5998a6d969201d20ded8f6bc3d6babbec3f5375606f718d1e0d748faaf081103d76d3f1e751c3f8068eb6eccfe6951e83a493f7e21425289e22516c0a85007b9b275b13073ff35f87b30432d6a264be7d9a3a00aae1aeca39b33f0df0ea481138f7bcc6f6d3e22fe4c2ae048ffd044f0aa9b878004201fb92818ed17e9fdf4fe6bee4a99c3012c6246687776b49f4ebd9ee78103d67385af689a41f78301b5e571d1a29de34880e40eba7e1d308d19c1fd0dd88176e92c8f0ac640000000e2d2445d3de1bee7f9131676ec2a72bc2bb702d9ccf5ca1264a7f794ac43626d012815980d58bd9855bcf32d5cecfbe42b876ad49596ec768fee0e7ffcabe921 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09262\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b040000000200000000001066000000010000200000001638eadc61fca47df352d69ce0875899198affb1b720d13539ba48f67b3388e1000000000e800000000200002000000090413fcaff5efb1c482870d56e40a0023a54f158f52d58440e180afb50bb9172f000000042fed693c62189865614cbc3a5ad2e6fc225a8715e4683e4ceb9c305e463d3070004bbc0e7ca255f5ebf38773147463ac1e39135385e587c4a367a8ab39491b1f77e138578cbb0319198231ae607d62bfea735b6c9929f87703a5c4e6a99f33628a8bb42c38fca521ffb7f8dc12ccf88f396db28385a4ab1887647d66c466b60f4a7f8a2725f55feb88d273c91b2e5b211f120004736c6b155052ac51759092a19bd80cc0f5001c84545f77a097f4f06ef464e760720049998eedca87d0532d42028b89ca5921aff88e1a54ff7f544aed64515225bd8d6784b3ccef3f0627bcc96e73b2b384ca4bc9b47e7ac854a096e40000000358c3fce76e3745b2c704655572a7b7badd456a0e4b7d6e5eac5bf8782f1d2e4f5b705342282a90f60096b14961ffe50ef6ffe7d92cbd932aaff01571456ecb0 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09279 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09271 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09276\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d387b2351885d4fae3e4365e8e78b9b04000000020000000000106600000001000020000000fea1e295c399cccdb846a2f0bc477deebf803cb99ffe527c0e879111c7d7fae1000000000e800000000200002000000028c714616d5b8bf64147f49438a5d4575c710ab20ff5eb292ac492efdc2ccd9df00000007c05dbbc110db02528a506cd258cfd0b6bdd3c9c5da9694f42b28b5db9afd8142fba1f664d99b7a599c071dcf09addd494c15b6e64889ff0f7334f2ba52f993af65f4d51faf038c29f14709c4ea49b0a41cec21f9f89d9b2b47431934d11de11596e29832306495243c803ca612456361a54a9bbe97422ea5e77e6abc9e82c327b566723cc606df2976564b385471e994285b99e0f06298fdea04b2b35be7cbc2e3553922ed350271ef6b44fbc6a60af19e44e814546c3d235ea8f7851e76b7218237bd532f516929ce3b0ccefb24167b04fbb8d6ac9b784f33faf6d3917951cf09198967f058c203b93b382ba4871b24000000077bb51f3a1c148fde53d18bb923f6243ab54576b10f4553e467cdbbce27897940654efa58e7f7baf30f49e45281c3f7e7f250d61f4f1be4469897d9b559bf45c C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09262 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 3044 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2692 wrote to memory of 3044 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2692 wrote to memory of 3044 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2692 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2692 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2692 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1284 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1284 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1284 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1284 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2260 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 2876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2688 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 1ec -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 24c -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 23c -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 248 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 250 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 1dc -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 248 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 23c -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1e4 -NGENProcess 24c -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 24c -NGENProcess 268 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 260 -NGENProcess 278 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 260 -NGENProcess 24c -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 248 -NGENProcess 278 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 28c -NGENProcess 1e4 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 23c -NGENProcess 268 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 294 -NGENProcess 26c -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 284 -NGENProcess 278 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 23c -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 280 -NGENProcess 278 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 280 -NGENProcess 23c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 268 -NGENProcess 278 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 208 -NGENProcess 1e0 -Pipe 1ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 250 -NGENProcess 238 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 224 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 208 -Pipe 1b8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1c0 -NGENProcess 224 -Pipe 20c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 208 -NGENProcess 224 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 268 -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 208 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 224 -NGENProcess 278 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 278 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 208 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 208 -NGENProcess 224 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 28c -NGENProcess 274 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 224 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 224 -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 29c -NGENProcess 284 -Pipe 208 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a4 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 224 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 250 -NGENProcess 294 -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 294 -NGENProcess 2b0 -Pipe 2ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2bc -NGENProcess 2b4 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2b4 -NGENProcess 250 -Pipe 2b8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2c4 -NGENProcess 2b0 -Pipe 2a4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b0 -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2cc -NGENProcess 250 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2b0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2a8 -NGENProcess 250 -Pipe 2b4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 250 -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 2dc -NGENProcess 2d4 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2d4 -NGENProcess 2a8 -Pipe 2d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e4 -NGENProcess 2d0 -Pipe 2c4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2e0 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2a8 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2d0 -Pipe 2c8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2e0 -Pipe 2dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2e0 -NGENProcess 2ec -Pipe 2a8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 300 -NGENProcess 2f8 -Pipe 2e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2fc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 308 -NGENProcess 2d4 -Pipe 2f4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 304 -Pipe 2e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2e0 -Pipe 2ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 314 -NGENProcess 2d4 -Pipe 2f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 304 -Pipe 300 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2e0 -Pipe 2f8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2d4 -Pipe 308 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2e0 -Pipe 310 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2d4 -Pipe 314 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 304 -Pipe 318 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2e0 -Pipe 31c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2d4 -Pipe 320 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 304 -Pipe 324 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2e0 -Pipe 328 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2d4 -Pipe 32c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 304 -Pipe 330 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2e0 -Pipe 334 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2d4 -Pipe 338 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 304 -Pipe 33c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2e0 -Pipe 340 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2d4 -Pipe 344 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 304 -Pipe 348 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 304 -NGENProcess 358 -Pipe 2e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 368 -NGENProcess 2d4 -Pipe 350 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 2d4 -Pipe 34c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 360 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 358 -Pipe 304 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 2d4 -Pipe 368 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 358 -Pipe 370 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 2d4 -Pipe 374 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 378 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 358 -Pipe 37c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 2d4 -Pipe 380 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 364 -Pipe 384 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 358 -Pipe 388 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 2d4 -Pipe 38c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 364 -Pipe 390 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 358 -Pipe 394 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 2d4 -Pipe 398 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 364 -Pipe 39c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 358 -Pipe 3a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 2d4 -Pipe 3a4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 364 -Pipe 3a8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 358 -Pipe 3ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 2d4 -Pipe 3b0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 364 -Pipe 3b4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 358 -Pipe 3b8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 2d4 -Pipe 3bc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 364 -Pipe 3c0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 358 -Pipe 3c4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3c8 -Pipe 108 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d0 -NGENProcess 3e0 -Pipe 364 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 crl.microsoft.com udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 crl.microsoft.com udp
US 8.8.8.8:53 crl.microsoft.com udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 crl.microsoft.com udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 crl.microsoft.com udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/1728-0-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/1728-1-0x0000000000810000-0x0000000000877000-memory.dmp

memory/1728-6-0x0000000000810000-0x0000000000877000-memory.dmp

\Windows\System32\alg.exe

MD5 695813fe02086145f5a008b42f1e8502
SHA1 6c76d791c9c1ae8dad924dbefef9925625cbc5c0
SHA256 22e667b9179fa62bdcddfc5081fc6fb592b4dd4c00896676d510dd9677d56c79
SHA512 c1225d56e8a561e6a740c84a52525f0b442426df5e277cdddcf39095134765fee7de743817d246af5ef8a138ac11f364d443f80ec0fb0757a4e537ef869c1afe

memory/2348-12-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2348-21-0x0000000000450000-0x00000000004B0000-memory.dmp

memory/2348-13-0x0000000000450000-0x00000000004B0000-memory.dmp

memory/1728-26-0x0000000000400000-0x00000000004B4000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 6cf5d2934b3721708ec572de713afaea
SHA1 b013d85da89b5f9d57654e3d94828391de2e330d
SHA256 d4558e897794594920e132a473c73310e54e2bcdec726bd3298c2e9eeddc6c69
SHA512 874c036453e0ca741deb9288c54d8d8aaed46c6682e5900f934186f4283ec132239c786adc2481a9797eb9b0a0f5c0a0eee5834c6569fb64ab703bbcd75a0cef

memory/2096-30-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2096-31-0x0000000000E10000-0x0000000000E70000-memory.dmp

memory/2096-39-0x0000000000E10000-0x0000000000E70000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 7146952559a2dd4c6193ff3c5cb7fc80
SHA1 94404214ec499f37ba94248a3dab80bb2ff82109
SHA256 5e5dd8db1c192cfb65a4cd317d15578187c84158577930864efc5aff8ab51c32
SHA512 2a099c0260326ea42dea229f5f2cc645513ba66e7978a8381e496649ad1e348337c0bc83a4756c7d3511a2c936f7b72b7cf8ceb50a8a9587cea0daa00af26003

memory/2688-41-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2688-42-0x0000000000290000-0x00000000002F7000-memory.dmp

memory/2688-47-0x0000000000290000-0x00000000002F7000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 b339b556f8ff257f3f4f30ec10153067
SHA1 df87b5a95d2ad422716da8d21b9be02d9fd6d074
SHA256 ed879603c5ea2118c832dd65f5a20eff868fb84432a818eacaae30ef567b623a
SHA512 1a3e828c2e487f41167097a13e29091af49ef61796c9898612141e1ccd8d048710b535f4d29cb21d987f73c0907c483718a7b0661134d8f9ae61f8a6cbef5818

memory/2692-63-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/2692-62-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2692-54-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/2836-77-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2836-71-0x0000000000320000-0x0000000000380000-memory.dmp

memory/2836-78-0x0000000000320000-0x0000000000380000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 b1473e88208431e5443568627f901148
SHA1 771f1b462a4a457814fe34f2d0a562177bde2e05
SHA256 b6ce78d97ff437a5490311b2d304c2131c467fbcd3176ac0c373f1c45da585c0
SHA512 190d4dc1a7da104a73793f9a06b7dc2a3f6901f11ad342ef2415cf54c541d230261bf6be663b2b6ed25ac196245e0d91b7f8a11bf59577d6c5df019277449f05

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 e9de325dc06b646689751fd62242aa9a
SHA1 9cc36b9974536fd2e80da0d621dcfe0dacafefaf
SHA256 e5e6f77dc554b4370f33fc3f949d670f4fb56e17e4d2db3c3b6b1eb10938516c
SHA512 435e06600af00c121fb5d21d512659663c6a49a4f34ee5bc9d7505d09c7ee212d0c2d2f138e6357623f425db5bc0656b4510592377cac8c715d74817467859d6

memory/2888-87-0x0000000000A90000-0x0000000000AF7000-memory.dmp

memory/2888-82-0x0000000000A90000-0x0000000000AF7000-memory.dmp

memory/1980-91-0x0000000000F90000-0x0000000000FF0000-memory.dmp

memory/2888-100-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1980-97-0x0000000000F90000-0x0000000000FF0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 ef501ce8133cebbe220e615a48b801ca
SHA1 0e188c45b52bb5cc2e42efc3d17aa2e21595ab6c
SHA256 4fb5e8aa8f986efd8ba5ecd5b11db20d6da8312882f747ef530b0a4b13fb86ae
SHA512 5872ac8393150eca46efcbaa7b463dc1ca73d1643a2a595e04d7f9f6185705d5c15d72d827f20c5d39f9460ce4984c32afb29d66516793bdad7d99a3dbed0c2f

memory/1980-102-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2348-101-0x0000000100000000-0x00000001000A4000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 ffa624318f9c1b025564cb5791eb2fee
SHA1 14a57a68ca7dbef8d1d8c3f4f2995289231f129b
SHA256 850a0578d2a05f7b488377bbbcbdc76313a592160f47a6f385dc75df4bd51b94
SHA512 556bcd891f00f6b6a7a6f0c47cb68783ff8e8e6f36e8e4cf3d36bba4f8a3de7e3d8d335794f8d28ae71cc4658beb5c19a909ee0b1318433eb8fc46c548d2784f

memory/1272-110-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/1272-105-0x0000000000230000-0x0000000000297000-memory.dmp

memory/1980-115-0x0000000140000000-0x00000001400CA000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 65d2e2d0b6297019f77ee359a134e005
SHA1 f6671d733502fd676ae5be8225e930e5fba72d1a
SHA256 b938fc8a8ac39167dd1919372b46b1dd8e479bc144011e035b67654087cfe739
SHA512 9e7f308a3a426653385565e4e376b9aef433d07a1213af602f00f80ec950d0e4b8ca9243840a747b717f8aa66399cca7aab2cbc5caa821c930bfe70bc684e1f3

memory/2096-118-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2040-125-0x0000000100000000-0x0000000100542000-memory.dmp

memory/3044-294-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2688-293-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2092-305-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2692-296-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/3044-308-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2092-313-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2744-324-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2584-331-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2744-336-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2836-345-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2584-348-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1868-350-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2888-349-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1868-354-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1276-365-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1272-376-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/2084-384-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1284-388-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2040-396-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1864-397-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1864-401-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2960-410-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/880-420-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2960-424-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1304-442-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1816-451-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2288-464-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2260-468-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/3052-484-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2876-487-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/3052-488-0x0000000003C50000-0x0000000003D0A000-memory.dmp

memory/3052-492-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2272-510-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1260-514-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1992-532-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2620-537-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2124-536-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1472-553-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2124-556-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1472-560-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2008-578-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/992-579-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2008-582-0x0000000000400000-0x00000000004A8000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 b333863d830e1b534891e54b779d44e1
SHA1 2065a35cc86b0ecb4978bb1a7bcdc4c7cfeb8f37
SHA256 cc705393aece4e1c27c6f08b2365c59830107855f4baf249d9b3f75e96a05c29
SHA512 51f2042d5e4bb46a39f9effca12103c677e50a16bf0e2554b91f4d998f339b0a217cce01d684dac7c423e4e31a580532b27118c92c4049d6796c1cc36e606278

memory/2664-587-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8dc4ecb9ecfbacd95c53b96870d91aed
SHA1 341b59d7fbedb4067148a13d4909b43bb7c13e0e
SHA256 45d5cdabbde8403a74f0f29cf36658ad914424971cec3ad504f3695cb2125b92
SHA512 2fec2d9cf97bd7df8b79d6e16a8b91fb96d35c53c07043da39d7235911c6bf17e84c4d08c13f33139149572f9d58d502811388bd0ee38d9382336e45af303ecc

memory/3004-603-0x0000000010000000-0x00000000100A7000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 4ccdd43d0d1d12f21bdc027c45c50a83
SHA1 767d969024d2884b494ca7bc1dfd60bc21d967a8
SHA256 66c71cc185551c95522adeb0d186bccb522dda795e134d188e547be48ccb202e
SHA512 aac9d5d89094a784612d1de096da975fe251c0506ca748adb7b62d736f1025064f91f205403217e9ce598f70cc2c4bf9e12204891904f1be70f6fa4b0bab954e

memory/2664-619-0x0000000010000000-0x000000001009F000-memory.dmp

\Windows\System32\dllhost.exe

MD5 4f3ab9698dca88ba959f9356bfffac2c
SHA1 aa9ce9e0eecb9eab8283635919c1f7f84783d8a4
SHA256 31c4e57a4dfe053f9fae49cc4be91518ba1287f42475b7825ca9e7b0eceff9db
SHA512 266172c3e123ef8a71abaf89490e0c03783560b0eb88ab84eb3b3d70d1ba87d5cd9ca400b35968ddb5fb77d0d22ee45e9379169f4fa61b90ac0c3842a5ab47d1

memory/2560-622-0x0000000100000000-0x0000000100095000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 3a6abfef6a2f5e63bee4cb416d002749
SHA1 8a8dff4ad4ad08d86db6693518f3a9ab92a3c2cb
SHA256 577013476ddb010f2556740bd875f7cd290891ed496a96bb8e7a1d8857abc812
SHA512 fbd27a1f8ede38cd04035efe6659a444c431ea01078dc2944c5f303f6cb861e8fcf60d1edb27993a0b3f7f7f092a3eb0c3ee91c8fd726d487f0eb227b18509bd

memory/3004-636-0x0000000010000000-0x00000000100A7000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 35ebc628901d4a25a44a888ffc92e7ae
SHA1 866040b2422179696496558c386d09a9d45f9638
SHA256 dcd2123d70f2dda7e76fb73ef4eb37b295cdaa9d2f38bba227350ae5b628c1c6
SHA512 f4e94b8cf2d6cbe9887bf96e5142f30fcf33a3e1e4d96df6f9271a8d42b0dc4b10abd2858ce8d37660f8e576ca3f7f5a44c17e9c54ed641115ac50692fa0d4e1

memory/2452-640-0x0000000140000000-0x000000014013C000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 d602e9493fa6f8cf78aa387992bdfdee
SHA1 23606d9d59d0bf0dfb2713aed06fbfb731f0ac47
SHA256 396ea663cb97505ac216ba6f4429a7c027a64ed6c615cd1fe56673631de81a96
SHA512 d5ef367ccbd043653e1efc2dc5db7e8af306d885db66cdc0925cd60d58de4150483d533b813162106c18adf4031436da6ffa7f20b5368e75bb0609b5bf5f28eb

memory/780-659-0x0000000140000000-0x00000001400B2000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 a82c2e20c878ecf60d64540af8ca6c26
SHA1 7bdde53c13ab43274d0f4748232c157897860aef
SHA256 e7d66b087a3a0c03c275d35da0e5e0ad2dfcb391168244ec1ce536393c6957a3
SHA512 ad61140d99c24df8379d6462f84e46b4a9b8f9574c8b6fdece203c6cd848b835bf0b1681651b74fca6c327b647a3b157ff59a90ba77eff5adf763e37782812a4

memory/2620-675-0x0000000140000000-0x00000001400AE000-memory.dmp

\Windows\System32\msdtc.exe

MD5 c3dfe760f27c3fd221d867012ca0d036
SHA1 e271bf9ae209c5f1e485e87609eb7db5c4cfba12
SHA256 5467a34b1ccac602d472740c94161e461113e0abe86266bfb23c5ba2458506bf
SHA512 a7f866ca3c725f2b1806d6dca4194c211503f1155383a6e8c470cbef8ae95752352dcebf64d43ed27a016f779d51bad3bff668ccc6cbb186086c249a8d10a35c

memory/2124-680-0x0000000140000000-0x00000001400B6000-memory.dmp

\Windows\System32\msiexec.exe

MD5 7937fb933771a99d4e55d2c5fc38f8a8
SHA1 d8712623733e82724d20daf7896d323d59ee732f
SHA256 0f7ab6edc034c7005c585daebef473035457abb115f101bd3f4251253d7cce50
SHA512 29e1501e978c9526866a827266095cc117e9e9a2dac91f93ba2290b646ae46c61f1c5e15f2ba16426dd60a74161f89ce42b7afa456a942162cb0b6d689556902

memory/2972-693-0x0000000100000000-0x00000001000B2000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 75c0b938b70f497d3ed281bc3442cfa3
SHA1 8cdb440dd608389ff1ade302b256b9fa4ba1d2e5
SHA256 eceeaed2043ff6c12935562e09a0e8a60cbca9b5118249dac0245ffa4fa3b13c
SHA512 d615dad8744c25f0902c88e157b1acba6934d13bc8acaf4ada203f1938d0da6b3baceef402338b4e9663db74c80853b17bd057c400517cd692b05c23c5c4ecfc

memory/316-708-0x0000000001000000-0x0000000001096000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b941b4e92ae4aa9077ddfb7c1d49831d
SHA1 66ce017e9cb9dc200e1f6ecc4352bebf9dad2715
SHA256 843732acfa0c558b3581bf4aa7e09d34cafe135c7248522e00e4d5f5d75e8c9f
SHA512 479d3cd9d887e4e68b4411822fa3d04c25e8e36be3d554a65ee29b9cd6ea4666b29cb527fd5802f354880ef18c4bd8e3fd087b3bf51a5baa33735937ffc37666

memory/2360-727-0x0000000100000000-0x0000000100095000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 6d0df463dfc32d62562ee3369e288f36
SHA1 0260dcadf6fc7a84fc98c794f19aa4e4e62fb03b
SHA256 8a11fa896fb1531344ec52370a56b96da5a570f7a6fdada923c430eabb0f0e26
SHA512 368031411c4c3dcf4f3935ba29457b81f3fd07a43ff7d491e3a6d058d5f7656488e04257705c1e04abea6708a98663bb3ebfd155266a28d459b4891e6b45effb

memory/1508-731-0x0000000100000000-0x0000000100096000-memory.dmp

C:\Windows\System32\vds.exe

MD5 a19392f5e76c3587231cd4bfe9b1d56d
SHA1 12621d8ffc42e12c81ab9628850ec3bfd28ccdc9
SHA256 5022162c308ca459d7fc4494c0913dff5ca7288b8410aa7a2d0c46296093328d
SHA512 ff3ef31c5abd704fdf2453117be76fd7ef493eff053b22f52e5860bd8e796d081e09510339e763c8b8ddbfc70bfb27c68f2ea51088b8e9dd8256e0d341a05699

memory/2268-752-0x0000000100000000-0x0000000100114000-memory.dmp

memory/2560-743-0x0000000100000000-0x0000000100095000-memory.dmp

memory/2452-754-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2624-763-0x0000000100000000-0x0000000100219000-memory.dmp

memory/780-773-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2696-775-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2620-776-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1524-783-0x0000000100000000-0x00000001000C4000-memory.dmp

memory/2944-796-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2124-795-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/2972-800-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/1760-807-0x0000000100000000-0x0000000100123000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 f5b10799a616dd521a007cffeb92b9ef
SHA1 c6eae24297ddb12673ed3617536b0b79e082ae85
SHA256 293347c594baa34bc956d54f5ee37b4b8f8e930c2e538793682883dd588d3eeb
SHA512 913b1e139fa7f62acf36c833f1fe8b61aba9f1604eec93a6208e67f5f7f2a6fc7d1aceb287904505e412266a0fd86746839e314405683b047e3ed0cf7ea6f3ef

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/2972-903-0x00000000005B0000-0x0000000000662000-memory.dmp

memory/316-904-0x0000000001000000-0x0000000001096000-memory.dmp

memory/2360-905-0x0000000100000000-0x0000000100095000-memory.dmp

memory/1508-919-0x0000000100000000-0x0000000100096000-memory.dmp

memory/2268-932-0x0000000100000000-0x0000000100114000-memory.dmp

memory/2624-935-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2696-936-0x0000000100000000-0x0000000100202000-memory.dmp

memory/780-939-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/1524-940-0x0000000100000000-0x00000001000C4000-memory.dmp

memory/2944-949-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2260-950-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

MD5 5180107f98e16bdca63e67e7e3169d22
SHA1 dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256 d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA512 27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

MD5 5fd34a21f44ccbeda1bf502aa162a96a
SHA1 1f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA256 5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA512 58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

MD5 b9fa67b129d8a3fd4d5207afb4751e27
SHA1 bcfd22ad2c98b0247426d2df374fc68b62407ed1
SHA256 7240a877ddf4c03158e557f67269a7c36b321addee0460fcc5878ab8ddf331bc
SHA512 34489529de30c5f89b28e1eb51af66f65b25e76449488f0d03e19c8263e4c23d38df14f35a7eefcfb95f08467bb10c2b41f7364559721e4097632f04ee8fa722

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

MD5 3d6987fc36386537669f2450761cdd9d
SHA1 7a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA256 34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA512 1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

MD5 a8b651d9ae89d5e790ab8357edebbffe
SHA1 500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA256 1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512 b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

MD5 4bbf44ea6ee52d7af8e58ea9c0caa120
SHA1 f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256 c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512 c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

MD5 ed5c3f3402e320a8b4c6a33245a687d1
SHA1 4da11c966616583a817e98f7ee6fce6cde381dae
SHA256 b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512 d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

MD5 9d9305a1998234e5a8f7047e1d8c0efe
SHA1 ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256 469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA512 58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

MD5 dd1dfa421035fdfb6fd96d301a8c3d96
SHA1 d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256 f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA512 8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

MD5 57b601497b76f8cd4f0486d8c8bf918e
SHA1 da797c446d4ca5a328f6322219f14efe90a5be54
SHA256 1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA512 1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

MD5 68c51bcdc03e97a119431061273f045a
SHA1 6ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA256 4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512 d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

MD5 0a41e63195a60814fe770be368b4992f
SHA1 d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA256 4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA512 1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

MD5 2eeeff61d87428ae7a2e651822adfdc4
SHA1 66f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA256 37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512 cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9d6012f07b15d13bce0269b033935cbd\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

MD5 edb0fd1575cb46d0c367cbd40cf60292
SHA1 45b6e18c4636524edd53edbc3747faf5547c278d
SHA256 5833b490826eec6ec0132a50fc0004663cb2adc1a8f3e55b11048fc2a37bf761
SHA512 f550f71c7612d7219fe43a431b4b2e7c1bb9409e0eba7d1ffcc1e36ccfd8cef84edcdb23aeb59f927c961af701b2ab3ac3e30a359e93d611ce92a7549eaae23d

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\7617cb5cf0b5c2e9ffe4c34fd5a560f8\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

MD5 458f724ed911827c02c55a1482387080
SHA1 d3714329ba042704ae13bed5c4e3aa3892d0eeda
SHA256 d11dd07bcac23dd68a6c707604329cdb07beddd1fec6a3871b556a2d52c60ca4
SHA512 b4ec62e8b3484947e5df0b5467c81c12daa795281cf0d1c8e8861d01416ac3474bd329f40bd1f57a8b24539591c420634f7ef17128acc207b8df68a7efc364a5

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\edb26cfd1ae973cd1ba350e4cb62f2d2\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

MD5 7e1f15da6cd79b15b351f68fd40244e7
SHA1 2d107e27b1d35a3857ad38a788e96ed13991e80d
SHA256 699a913e9444d84fcba164cc8e3cdde19e95785f5aeb7998f8e73a526648cfd5
SHA512 2d3f56949d04b60694b7f9c433cfba8a5b990eee7d9455c2705c00476e4d8083bdd558439da20d7e7add0dd441574ff3535cfa8fa0c4af422fd911d3212b6c94

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d930e1d9d837e34a28ecac066efa7d5e\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

MD5 9adaae07a0024105f78bec9de948183a
SHA1 e21bf8df1af426160f5a919081265565edb4bcca
SHA256 121d510dbc4562a51f9018839c3d70f791f70f9a97e873a36b19c238ff7f258d
SHA512 a07ec5d250fd7febb2a1da66b407560ecb755284d7cbe6016982cd19b4e3046fda69b5a692c72ecd355d9a117501efab37fd0f3ffdd675344bfa71bac0b79a85

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

MD5 10b5a285eafccdd35390bb49861657e7
SHA1 62c05a4380e68418463529298058f3d2de19660d
SHA256 5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA512 19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

MD5 1f394b5ca6924de6d9dbfb0e90ea50ef
SHA1 4e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA256 9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512 e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

MD5 929653b5b019b4555b25d55e6bf9987b
SHA1 993844805819ee445ff8136ee38c1aee70de3180
SHA256 2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512 effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

MD5 d9c0055c0c93a681947027f5282d5dcd
SHA1 9bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256 dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA512 5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

C:\Windows\Temp\CabF289.tmp

MD5 d59a6b36c5a94916241a3ead50222b6f
SHA1 e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA512 17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

C:\Windows\Temp\Tar19F8.tmp

MD5 b13f51572f55a2d31ed9f266d581e9ea
SHA1 7eef3111b878e159e520f34410ad87adecf0ca92
SHA256 725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512 f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

MD5 598a06ea8f1611a24f86bc0bef0f547e
SHA1 5a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256 e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512 774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 00:16

Reported

2024-06-13 00:18

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a313092ec8648821.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09279 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09279\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f5904000000020000000000106600000001000020000000df2ca60f20100a38fd5426611c642a25b2e87de7f1d26817aed91e3fe6f50b35000000000e80000000020000200000000afef498a438e4f8974dfaddbd6df77b7aa94dad1182c5e909dfc408ac3922b2f0000000e771e7039acbe9d0b6d9280ef1be1d04315e2048020a1fb1c0323c309b97452836a57e232ae0a3da7356eb1d5def64b31054715aedcd241fb91c5731b413f1b606def57f4d4bfa9187cddf9f0f0ef3aff2efa4187f3d88e656e5248bcd37a1b42092a35cdaa8b54db9cc11b0bcfd9cdd9023c3b1c3dcd0119b18bc4c8680a9a59a79fa3884b58c3587d7c689c1ef41058f9e4aa1975980a73bee170fdd379b22606c2c5784b4a2fbd65eadf2a85c416de2fc3fbced48f193a70c423ef245658ce55a120723a0d252ec9ec5b8a2ce9346c3edc3218406217a5c984bdb6dfd42ecdd3106c7cb832b78f6d9d53b92c61965400000009fcb7787810680ed9ccb53f89dc3b0a240fdaff586e88318bc50bd020599d7945c8f3de9c419d8c72d8edf5b6e285b662b24e3a8e0a3886e6b7ef2cd60c2c470 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09260\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f59040000000200000000001066000000010000200000007d03d9e4819c61da378b7d6c237463b797202996e7afae62df5b03f348d84a46000000000e8000000002000020000000786e31a93594b284ae6425d90798fa90ada9aa989b262c6b3cc9b569d7b6db3ff0000000c6d76c1ef01f936228ff6037ab71acd5d79da5bc1f64f06a6fe4e9f4071676a42565b31415ce168c66b86deea7af5a7f78f149bcb68364f981af691ecc4772ed63fc04b94dfe26b5ee664f928a6e3bf5f5d4abb58db408d32bb8e67a015300c7f047a22bf6496bd499d0132b2d55628e9858375c9d61c2f125738189a0bc92ebc0dae091edfd85b0b6a1c3fe5aae13dfea2b30ac6a7861b8ea61ce4768004ef5a5598a69a093d06574cbd0c84e60a0beb2b93705244e704aa74bf3f5d5acc389844f05bae64a44e89ca1d3af3dc5cda3324a161ca2f1d54ab92f929f742895fa01747dd7a8e74ebe5b47035b826529ca40000000c8803dbfb6be72076b87d2ec4b0fc4387c11a9a75a603459e2e7c238dde524c7b9cae22adff26044840f003f5d482e37781540a5de41efa0777d6161a3955bdd C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09275 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09276 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\0bcad\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f59040000000200000000001066000000010000200000005321585e55b01314fe322a137eb590f050797edecb8a692c30db4a067ff6e45d000000000e80000000020000200000000219a4f8bd96a0d3c64bf0feda24130c32b8ff6d024b65c039c64db6515df7ff50010000e19ae2a6c4a0f1fe5c705bc0f9e5b07a10486f088351dcdc4c4fa2d30890c68b68720541a6558aca05cd844d9aa9054447c07c1ea81296cb8935a1128639d2412c623f34a179389d0bfa86d972bf8caa7205d317cf55a50779c5d42b656c289cbcaa51bdbbd22000394eaa68e45e95247a1241a7673d07ed9075e496e571b964da79bdccb13d3dd001204f4f3479411938480c7fd0c8e22785f372768e0bcba8a3204f8498b1c6e7d6f4751fa8d643b53ace99a5d090f331d9330890592be92f463710445ef904db4c2a511169827a2ad676c168a4b6c6608b4686669b2b64d44b9f0084f1058328c5df925b4e91c5511231574bd40b1714e0c809a3f4c358464ffc87569ad287445324b65cd5aa1d231575e5bd3928419a8ce8064cc6b2b288c395495b0f2e60963f333edd0a5b18b2146f34984de41b225803ef840ff7c1459f2973254ba118880b0f940dd75e539740000000dbad594c95ff7780048fd15fd0a079f4741f94599448675662caf6f0e6981612356493271e0a77b2f1ad97a373e5ed81d7c6e9792608fc27a6e2e1ccaa47eb94 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09262 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09299 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09280 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09280\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f590400000002000000000010660000000100002000000010b18cf1a96e89d9572beeff2aececd592611165823b7cc9d843f2527b2f98f1000000000e8000000002000020000000f4dd7daef96fe45c1759890062bfbd46a961b593b9f9db56a1072915078ce1b5f0000000d645d106b1a49bb011ce309a8eda929f35193be7a228c3f856b12d7e367d5a144bee0f53de790c8927feae47c9976c7dc7e8d0ed19ae962d313bf5fb71a23feb78edac57d39e7dcb18454c22f93c197b43a3259d7e223a7048a4977461a8980873637dc25d1499d3dfacec00c12604c323835bb2d181b14cd923bc699e5a91a667c0eab49dfae51c353e5642375550e3f51f8f7a3d587e0c9a7398b2916dcaa30596a9ab97489264bbfb62167010a7049e995b28546e11ae1a44ae86f4921a005e9817c2145e15e7e135a37589bc696ac2be55c42ba0ad8dbe2866016b92cd204051aa4051bf40941284803e4ca6d704400000006a0ea7ca38b8652f7d695ad2b03ac2f2910faff1d5c89d46baf9e6b42a7f531d818ebc53be0fa1730de89c0dab63277502e17ec1099773eabdd5c19f8e09b69c C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09264 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09263\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f5904000000020000000000106600000001000020000000bd4d81602136f3a3d11a730652336ca8273775b19bfc95bd988df3a63583ff94000000000e8000000002000020000000252994905df5d4f382ec8063c0e0c6741ab44767031dd4e74d148cedeab941f4f0000000eb3fbd56d9c92d40dfe175047d67dddc7ad5e533c08865cdee4794310722e334c214255ee1e41dec82f71f50d7ec5448864be911d48f396cf40be50ca9cf9b00a50c5f56e3b6ba877bafec5e4eb7fcbdce2e8c2e4a31a5aafef8851e86cea6be193a320fc4d9f4b36386dd205854cb30750610c6a371544eb54053fb873e3ede2a092a9f2dcd313ff89dfd27be4622f964f4e544aac158e39817a67fb8377e53bf00d385c7ab300c4d7911492e6dcbd1377d8e85d0dd78d903c1cc131ca21cc85b89a5b0a44f8920e09c60bd602d538fefd294707b6a54c504ed205000839687b5abb637767071f74f11ac62393410e8400000002bb706a44adc372d2e04b2fc9bcc49c0fc07e9a67bd58e2539068d8b2a1b212c9f686f6e04f090b965c6b7b3f7f236a99ea199c331bf865e69a2ce02ff558092 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09276\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f59040000000200000000001066000000010000200000001a5f9be54087fb17798d7b20170e1bd7458488166194530dc8f289e5548e41ac000000000e80000000020000200000006cf9dc0772723d8c234088cf6f604c16128ddb22354c7b08af14f5ff533c5990f0000000c7c408c833f2884d32fb127132badad54c6c77e6164937643692c424920f085698d4de0dea77db2f4e89f858b95cb99a9d1585e5ec124a8e2440a4fcbd0894397d9d8db3613d9b997797c8f3191c11e5afe00a9e3459cf3eb0e5866f896882a118f1719c3cd10e3656d0113c2a101be7d2eaa3706b4075d659e6e938025c6750b45788b874edaf10f071fc25abe4f03bfaedcf114bd803df69a240a066a94d3b3b10b9779eb66b8f51c7b0c5faaac908ca07d66dc703a09ac100cf011c32aed579ba00f3cdeb3a1a1008953cb5b2d0f5585399b1e8f419aab697668f1760d7e0df4478a1252e560113a03100dce230ad400000001a80e6b8898e94734e3edac81a5b852f53d0d58ed5bff9ce11666f52b8dbd125c04a152f53ab494c7f64730734f8fc81d9b45c6374104a9a0530fe54960962ea C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09277 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\0bcad C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09260 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09262\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f59040000000200000000001066000000010000200000002013c82187345d17203c98dadd77dae45ab22be92db5e28067d1c6e5e48c3e30000000000e80000000020000200000004e3ee71c1145f7b45a2752795af73d840e725fffdba44b4fd3871401537a5380f0000000c0ec8b4b3767eeaa84058871467cdd89f69908862ca0b71de8bb53e08d840ea1b3547564095d2c339e77be160c90979ca7ebf5d6939635c6c7c4da6829c3b7edd7488a4cd982131340c4755a295fdf8fdeaec6fb01ec2e32bd6a1c16d03216576225e8b0479ad4515fc02e72378e03fd1546dc11c3d7a9af488c0e1c972b6d80c0e13729db88e356896b5ecb9093573c7e275119d61a0325318116448927eac3a5b5188cabecbf5fb2eee5ea249ee418b93ff1a1881bee4c6cf03254b3df51347bbf484bb697fa6587d0bb0f40213e46b9636504d7d3be5d8104b5b6f1144ec5d8fc50cb2a6787563123d2ea46c9f639400000002dde47c0a2810a83e3b95545141d863ff4ca8e841e6fc4ab11c29f3b8602e64a7aede4f6b590745943448e0e22a32b3c14b836212a762188749f28e2b3f76273 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09299\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f5904000000020000000000106600000001000020000000ac4f071376cf6e2b115275500a2232685a29c353da230b1a118a1e3ad19a9143000000000e8000000002000020000000b0b47cef1b066f8b7dbb360dd2e8c91bf45678a4703dd7ed87b2ea51a2592d95f000000082efb4e185365f5e3a010ef0b295d0d7835696d7f1d40cf6e974637fa7c5f9ca980404e2cbf9752bff0aeba6887fa41c457258e599678bb7433d1caeba2a494692a427dc90a9d12f00e14e36710de08ed1fed2448c5de910de7c5c5c456e773662b3148f086bc811aa4183bf00314e7e3e418640a0d439df684b8987839e743a27d82fab808a492399df2a205b98807e19f72ca310cc730639e8daaa0adc877b1cad5234fd3c14d8e14e0e8a3527352749ee8d08e875c35e2d47c23383a72110f00cc9da665581f4f9640abfbb6fce0f8dff33275fd4424020c9cb8a7537e79ab596de9ae9f5185ff90521ca75fd249b40000000ee5ec7a149ae88903386a13eb917e3fd609c8ecc94ca2bc537143e8a4c29c483b381850d16fac56f26efbf9d4fce528b9ee1ee84f94f9016692adb4905887eb0 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09271\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f59040000000200000000001066000000010000200000001061f291bc9948082eff877f9bbbda6d4193925ce715163e83c931215c0263b1000000000e8000000002000020000000e1c4786e50ff168f82e976a3021453491b6373639f53cb11a32104ac02c0e8ccf00000008e2d9ea54b28029d71187aef05c697ffa05e68e16e10c8adaf133abe06b06f232c8fa8a7776082a8697a35aaea7344064a56357eb32a7bddddb0092816ea83db61a04a7bcfec9e38e0d7a85c06de567fcf28687143c1426c9da7de2fadc9e57bf7419ee75760f57ce12eba2a26dbdc12797a84e20d5675c7133fa12d41f323e7fbc6e9a566948293769fc78dba22f17aa1604fb85d6d8505d71ed7b170aa59bdfd2e4c0f08c595ee63114b9a73814d311564cefdb19d3dbcf8f1c7b3fb2b31311d0270197824d35bbe9a02108e18f9f025d78066db215c66331c5fea3dcaf3bc040cffadd58216062a91a2f716a794b5400000008e0a88271b93ad70b3f088fea7554f880fe8cbdf5daaf3ca7cf8295703d40c0c368947bf4d4bc576880d3bc830bb27c0002ca8a1461f671dcbeea01f8a05d7b5 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09264\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f5904000000020000000000106600000001000020000000129eab492d7e1d308fef5e32e79f16e8be77a781fb4403b5819ba4c0f304d52b000000000e8000000002000020000000f3715557c1b226552e996be0a1f4704869b5439a717b72bc2b100c85ee036447f00000000d1b1f110548fbde564388b099c2c65d5308f1b2e67221f1a4843763b52d84afaec457f6dd67fc73a26da5f297d5c8081db61de7c024975e3b57ea14d04a0b4f921fc9ad00eb9240c6759fd4968529a527572ba16479efb661f49ec978a445a8ec3dc53585bbb73e6a70dd2bf18ba99b53a6dc9b34899e8d644f139b79dad40c69b7a24bba610cd8968287ab3f37748269de9bdaad01843c69190b965b2273d87c232ddaabbfdfd0400ba9a775acb71ebd3941a3861771c75f357e7933e3dea2c346e7007152b5f333c86dbc74883e46904d0f54b6194f9215b573f9189dec991d3ab809a5315cb1189f07707392876a40000000128a4efcc962b7dbde34dc49720f4ca0aba941121a22cdb7069378e08d64541fcbe6d8b969b10b5bbd0214fc733432010cb8e9391d98f3258579aa554248678d C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09265 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09265\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f59040000000200000000001066000000010000200000003959d21d2eb8c5a3d2272bb3d4f8c32dc775e97ad43b688bf7ea8d52e13aca28000000000e80000000020000200000006d5cac76f760976793dff0f3686429e18bd5cf606e89c1da23a97e520211e9d1f0000000196879db584ca1bb1b4525ee962e96d3bc5b4731f5570641a2390dbaf311ef09b55a69f17465584fa7af0a5c9091baf1b5cfff3d13841939cb915e5556bfb700febdd7853da9c94566a6bfa726f5e95e6f5488872f19db45ef7a61e815f7a5766c3c57249fcd3396e32420afedcc57cea55eb7cc6d7d9a33d38ef5ec0ec333eb022dff1488a1d73b90e75c5ae5720ef8ba8cdbaac7eedb443720cb05a8d7d520bb5df558a65cd46561567c1274ddc5029c118a3570b9f649ab98c014988edc5b0e279d7b3f972de71ac04e75c82de35b7708daa0f189637ef16bbac3404fb243dfda4b2a404a0fc7a762f1986dc7a64940000000639acf29349031cb51363f2c35ed900b21496ba68365d4a9d9698b76759754193b4f3143b5b178c9505f2950dfd5e31640d04eaa56972c3a9f98794a55060e6f C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09275\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f5904000000020000000000106600000001000020000000a83df586882fb0439041d7480e35cff442cbadd64af8d9046c6f7f4c9cbb877b000000000e8000000002000020000000f9c086ac30e881a39ce19992aca99b798bbc835fdb2f4a17a17f22e5403f4366f000000050351776bf0c6963da70bd85583b9a5c5d0665266987257bcb26801f98b5c5ee8b0cdf71462c84faeee56cdbe8f5ab124e9b1fa48532e36d5873255819a39532a4e96ec6ae04adf278eba3f9a0537f3604427f3da000d568e3e420799b86b7bc5ad78a8472c2311f81a189bb50a038f587bafcc45da93a1b43b711de3f21786d29d18b63378329a446061ae2014a3cd3b37a2db43830a0d7768a5f3858a1a9b171fab3602eda3866e5a2574c6716bf02a0e4637f362878d20a149978ca87d6bea78c28fe9b42033d8758f994593e6e0cf2bdebd0a895aa45adfbe14ac37adf412d8f3015aa2c255c01dae2a1fb493ab84000000096bf781f8889e5d85046796caadb1561f9a223a7b6d65db986e354fc245cd254c904e4bcbc495d2b498be56dc73997e5227246b644ab63b0109b2fa87d3e46a9 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09271 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09263 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\09277\ = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005112f476f46b57408cb9914bdbf37f5904000000020000000000106600000001000020000000b03671df74a52e04a9a24d14961872b8c95db5c98c1a476b9e5a9be66d392725000000000e80000000020000200000004b87c20dd56bcf6c27089cd925ef35d18c94f3f968fe07a8340812134a53ce54f00000001b44006a34fc67b363ace9b8b2946e9f191020d6a474d7594bdc7fd220553e7fa4119c250a0ea8b5163c62083864a3d67fa8c3d7f8e302aaecf8f058af0f613b3f4ffce9b2ec9c467fbcf50fcc148966f8a82b4a3ad2a0d52a7d4bac6ffdc0e9b8c1295d14302bc5f2e266351f3f02c99b03c4d85b4e9de5e8b44d9a458c17297d3b28aef40c949368f718fb2cec3b502385865e2ef1a60faa343d8c12eca22b327bf1ba84be94fc0130103956ad22f9fe31b97c5fdea12f643246435f3746fee90d277159b6fc88650e61ac84aeffbfc4508a7dc6de499da493ada932e9b73bc75e0249205c71d84f54c0e8536bde9a400000004d350402bb36ad41c53975726fe617cfbbeb7897beffaf7909baddd7099f936eb3cb5290c6f19a323397717902ebf9e8458a977d3ae7faa1a265f6c13c5e2242 C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Licenses\41717607-F34E-432C-A138-A3CFD7E25CDA\ = 480affff430affff3e0affff390affff340affff2f0affff2a0affff250affff200affff1b0affff160affff110affff0c0affff070affff020afffffd09fffff809fffff309ffffee09ffffe909ffffe409ffffdf09ffffda09ffffd509ffffd009ffffcb09ffffc609ffffc109ffffbc09ffffb709ffffb209ffffad09ffffa809ffffa309ffff9e09ffff9909ffff9409ffff8f09ffff8a09ffff C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f5fbb2c69b296d3ea4fb04435cbd900_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/3616-0-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3616-6-0x0000000002220000-0x0000000002287000-memory.dmp

memory/3616-2-0x0000000002220000-0x0000000002287000-memory.dmp

C:\Windows\System32\alg.exe

MD5 6d49f9ff00ef04cb0149d0ff1e5af908
SHA1 e2701e0f62be454abac3497de1cdf0a382eb33a6
SHA256 cc7f3c256dfd0bd0fc9f4563e1a19dad7f906222717a5cc24ab650618079aa2c
SHA512 e38a73b48b1ea7d96f15471d0b20bab0d1156b2948a02f4b3d4d430f5110e905cf4b5f98cdb9b350c58f9bd0d62a96c01a6fda2f13e280876fa40bfb4957b479

memory/996-17-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/996-19-0x0000000000630000-0x0000000000690000-memory.dmp

memory/996-18-0x0000000000630000-0x0000000000690000-memory.dmp

memory/996-11-0x0000000000630000-0x0000000000690000-memory.dmp

memory/3504-28-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/3616-38-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3504-37-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/464-41-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 f036e29c614239bae235b4996f25452a
SHA1 e95f6282b3fa2334e4ace0813a12f469a9fd4413
SHA256 e218f5da1be91ff3d821fca97ae4bb979494adaec1d80fcefed69912f0c83bf4
SHA512 04122a81dcec8f8ab6b08f67430a3469dd68899f2af5a8fab23d7ecee27086e7c2bc86bb3ea337be31e81847c73a6757abd702e48b4a8b59afcb9c954b474b18

memory/464-50-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/464-48-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/464-47-0x0000000140000000-0x000000014024B000-memory.dmp

memory/3504-36-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4192-53-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4192-62-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4192-59-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 f4021b6259c4bb0c9381f97c90f6d8cb
SHA1 ab8ec297cb1a85c0fe9557b21e9121caa240774f
SHA256 6a29bee0caf3e4cdbdfccd62477de8af4c5daaf3caee63c1be0e40bd5d8786b6
SHA512 7da566fb8575ff72e03519803a54f1eda6101a4734a40adcee18244a5a4dfcfacd4383ff92d394ceb08c3194d0b87dfde2ffdbb37c1d4daf771fb817ae89c874

memory/3608-65-0x0000000001510000-0x0000000001570000-memory.dmp

memory/3608-75-0x0000000001510000-0x0000000001570000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 072489876fb73f12ea5e4d02dcd9bf08
SHA1 a44a9baf2363c5126adf8f058a27ee99979136f8
SHA256 3069168898181bf8a5f2b4c3c53ee3ce5e2e1369f6d877d1295e2194f01a291b
SHA512 8c25069e46fb109277718ae7112c269d270761da71de44485f87ea054e0bb1fdcef0cfe120863c2113e28120080ee7c9acb97c870dd1621d937e08d86c714213

memory/3608-86-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3604-87-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3604-84-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/3604-78-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/3608-71-0x0000000001510000-0x0000000001570000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 2849233c41f6130c305b182a518e0bd8
SHA1 96453d7dd306d8cbc9f2e6e4ca6e02d22f4f0122
SHA256 de8170b6e6f09a674f3cdca2e4c2a3499ac8b28c5e92efacba3ad0bea4fdfc05
SHA512 35f137ce4531e8c2f20a405ea028843cc5f72dd63a694bcd85de1f7c115a4e471eddbde94286a1bf3423cf0a7910f428fc49390cf41945abd7acdd9016ab5c0f

C:\Windows\system32\AppVClient.exe

MD5 85bcf5df23372c06f16ef6d699f12cf9
SHA1 ae3789794718bf8669222b441c3fdf4b78683753
SHA256 9a107b81ef29d3f64526822948a8b5b551989c5560aed5cdd859d203a80baa48
SHA512 257f61086db13b480a2fe43d6bb755c090b2feefb6229b35b527fe905ca357a4063fcf45f055938dacef6283440756d11e81721df8cdbcb2dad7ce6db9fafe3e

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 5283a0898f51fa5451218f1bfd4f0d8c
SHA1 6869c68aa9e1fbcfc631e723b3f36a04f272522d
SHA256 fc40b356d419848147848f96c2fd4598bd1e40d500bfdc443bf89c746d095c17
SHA512 63f73b8509521fad48e412a7b77c96878c1f30aaa6e419ec076008db30698c21d24e0069c3b454797cb06d31be6e468f2de5de84f145c9966a0e5fe917bd555e

memory/996-246-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/464-247-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4192-248-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3604-251-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 f6ba7331fb3066c9af9d50300ba34d59
SHA1 45dbe06f408ca6e97d8039e8a749c3efa7e81f2a
SHA256 3ee8eeb98e0076bfda848460fc88676a040f9efc4ffb9c58b1ab63fbce38702a
SHA512 cce201c9fc990cc59446767f2925f654db4f959a1ef1537440fa4a776421c933d2b4d4334172fe1b521388c64c23d9d3e3ba956308e87b76294f92665f606299

C:\Program Files\7-Zip\7zFM.exe

MD5 3740f816790b95cccc1f6100195c356d
SHA1 a7482545cebcf859e03455f6d45afd7858139511
SHA256 0e037fbf2d3a86fd7322b53318187a880b88fc4ff0730eb679a60ae7d360e964
SHA512 52fcd09e48ab7a88b8af9d66456a64abcd26b11fd36da35d4b8c3ecf619120aab134fc71417fedca3d7f87d8f04a232c9d46192defe41c9263e82a47b330d889

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 4e00c882b2afc00c803870b8232f61f6
SHA1 76e0a8b423150e0806a93f792d80286df7671ff9
SHA256 5562134ab5be84de8e9300e47358215137fd0f19835de6bd1461ff5c3ff7a907
SHA512 913c1e3efbab65062d36e8e1213aa209f639d55c8ed137109ceea0d2d9da3af1ab24a3b267916f217513992b6b552bdfc7f15158a9b84b708826bc1851dc07fa

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 f3a7b1d273273b9379e5639527dda485
SHA1 f3946329e84f0ac8b8b3f6e96fb09c5dd310eda0
SHA256 ba2dcc0032a11a2409987dffca3028dbda8f2bbe5e8c264346c163da2185d6f9
SHA512 80942425b5ec93bc6dc1af5d81aa1a743ba0729312b2589a002b826fa04c016299262542eb8bd07ddbd34144cf7506424ea9aeac0f87df1aee0a489b6e899d95

C:\Program Files\Java\jdk-1.8\bin\rmic.exe

MD5 3efe5b20389b2e03bea5c2d76247068e
SHA1 5694d1fe5db15e9b31f36e9960995abf96d34088
SHA256 d6580bdc56ca2546de314183a8a89931be1c5e4b590f5cf2bc30b0103ab90551
SHA512 964ccc38c1d490906a3116a808592dad7353e5631b8a3854f0f96f3604823c14c9fc86a82eabef6c2f7cbb4de2c2762bdbc46c53e59cd4d7ac7eaaa052fda5f0

C:\Program Files\Java\jdk-1.8\bin\policytool.exe

MD5 82dfab82e92e60dd28b4b7236eef2a5a
SHA1 99e910a58652019803fd921a70d355313113d3ca
SHA256 f18a6c3599fa71faa00707fb1c7955d7913fe63f293c94a3e1ef3d99387c686d
SHA512 3601456637d281fdf203d054650ac10f4e0a328129e58dfbc99a05431f36a92ba6e71a03586244c3786ca0f740ec4b13bc8a3601819aded216fc61d20f57ddc3

C:\Program Files\Java\jdk-1.8\bin\pack200.exe

MD5 2bd0d124cf803e85b983c4cd419ee2c6
SHA1 62292a105ec43d6e549fffb88825d75554756c58
SHA256 9982d540dfb73f2fac847fdc22b2cffefd82a3276197d483416be6357f258ef8
SHA512 e802e4eb695a039593b4340852fc8e1bfc3e78bd04c40c3311c4314cfd9c0950725b98b7a31a9ca82e6cfe7f36653571d02108bd144f2e14d46accac25bf0ab0

C:\Program Files\Java\jdk-1.8\bin\orbd.exe

MD5 addc2e1586b97956f256231c4ae784c9
SHA1 5ccc519b48e8d950e5b0915ed926ad439e408e12
SHA256 1687c6c704a19d8efc8bb5569cac3a02a38a60b91bf22eb99f32217cc82cfdd7
SHA512 ee492928000e737c8ba742128611f7b727e7c507a2f81bdca3d841dad862491ac9630cb1e5f96f556d37f0ad772eb2ecc2cc9d01c9c10a015b6bafaa81f89ffa

C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe

MD5 f5937be6ad5c23b58e61dce27dba0234
SHA1 472ffac9aabd89b637cf632250c5979aba18ac4f
SHA256 de9685bfc93991dca66acd21164b786f3c3d9a61c82095b483b8222e27c97d45
SHA512 b3e2ca04de92005809e509b5fcb0960413e8bce9731602f9538f806afa1665fcc261a09214c649788af4cf7fa9b19ba6af729af29590cbe94efafe6a9cf52d88

C:\Program Files\Java\jdk-1.8\bin\ktab.exe

MD5 743f837841e6f26600abea5191642505
SHA1 a3b8dd00becf21ea9c441997772993f1b4f68396
SHA256 9e2c7b319f60d5e3657493b036e767b1d73a83bba44e3becf93fbbc73cbabe4c
SHA512 532a84a7a38455014b1b0a7d51697245e8f6599dd9fe642a86f250f2be41745846efcdd7a05a7896c0c15ba0ba042dffb494de93a2c67902a8111131ecef01a8

C:\Program Files\Java\jdk-1.8\bin\klist.exe

MD5 bc8bf86129429f6e2686b59353b92d22
SHA1 cac2fb989d72ffe89af6fdec288ca7b944a796c6
SHA256 3cfe298b05a61cba34edac544969a7aa09319fecb8686fe0c7676e1a32522749
SHA512 ea7455ac3df8866470986d71bdc6a9bffd23dd7631bf0c975383bd4e44cb7cf6c1933d84f8a95a4f4da27edc77108aa32d1964a9a3c9e4682ae7cfe2b59bf77c

C:\Program Files\Java\jdk-1.8\bin\kinit.exe

MD5 32a154c5377d35978d38bdc3c071b622
SHA1 515303534a3d84ffe0a3b0a9a89b51dce8f5266a
SHA256 23c8144e800e10f908ee7cc7a13796f0a52c4eac21f136f6b125945973077d5f
SHA512 fa493d1a5d8f7c3c718a92890abf56055e7a5d3db8f0f5cb515372d867e65fe379b117c3152a396bef8f6b827921031b0948631ff52cd17843655a962ab3da1a

C:\Program Files\Java\jdk-1.8\bin\keytool.exe

MD5 c8aa7958498ff0cfa8faa9fb82d9f13b
SHA1 ce72e20b874ca24df301e3ded39865eac864e854
SHA256 fcf4e5910983491122c69df8f8b248c61178ef107cd30fe35e1486621495ce08
SHA512 260f350fbec8251a59809bac94a36926ddba7d6c36a74ad509a5d34f122c8b2e2d959c4023ec88ca42f88e067668999cbad19a8f6c9f257c2b2429dc7b917ee9

C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

MD5 a972b1e5ef2e5c05e7f50252c7d56cc0
SHA1 5f65c14fe5fe6999598dae32e75fbbd3a2a7601e
SHA256 1d92dabeebe765d6eb655872a07348ff69a446d9ee2444d91535aa7efdb64add
SHA512 8e508dbe9c773db1aeedf1309cb87815cb8d095b803d45aa548799166b9f21c781cb496d15689a9a091d65cd7ae5b1bb9845cfa1d0a8b83bbb07025b992379b4

C:\Program Files\Java\jdk-1.8\bin\jstat.exe

MD5 448a7e551aa77d33a8fe4100b3ab6a0f
SHA1 4ab852ba75d7e4e38b97ddfe55e1ddaeb9844f01
SHA256 1ab15fef4c337c4d72b066ab16f838e66c62a22b3796dcd7d393449e07bfcfd9
SHA512 0fca10cdbe2d4054af62886e150dadcc49b10ebf5f8e570f1f81e55ba4631cd2b139c227bd47a527e13133d08102d2e4d69141ea61550fd77744beda2e0088ce

C:\Program Files\Java\jdk-1.8\bin\jstack.exe

MD5 8febf0d5777b146a55d6729186b91084
SHA1 3bcf9716b9683d55d4c0e5fa3c8f8139e7a5e62d
SHA256 a87508a4c222208f61b6e4e90fa5deacce70a7710173174ea0ce1818286767d8
SHA512 55df4978cdbc20042e2018711cefa3ea58414d4cf29f5beccf1875d9b1887b675d0ddb695bb104aa9155ddbd4f600112d57080de62910e1afe4cb702a3496127

C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

MD5 f0dfcb7743e0723bb9e4a8fef26ca70a
SHA1 9f1dd3d3fb521a78af8119934f4aca0397124cc2
SHA256 fecf90a0b9f03297c19655b477dd6fe337292ed414cf7696d16bfb3153499bd1
SHA512 e6171912e78530f9ea16aa3e1581f86faf015778e9b6e51eaa8831a12fd3eec56d258524ea7995da10c7b0aca13eba958d7cfaf299c7a3a5c9203bff7073d45e

C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

MD5 ae656d5126c1c4217f79e01a0096936c
SHA1 a62ae4483d1ba854680596457c4bb2f93a48445c
SHA256 22dee27f5ca9c8863bf52123e0fbb821e5cf00c9c0251f4f1578dfc7c48227a2
SHA512 27b270d94563f75e46c940ae4db81f8c23b1e4294190153487f3bdbbbfe55217653b3ff1c7b3844835e368be2c55c5ab19557ebe5326cd6b0749764e9c96a9c2

C:\Program Files\Java\jdk-1.8\bin\jps.exe

MD5 48a11217f73c8d9a470c89976b108390
SHA1 d0ccc964f610067e4edcfd21888879ce518e3a8c
SHA256 a6172c29858c4d097020b47561d791358470f62a223feee091c649f0e3192a34
SHA512 d3be152e2ef6d4b65abeabe51672c06b157f657e4cda288109c7dc5497f0ae5baf0991b85384b756fe6915a5587785565b293c6a8204a9736483ef529c9492ac

C:\Program Files\Java\jdk-1.8\bin\jmap.exe

MD5 6ee7f26b1a79e85813fea415c7e367ef
SHA1 ac5a2e72ee91c0ad59e3dc9bacb2543b1391f119
SHA256 5282e32b1e6b806c5b0c37ee7b7dd8dd8fe190dccd730a4183ceb72c7322200d
SHA512 e96df11fb6c1e62fcce76c649bc6c9bd8593250de1057f39508d9f43502b37061efc88afebf38b548fab20d92004e24f2d1f4b22769a4f1254a27df378e0285a

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 0aee0ba8875dd8af77bb773041ba2ac7
SHA1 64f2b96ff7b8a806a310343a5cb9426d15ef275b
SHA256 8540ca35e118d18678fcd0ca2d1b4fa1a0ea7a00633f0b5bf95f6f217a307187
SHA512 719ee2e98ad5c4841762dc889723f65010f0c9a6bf6d91943f397df72b4cf2b33cb83026fb4cb8db54811cf95883976236dae0ecf6e87f61eaaecc643072ef35

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 ed2a9b15ed0d86d44926be4f0b830a25
SHA1 9e1250e5c005ac6e6877c5278e40d8fe3c0afe50
SHA256 a910fc1894a3ccf476e25d5c614884d55412e75110a9461e19ef66e6fecbfdce
SHA512 e2e3cc03afda3f1ba91fbfcd1d742510d273642dc27eb1bdb283b588c18437c02bdc9f2af2c49cebc66bace18ec7a22b8d504a7dff0ab37c8a720e53f80821a6

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 266219a3398c740a93f2a97bba886ac2
SHA1 f2e9a3a8096484ef99a9d1d50898173feb49ca7b
SHA256 fb513dbb1f5bb745e36a65583aa30a1d4989074ece8a7126e71f151bc8d51aa4
SHA512 e538d78509383591603b6b5fd6614599c4a9edc533130149e5466d87f44afc7deb660571a23b1c8b6c81308d7f89b02579008d3d0f8de8a3432cdf63543684b3

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 610dfbd9bfc0c28644774546d02e0ba9
SHA1 c951b701ad0bf990d20e4cfde1f4fc8c40c63913
SHA256 239abac259f00e55fa9f638896827afe7901c147d9fb64febefd0612fd5848bf
SHA512 bfef4f6696c89980a585259ff60d6a4bb328b2b27a7746afb4baa5fd5701fe70df9d92ebed0b842caeb03749233e9b4b7ceaac94f37241abd758c071ac0ba86c

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 117d9c523051068d010ca7e7c83df28a
SHA1 9dfc83da2bed934e5b4257cb213e289b1db598fc
SHA256 c71b63acc6efdef3df5935bbe3398d7d436b4297c3d2e8f9d8d12e84aaa49e66
SHA512 b0c6dd57c0eb4dc5078091f36edb9a0eef49408c5cdfc310636633d0851b8ae6a7f9a615d4268df1b6780ef81607109c97fab7193df1357c8e667245c161a107

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 f0d7154b9cee74834304b82047a36dd5
SHA1 3a86137ff61d8d85cb7608b47a9de069fd0fb616
SHA256 8eeedb95e5e1939a67996c3825f07fa9991a1e6d4c3a21eb6a3137561b0cefae
SHA512 c3731186b28400380feb1d834e77a011faf378e4333ce71bc24d842728cf992cce0e70edf636741dc8155a057a5c8225ed8cd796ed104977d5d65e41eb261d14

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 363b60044ee02b4eb73d3487aaf50d5f
SHA1 0c04bab5ceb2c52545cf1ae8a28be32f2e6bc2b8
SHA256 979368508a5b76f6299608b7be81f78b469d72bf23ca4bfa0df399b19daac98b
SHA512 12033dbf405460661b35972421cdfe64e5a1fca4b2ce8f22b413aaac6e6145f4d7542dc38653ca0e3c5008ac79ae3f240ed29552a920f91fdbe465bda4ad2da0

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 8296fa935c2ff4fc6ba045771c91ea5e
SHA1 396435a4d50ad3d810bd7913c0f7945936620926
SHA256 5fed9cce3f25bd341b8e638dacd5a6d7032c7a3af3be5f60846fffb0cbf090f9
SHA512 a7e94de2eb382cb440ec1352dc20ef667fbd89ffbe7eb1fb2509404ad7d0ceee33170ebb89930174377e02e01264b26e7847bbf49a357e57f24a99b1db2c334a

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 85423226109a460c312596883e6eb5e2
SHA1 73b2596d931a25872d33a40b1b459030664bb5c3
SHA256 4590a50d426c353c6bc5691b542bcbc3e11539163d329d66f9b8e372dee855f3
SHA512 cb2f22a425226fac1dde61382eb74b7d5d94acdbca065d1815603001ab54d21a2684dbf0cc99dd01c67a3ddfcb45f33b00a8b3dc4d163d8e2ff5f4d66218686a

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 dd98545488927427434d95ed2ff871d0
SHA1 c2bd5645c5363d5997c3b9b7e846243cfb7cd417
SHA256 c307731dc1fa3802d63ac4cdb410a20f3fc75d3c8e4c5e66463de6cb0eee8ccd
SHA512 9677a0206fff20642b1e45f754223254e4b4b13725429f33a0a4aa1119a8bfa148f33f85dff592c7dcbad0cee5c6078571d611c8f3d20936bd5014768b2b6c20

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 b1d10b0132785e2c2e8b1ba06a13676a
SHA1 1531ed60fa4f330b171e0f83c9bc0b1ba674ab1a
SHA256 56fad2c92e24b6362747348909a998dc7dbfa85da3233a1dfa595600f1bb304d
SHA512 3a330f804ed34ec43418df1c040ad0df9e09a5a2c568d15841de0ac0f03483398168f5bfb5b2db1f509b6cd49947c53924ed8de079de1f309d0aa00b088a557d

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 d0e761d7edebf5c08d81449eafe23453
SHA1 02a6d3b765badcfafe15b2085d6cae4aac39d0b1
SHA256 e51da75179a21db56b0ac1778ae226a797b6c54015e570e3c3a217bd4b0fa150
SHA512 82c2f7a7d739bcdfa2fa952119c2d077e225c752c8e3e30450412c69e587c40d0e71e95fa53e1e7aebb1a0177e2e7de68332b66524aeffa9c8eaa40f61ef98e3

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 0a6ef7db1db187dad15b05ac70fb97df
SHA1 e4cf7fbc5f47ad2b856f86d27d11bf076d38ac9d
SHA256 7db1bbb94b1d473cb863dbaf185ce3b555a5b82a381106dd5360267d5c8b4b5f
SHA512 a02cedc5cf4a9155bfc5cb4a53c78acfed302cb11d9b90e871eea290577e229b342bdc503de66e9eee13bc8cf0e9cbea4137101178cfa2e1f1faa5c2058a4505

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 5787797efa30802024a2d330f4441c5f
SHA1 40f9dfe2b7dac370d170e63ba591620223db97f3
SHA256 7aed94684a60aead7e3dc119c657d754aa46ac7d742ec8b5deee8d6d2e82ce31
SHA512 f9e01f4fe93fc15f8a54b1d2b033f571f9c8c4e6a46f6ac5b2d9631bb6ed28eb043b720c25abc8718fd93ed840c2876b062c4b2b9c216686afcebfb16af8c506

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 f5f4273ff1781bb7ff1a5643e3599b8c
SHA1 42aeb130bd1a4df36f905b40a9dd0358a03ad21f
SHA256 839fef74e607c7fbe7ea691d88d02e2ae0258a6a375ce3966093a103af359ddb
SHA512 a2c0becc47314b0c27aa8ed68a81b6395e9f276032624e4fb59c922ec88c0da46635d77d52f954202276dc9675338ea2c6122444aede2a4d3427b198f2fc3de1

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 69491cd31e06dff65a0a36ec863ad5f4
SHA1 2ec808dc1e54c586d2f73430cf088013b12c8102
SHA256 ea9f0533cbaafdd6e6d5d076f180ed273425d8d7abacaa48d53be9559f92e362
SHA512 080a2e6549b4b2996ff770e8e3ddf291d7d3ea9c310ed0d8689445e074f76c73f8373de134dfbc9459cc9172e45c7e68701322aad3561c554fdd6721d6719f58

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 ecc92b3131e3a473b8bb96bf570a14dd
SHA1 cde1e3476ae0d05dedb180246606448cef1f16c1
SHA256 f548ed8961b15ebc98d611bd41cde211915c414b982dffcc3eaaeb29ddf6d54c
SHA512 34741210ef3837fe78e178908f4a1edea3c3d101041c8c2c3473f3943450d2bea4d15d2e39b3eca8e9825a4d7cde392fdc355fa11016b7ca6dab60dd762c06d9

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 0c8473d2deada920381767d0b6bfcde0
SHA1 ae189bf83bd0958c141fbf7426f51219b0a74d62
SHA256 d8aad94df6c507fa963a229ee98212679062f4bcdf592f5135949fa2434d273a
SHA512 d5cc75e0397dc18e6c69f1d8aa052d409283a4da76a42608aab80a0d0dba6fb261e41df78afb1f61a61f4e899900edb759bc60f175276aef941e08c3f4f5fb42

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 3468674cebce620b4577b7a1c1771bfc
SHA1 f1e76995b9ce3d915e70bfca753748f1d2983c96
SHA256 6fca9655e1b25e2fd7d8cce97f05186a7f807fd13841832cdbcb0bfa792d1e13
SHA512 22a825bcb60a2e43ad0cc13b645ff7bc9d75316ae4fccdd545b1f6feb95dcf500bcff7ffc75ecff2428a533d6690cfa3fdded8016cdbf491c8b1afd606b11df2

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 dd79bfc81726459b2e201caa671cb4ea
SHA1 8a7bf9be2c45fc05a6bf7b5eef9c3c5692fa7bd5
SHA256 505974760aa0d22793b0356b6981ecf3c20ef920faab8e78bdcfc8f0cb41f3fb
SHA512 955e585249c85dc0aeb81be90f8b2c0676a4c5ba1cb538e24f01ae56f5a345e20ef428c2054b4a53c92f742843e6c95a93b9984e8d60703612b9c0b8850a6dd0

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 79234080a71d5315083446fa85bf0f72
SHA1 cc47fc20d9aeedaf494ffd57dd5a9f7828ced630
SHA256 2cedc71ed16452f968a2fe9abb41659a5f4316642fc5cc82428e49413e58221a
SHA512 4aa84e8dae5071e5245890fc4cd28d341c55ea42a22bc8142a82d77ef681a5126268853e2778855094b93eb2c49e02ba2cecc0f3a930ede0d476d2b09d753caf

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 7d49882154d19210fa31f730f347efff
SHA1 6c0b5b8b9860c241d498007446a50a6d05624081
SHA256 a61c5026fa53cda4329cab565f57e8a6daa8813e92dd9d55fa8f833c5e33a972
SHA512 75bb96ea3527239a38239065baa50b4ed8a74b3d31d482ec69df80ff00beeb0bf1ba5e023f182ccb968a1aa97cfa5405ab7d3711c03d49ca869429541e4f6955

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a844751133432fdf2d6c38ad6f2c3fa6
SHA1 9e113c1fabf36b9a75294785d539d3bc95b9ce27
SHA256 c84de2c42bef9a1a98ccaf8e98789562669f68eb27821c2447c95c25c086628a
SHA512 1dfdae742e03ce64eba7769053539b1cd2a690132a278f98bc473f73acb99f328723c7d86349fd4879f669dfbbb5804fdd738ad1b73506f9eb9e7cb5956c0868

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 7604b414b82dcdad4dacb68de40e0acf
SHA1 e7f3021d87e701bdac3d76aa62b8db5d48c7a5bc
SHA256 2070cac764b38d3e36ad7d1370cba92d3f84fa032d0f8a097c61b8d0e396bbb4
SHA512 c87d303d90a6819871e7526d831da3250d36b42d67bc2c56c63635e5d31633ba4df15142949bc3782248e9d0dd115baebeecccb1337ce8ac9ec90bb9957a1c5d

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 3fcd01e3632432b9448e30e47b997d08
SHA1 bc3e4c9a17c29d9720f0230f1698eeb12667807d
SHA256 0e3fd046355cdec18ba7f035c311c26fdf08101ee6d8905054ce9c6611f7c387
SHA512 ced4e7217e50b2eeb3c4d11ac330d9c3026d8ac4869b3ebcb9073fce8e9a93424691524b23120b84829f235ad6f1662d73e7de34065be804ad7f9e8d6897e739

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 0c44f14d979974c6dbc8e6e3d4b7a7a9
SHA1 a7fb34a32d53bf47b3603162db14041bd6bc55a3
SHA256 e9dbab452a7e592ac83df9b86aa7c56c71a375a197e95e74a9f8b3f803a81754
SHA512 5145f7147d5d7ff3d1e6684c95512040fb74991a1e7fda4d6448252654fb36225ddcbc33c13ae86ad997478680146bd9f8ec1474958a84c32c8ff843b9788aa6

C:\Program Files\dotnet\dotnet.exe

MD5 4ff400d4d32afbbfd3e13d6d400f0c35
SHA1 3c48d24e9d96ef6d710530a440bcedd16faef540
SHA256 f9710d3cf0c89226c087f270fc0b636440d2e5b5fa16d5d91b67200742e265eb
SHA512 a3782a6dc4ea326c00e09718b705842d2de44bef89c2a840d0afa90b9b1d9a657a9bae11a733e5dee9ae9fdaec4db439524df2eb39d494c35a346e080b1e4e6e

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 4467afdcbfacffd3fa1ece235c41d21e
SHA1 615f4ca6de7105336d5cca07891f4fff7146dad2
SHA256 5e2ac799c459fdd31fdf506fcf35b802db14cfc845ca5e3385bffcb0eb1f7867
SHA512 c95280bd1f34925f4b72e43c6e326109de35249e288cc6f00c2ad6d9f8bf929fdf4c60f75adeeee0d96ec61d2909a2989d3ebdc121c603bc23c7b633e1f1c78c

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 6f09d5e20ef60b47936927a440743e5c
SHA1 8d1b58bb5c24a58c4bc1e65e4bf235508691374d
SHA256 556486dbf0849074b64a0d86e801130e99d21e2a9748c32be70bd7d7145eaa33
SHA512 20cda9b2cae604d5c051cde313d3c38c9cd87180623a1ed861973bb103feb08cdb2a74f077b16d0145a32ca6f2caae773d644a630b0e4523007840b1d6a357ba

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 7fee4933782979203f245245d717c9f2
SHA1 08b59ebf433b4c5aac33627070b30d162277dba1
SHA256 e9fd674dd87c9861b7ce607943030d66503b6aaf2b9b5d5713c8cf7b795032da
SHA512 0611068b652e303b807423f2eda8ea77e8c0456cbe7fa416a0d30f33d193138da927371f694114fdfc617138a4899b4fe14072e81e88852fc4a613dee5ab4aea

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 5e9c966887a9de7f312490545d50012c
SHA1 098e62661a28d3261f3fd123ca19205ce4e7ffce
SHA256 f0b5ff2a4b644e4bdccf299172380246b4d4c4a9b94258b93079f9fa90e7d53d
SHA512 1f7392309a6e639fd793326680f0c238bde22662724858a1583313784860b0d528bc48d31bcaae3c84caca42875c60e7b68182bcea317184b256d33375c433b6

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 b82adc4fa91b711a9f55825281a77c3b
SHA1 d7264da289dcf780b2eab44c3d4a3484161e3d96
SHA256 93cee54555cf698e6648e1790eb0b2437e35f0a381459a2854f0296560d2e93d
SHA512 4ed0af25293878f0fa83aa1db0c7cb9eff3d758a7d11ca753360af6d1af9795fd919721e049ad915429960c12735e277a377d23bccba31b1bcdc642028f26c92

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 8cca1e8612adaab91d41476087500f2b
SHA1 782bcec614698bc18c14d5852144ce7b48801a9e
SHA256 8e8aa05978bacff8746e2712562792de66f066b1c5be0337796fa6a086c32604
SHA512 d4482e4e19428e099094989d974d1f560f584b07741d6d153928a5de56b07d172f8a3df3a9dd7d83fed0b88369af8ca75c9730d2be34faa17ae469d8b11771ad

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 2fd95d95055864a55900c14438f52e6e
SHA1 1e350b1954cf418c221c351e6274c008ee660ddd
SHA256 b32a4d5cb8e1e860a74c2f394de669a487a8f777cdbf03976f82e5ba1340bbb1
SHA512 7c5e1441e0bc02ca7b8dc9fea9f48136489275a9e4d671b0c8fb0a5cc267c34ba33a08f798515de7edeb876312906dac14b8502d9483b7281c6e8b171f786b7e

C:\Program Files\7-Zip\Uninstall.exe

MD5 0766d3e43ae7ac206b201224e8272210
SHA1 7dd66828835f73e437a2a98c8f5ca8a002bf819e
SHA256 6c2bccecdd934351deee68bf65e330cbec1c879ada023eafba635ee127da8d9a
SHA512 be74ae9176157e176190ea822279369cfa89a46d1499a37e3850b2d6888dfef5bf1e8cca6c8c4d6771a9ddce785b2d3f8ba78a297a72f7459cecf17180ddaa01

C:\Program Files\7-Zip\7zG.exe

MD5 0aa4f8f17b541d8b8a7fcecc8c6f967f
SHA1 e8d89475b0ca1cd70947de9e0bbeaa1ffadf90a7
SHA256 b80fe0b49fd4f83baab1d4865793d3c512106b16ec0a94834248d45ca151c3ad
SHA512 70054669fbb41b5b26f0cf31f5298090a8d7c868307be73201b2eb289073938d38d7d852e1ae588db9431630172609867d3ab9419f04f59215a8862970e7c1b6