Malware Analysis Report

2024-11-30 06:04

Sample ID 240613-cmrffa1bnd
Target 5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe
SHA256 deb8e0fef6253c5f584e5034c18cee93d6400ecc6c6380754435e66baa896d9c
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

deb8e0fef6253c5f584e5034c18cee93d6400ecc6c6380754435e66baa896d9c

Threat Level: Shows suspicious behavior

The file 5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 02:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 02:11

Reported

2024-06-13 02:14

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ad81339bc3a5208d.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\javaw.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b12a41737bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089e1751837bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a4e9f1737bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092c1d31737bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a2fde1637bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c630651837bdda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5635c65e4caa918eba40483f86f21f60_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4436,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/4440-0-0x0000000140000000-0x0000000140184000-memory.dmp

memory/4440-1-0x0000000001F00000-0x0000000001F60000-memory.dmp

memory/4440-9-0x0000000001F00000-0x0000000001F60000-memory.dmp

C:\Windows\System32\alg.exe

MD5 e35ecf54aec963d967cfb54fbb699d7e
SHA1 25210ed4048c7d99f192de0b8eba81773df3a1ae
SHA256 53c1ff3ab8929f4f2bdfcf7a1335aa617df3bdd25faa496163eb21277a884259
SHA512 a0f30139847093b307aeeab9b660fb2d40c402812dd20dc9731a1f3c13c0fbea6592067e4f3b029094ecc643cb0501f7a41544e6c702a3df5b1e13fd1d0c4aa5

memory/2556-13-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/2556-22-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/2556-21-0x0000000140000000-0x0000000140189000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 6af579368e30fe4ce788e257b47985fe
SHA1 4b29760092ed87ef088a36e5f4112b8723ee2eb9
SHA256 6c196ffd5d073e9c95fbb141794de5e1f7793a6d627a3f851a874b60a48217f3
SHA512 6a0d5e5fd52025c83b70a0a2943cccf6565517b5cc3130c0d0fe1ddd06908f4c3355d853dde3c225612c7e2bc3598199ba3becc6b241a3ae54b54490cc86f2d7

memory/760-36-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/760-35-0x0000000140000000-0x0000000140188000-memory.dmp

memory/760-27-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 6a7a7377099cc8e3003d831b3494eb0d
SHA1 c82ea503b6a7b590d9bf4e3160da9ad817e1a362
SHA256 a1fad7bc5286ae629c6f4b7d51e3552de984f7191a9a943d2941ce5b24e1e313
SHA512 efc3346fe876b53e0eac3889c5518f340697b781daa2bc72a933503908bf9e70f851aa0a6619dc05cd7cf85a4ba9b9320240bc70445c627b7d4c756d627570ac

memory/5048-39-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5048-40-0x0000000000540000-0x00000000005A0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 a13df54d9517e7f050dafdba3e5bcf63
SHA1 c40a02687d0bb488a50f1a596ec2d5503b85bd51
SHA256 df75887c472ee21c1c64df0c30277b11376297460b2638df32fe505d10ae5783
SHA512 853c432f5687a18246e154aabdae0b7f055432e847fff20596a34524ec6b0729282823137868700700253278f8ef593b6d6c516823cb6d50890882eae73c796c

memory/5048-46-0x0000000000540000-0x00000000005A0000-memory.dmp

memory/4808-56-0x0000000000510000-0x0000000000570000-memory.dmp

memory/4808-58-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4808-50-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe

MD5 dad081d9a9310db2329c0cc09cb910dd
SHA1 aca0b5e2589db86e10dc50b941a257e7deeebf98
SHA256 2e625f156d145d049486a895dfd9111d702f2ca8a82e89d4806ec08569c23f32
SHA512 db03b526386337f82728866f4d79c41a501e40e15ae40d4d042f6c1b2894629fbf70196376254bf0c8fc9c2b0c944f3106c8c1ef5f54b97b4024dda5848dabec

memory/4316-64-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/4316-72-0x0000000140000000-0x0000000140267000-memory.dmp

memory/4316-70-0x0000000000890000-0x00000000008F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 af1f6f7f654afe99e8cf5e08b3bf4e38
SHA1 b857e240abee728e84dedb64eb3f2add23faaea3
SHA256 82c81212320450d182d1fe8121e50ae969fba95adf4cedee48df0c3dbe0015d5
SHA512 ad6705427d3ff9a57be0e37e1e059c968038af50471def959309390c54d841f1744926cb570160a91b1261c1e69bc0be27ac8cad22086be09544c8c529ba5c2e

memory/4072-81-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/4072-84-0x0000000140000000-0x00000001401AE000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 e82d5ac84d1a6fd285f154abe901c6de
SHA1 731b1d2e9a80763b4853acbfd72d489629e98b04
SHA256 85bfdb7e5454e77717171edb4d88f029b6fac064862d8027aed17980e6329914
SHA512 5c3c1bc9522c08725fbeba7d0b0f3ad478300c5cb9b8c3be2eff710d300b5632196ad766b25fbf21e51af0249f7122f2c9bdcde4d734f13d5d629b2b3af27c31

memory/3988-89-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/4072-85-0x0000000001A90000-0x0000000001AF0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 aa1aaf8199a4fef9663baced375cec4b
SHA1 c9730539ed67d7ded7760effcc1c4474b4cbf057
SHA256 9a89c019fb4ad8e610de266ef0fc7ac69bc244dd19422ea3bec963b9f5b4ab97
SHA512 bfd001a496371d8261adab549279f3ba36dc56458faf45e6c9f2b832da1b804c205270b7b3ad427a86688a1b566d215c9f901fd0da2769916aaa209b311b942f

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 a75feb717439926c5d638ed2c8a35094
SHA1 fac15e997f56cd3cc9f462ab4d01869981ac60bb
SHA256 314249bca920d88a7bbc0b7d91ebd4d1e2cddc6727e0263b38ef02559b3748ab
SHA512 5fef7205c39dcd8731cce59bd90d1f85828e07d4d67edfccf81290f37fef47c1670d9211c695f8dbf0422ec3fc203b5c5de04724d27383df5429ca5cfbf2af65

C:\Windows\SysWOW64\perfhost.exe

MD5 15988234e89f573a813499102585709d
SHA1 2b0e4d2d1f46d1a842ee6227c8642b3bed58b5a6
SHA256 91456422336f8d311d4f73039742c5e7effa089e5b92451d182d5ea6fd375566
SHA512 c65c21c30accdfee5b5cadcf59b4694f1347dea5c83b963583d74007e765163c9491d0114bd172a9e87069ecce6f4cd5b4fe13052d3fe6c464e12461088e7f0d

C:\Windows\System32\Locator.exe

MD5 c5388c369779a40f4f1bdb2893e08ceb
SHA1 7c3fe38f1675aa2c136886543022e6ee27c233f6
SHA256 6d29b6207416de6e6cdbf9cc73b9002205b2eaa04f965d3f0d980dbbadeb1a47
SHA512 b47dca3e89097ad0f332abff56dcc8ed00ed665acb334fa39b7d45c2484343a0b4f879cffc37fd8f8d1a7bec4b6ab652e7f0f729efef4e03f6d29451e0f99d4e

C:\Windows\System32\SensorDataService.exe

MD5 c3865887c123bdc8c5beef198d51717c
SHA1 4630d993bf8edb7ef23022b1b5ee9ec0a73876b5
SHA256 94d34d24452fff5bc8342c2935d3e67370eaa393a679362a92b0f6b437067143
SHA512 3d07deb5a73323c9c3be4f0db50d2466618bf4a3a3c45af5a90dc34a87cc0bcc364135a6f828d9b00a5b3323cd02f93c2b369aeecb9ef70d95ddf92e9e23f8b3

C:\Windows\System32\snmptrap.exe

MD5 eeb8361fbee5bc2ec2dc2a8b852745d8
SHA1 a7e65ee353ab20e3751c6e491fb0ffa5e709604c
SHA256 aa186c111dd495b52aa824a8ca9a8fba2ff7e7a93ed0486b315a3a8544aff45e
SHA512 c92a6b3aeca5a49877c4211d97f3e838e2f4099b24150d842fa61e7823e3982ae026b4fbe4f80c8bd9f6afb924f0cb0f7b26653e4bf8c27e9cd17cb0418f9c16

memory/2500-159-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3104-160-0x0000000140000000-0x0000000140175000-memory.dmp

memory/3084-158-0x0000000140000000-0x0000000140174000-memory.dmp

memory/1764-157-0x0000000000400000-0x0000000000576000-memory.dmp

memory/4668-156-0x0000000140000000-0x000000014018A000-memory.dmp

memory/2964-155-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/3988-154-0x0000000140000000-0x0000000140198000-memory.dmp

memory/4072-75-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/5048-62-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5048-60-0x0000000000540000-0x00000000005A0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 177f6469811859eb17c91327206b6f2a
SHA1 557a9b6ecb8b71c175fcfb4aee4eda7ffe1167c2
SHA256 e57775ffda6e0ad3a7d108aecbc93e4d112c40be4e6c6ea3b876bd7fc415cda2
SHA512 045c12d7b55c82920efe030642f8c3f40c6589281b84609e35f4d3ed0b1b5458ec15f18935a4c57c750dc64c9fbc9da8743148b9e6184c7b69219cc19c74656f

memory/4440-171-0x0000000140000000-0x0000000140184000-memory.dmp

memory/1004-173-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 25ab4d08755c8c77c8b82d78d865d801
SHA1 e6bc7d69d452af2ed216a379e11c3572854fbb9b
SHA256 f955f14bed5354dfcfd395250dd95fec0d8e6fefc0fddfe0b4995fabf0fa630d
SHA512 6f5903d6d8901253d706fa9082170f0cede0e3c32ec1c905b1942eecde4bd9f78c16b67bcee88bbcacf291eddee94f722d3558266853b4b0ca035fbd6736a5be

memory/1000-184-0x0000000140000000-0x00000001401E1000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 b423ea29a82ccdce73c01d1a242ac80f
SHA1 411cc64e0374781015ae0f985ec4aabedefac9c6
SHA256 0ff655e8917222f669211b1723f27921d17dda3d79a27fb1b822a004df630f36
SHA512 84f52d79de249b8d1fd818c3c1426efc3905f59b052ecf14681595f674a20b644f6525843dee5d92ee191eabece99f2c2266f8bc4823a5d2a84d997df93e8d42

memory/2556-187-0x0000000140000000-0x0000000140189000-memory.dmp

memory/4836-188-0x0000000140000000-0x00000001401C1000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 687230c4131bacb59b575ab1ca8fc93f
SHA1 173f1cff28e5a42aa4ebf1f2149fcf78647f9b4a
SHA256 444fa771ac52569380e09dbddad5a07772f18143629847eaf929c6ea22ed897c
SHA512 6446326c623f866ad5e7ebd021cbfb07d8c38adafc09c1d27ba323b58365702de0c0d679c1b3196ba2a13b1bc68170b6568448eefaa3856074ab489384151299

memory/672-207-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 9a4a40c251e67e13d2599f546a84cdfb
SHA1 eb7e250aee36cc41d6d43242ce22f19fc8f52737
SHA256 6bffb49009b99da0bbfbb8732f3c8565a1b8e82afc7c1df70766647617128337
SHA512 880a5fa898fa833cdaaf8ef489f4e9eedfad47edc33047ccfeef8ee99410b3030299502e4493cc8757b0f63c4348411dff3c013e6ceb219c78f8fc778b60de32

memory/672-211-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2956-221-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 4c68d1c4067b26a4ba3147e4229dd70a
SHA1 b2f6b2d01e5f6ab413d014e415abbb1c8e983823
SHA256 54e597f6ecb6b7e89ad6f60fe360cdc9aab1901d39f154f23357d6b574671f04
SHA512 19229d0bb6f665f0a82c3830fc8a7a65554695a2d87cd2854653f5a59978468c405f077f5be52694e28b2c050ac1a210c30d23aaaff64a9d5cb4618d8498dc94

memory/4416-230-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 313dbe0dfbdc52f3454db242c183e263
SHA1 6d9b2bcd0c36edd71647b6e523ea2b6992cb6a36
SHA256 05788e317629dc15912f84fcf628d747df08cf1d380f3ec8b0fe3b16917aec83
SHA512 a30a4e57d7abec903fab4fc10d864c41beeca058347165f2628e4799d952aaff938f251e77af6b677da19d2b18254eec01cd8f9f9113cb90518e61cbb277b433

memory/3868-244-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4808-243-0x0000000140000000-0x000000014024B000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 e31b79beca6d629bd94ca528ecf8a7b4
SHA1 f0a1f6a5e52ade2d99c7222698cde3092d609496
SHA256 3dba75396cc6e09c151d4601f3c7844f43cd807a39eb38b89941752bf466b748
SHA512 280675d3322e452926c5b465a2fafc5b43a48153a83b8be67990d9dc64469571b94ad6936a810fd46f43f9b6499c3b10f5cadc278a85408323c47f71420a80b5

memory/4316-247-0x0000000140000000-0x0000000140267000-memory.dmp

memory/3572-256-0x0000000140000000-0x00000001401A5000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 97c893abea0c58b037d8478783776b53
SHA1 32f95864eed969ca2571ca33f3d0f73a7f745c70
SHA256 b1aa783a44daf7bc9d816c4a897c21b78fa2d2283e7021ee855b0bcb526a1a92
SHA512 f91bd0ede045bc09839e24deadfddeb499b27ecacda09d6c583a66a7de308612392245c3b250977c1e6ff7b80a5ed303f9f4ec77c7d95e1788eda10859ee5e26

memory/4576-268-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3104-440-0x0000000140000000-0x0000000140175000-memory.dmp

memory/1004-482-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2500-565-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4836-566-0x0000000140000000-0x00000001401C1000-memory.dmp

memory/2956-567-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4416-570-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3868-571-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3572-572-0x0000000140000000-0x00000001401A5000-memory.dmp

memory/4576-573-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 b1e10dd2d7ead2ff9d01034bb8c9dca7
SHA1 8bc1640e7ad45767833f09dfa546a156182f4c5f
SHA256 4c95e7a39d35cbe19958f23ec0b92ad0f4ff1a533d8d85bb12e859db85cd82b4
SHA512 b447781e3804035151923edf36c96088ad9cbc538060155c5d72d3e2f0ab4f27653bf69a5af54faf99ac45b6740cc6c28ff2831f42a836bbdfb3d8013583de19

C:\Program Files\7-Zip\7zG.exe

MD5 6c7ebffd8774adbd36a06ff44784493a
SHA1 eb004749459d02d9fd771d20aed3bb2bb7bdfb4f
SHA256 08af6f75f2a994253b9e1ba486afc82d428af4e7569b800e41486920a93b3c5c
SHA512 712966e7abde777b6c0b2c90578b63e9230d4d5ee287608fe6b6d09026d0c18fdda410347741a9349b75dbd7cc713c7218072fdd8dee99e6d6a7f9c3521b5341

C:\Program Files\7-Zip\7zFM.exe

MD5 67e37deb8eb9bf683e6219ab597cd008
SHA1 74f8fa90b0f9831e5b4217b68620ab5f892cddad
SHA256 37fd83f48e104d2389bedcc20244efe0fea48800d63031b40837ad969ae7f541
SHA512 d92409993840efb261a3059576b0acade9b6960da3135caa27595512205962f6c5f39749ea4148c2cfb7f179236b40e2e5e8fba76b459c087951cedaf6a20328

C:\Program Files\7-Zip\7z.exe

MD5 91b08fec1c00a2ff93360348cf51ef19
SHA1 52a26d8accec1e0216b6e2231ba89b41c232007c
SHA256 d631658a566ea04f5f913a9f7f5ecb97a40124d1a3aa51a235d41a01f0bf8dba
SHA512 9b10787c91d75a48133ac0fbdb004e4adde7d0560a97f2b9dfdabbfa0247b480c8fe48d7400b95a05bf794bc1a1c9c61ae4d5656e04fcf54f0f6c42806d06d60

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 77653af4000132b7168b9030e5b6b8e7
SHA1 d2d3ad4b23dbecbf4e531fc1229ca4677a6e5b70
SHA256 04e6de2f6a3bc3d501dba4003147bbe2516cce949ee67a53af1109b2d1366c0b
SHA512 23967e0f0f32816a60707e912011de16c3dec6ebf767eed59baf73d37ec0a9bf282f659330b1ed781f3efb42b20c1ff0d53e7718def3f911fa2d60056e8dcac4

C:\Windows\system32\SgrmBroker.exe

MD5 980493870969fee8ec338b57c8c9bd7f
SHA1 79df7dbc6a541e33076a62cbea481dc05d3db930
SHA256 ce1deafed8b91ad2de148244cf564776033e48581697223c1cfe0f7586584f76
SHA512 767d591f37387b1dd4eebdd5e1b5cab0dcb7e7a91e5048e7ff5877a40899479a41a6d7c17aaa6e165ef1c26a9982a2ed035f125cdbc87f23de5624341e4a49db

C:\Program Files\7-Zip\Uninstall.exe

MD5 1a4da1288a7a73b15022637eb65fdfa3
SHA1 7e6512f95071fccdecba1207f500b94ab0d35074
SHA256 686eda082143ef4e078f38da771a7e5919ad8e81924ff347a6615b8c9e23b48a
SHA512 2822d43998fea4ba482f9f58c9517ed8a38aea7fa0e0bc3b149373fd7d10c0ad8ea0954dd7cca0ea54a0d1375856ba44e66ff14641007d7060a951e8986a8786

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 53746f85e9f929b58385c78557bc3513
SHA1 5a2c408d187159281e1a05c6804755d947973fce
SHA256 db29f9bfa68c59d0ef33454e9cf2e72913c3831c24cab367239c598d1d2132c9
SHA512 3780a0e51f90c4e11ef4f08705b12b5dd1b574958bed0b8baabfc057e918443aba233484aabd36a903bc63eda71fdb1e62975a8422d1fe6b79711b1d9a4f1f30

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 68c04eb86bc227adc6be96adc03790a1
SHA1 dac7d7a9dab554344ce0ceb3cabf2f9ec43740a8
SHA256 e58b55aa2cbac552decbfc97b758f380d844a9be92073649cfaac23e9ba52ff6
SHA512 d7afffc7e2503a5bbbbd71ac94e4bdda77beeb225580aea8368e47367dbcb00470732ef3800f2d1f6238f91bc7f0dca8310b153a6cf272991f5ae50b400e447b

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a3f9fd04c23c470c93d5fe25bad5f3e6
SHA1 eaf2456847e039a5a290d2dd96a388281cc07c5d
SHA256 4b2cb0f3a97bb3f0e50913e647216b3e8c62866ac95a830af27324eb7dda6429
SHA512 4ff9e970174c457aed034cd2ea6779965657c30e348458069d3a97cdf4ed87f8459590e5c420484347680757bd8abf57f35dc25c310a6f61f13ae5b695d65cf5

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 a0ff0f135fc6a1b831ecc8f762d031a3
SHA1 7f125f0b44de55611ca29b7c713c524769559933
SHA256 d129405556e1efad92ccf9b367eb3a7257cbfa1087c5a865663313129311062a
SHA512 518c58aac4c3a7960d0e883574e3290ed12fec2eab7f69be50fc8be22e3c4e6b6458fa544a4f315d6e373dd198184c0d6bc6ac6fd6c88d31a5fc025a6f6089ec

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 c2e42125039746ad1fa8c58a770a8ddf
SHA1 1c80bbad905d71e569c2f18301fe47a5d4a2d6eb
SHA256 8539a549caa3cb55f3752df0634b18cdbe50dc0e40baf41e7ddf762da5e27f4f
SHA512 a4488921463ff47521a6cc8ffda061b67d342bdaae4443dad240483e83024df5e9858911de3079dc94d61c064543662e13dca653bf7cce88e5e00f2dc415b1af

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 a507ee618b94b058c68aa7e39ac7cdc9
SHA1 e47355509b7ac09d282189c129eb66bc642f6ef2
SHA256 14d3b7e1f23e6fdc7523cbe8464a4bb7d0507318e5f209c032b34ea19a50923e
SHA512 fb0eea84ee27163d79649eae151b4c4a504196eed5c2119fa44d452f329f443d6c9777d12015c75c03fe3f32342f039693d8d1ddf2033cb6270adbbb3733d574

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 9a691b214ae622e5732748e18051e5ef
SHA1 f1f877dbbd181f1dbfe0b77b709b24131069c1d3
SHA256 0ca17f58e630e147981105ed88082cb5d3c5115bd2579f9e8fe6de1a0a77ae25
SHA512 bfcf9be8b9a9413f84ec8cffb48706af5032be0a80f2ea018def640795951ff409dc5ef07f5334380e55b30e410b0800497911cff969e966fc074363dd252b24

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 26e545246463687c0fbaff1badc17094
SHA1 6f08bd3cf6f7baf85c9e0cdf56a80c20ea5453a6
SHA256 ca31a8b4a9046db65ccaa73fdbd87420652e7c8c64185bf3b8d24861eeba9588
SHA512 50ae091a54af552077853ef4573b4a91a5033d49cc56d6883f7f09dcd9b71414f4793e21f2dd2258eaa02412b8a5988d56db4d084eace4f7f5999143ff9ae31c

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 2cd790bd4d0f27a8a2be50b8c062da6a
SHA1 eb5ba7676daf11f5777ccd25260f308e2ef82108
SHA256 bbde442a04d1fb09805534bc1019f6ff904dac369ad4cfa19bc603b3eb276abd
SHA512 6952c5514bdab168d5083a60b6609b819a205e86930a6fded681d5e0cbd795ff525a2c521e2d00fc771cd80a7e285590068a4644d9f6c5b5a27d4804defc6ad6

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 9c60b0107118ed136c08316c3427d552
SHA1 7a699604057609a6643ab5a31ac210e727ba1cc8
SHA256 168690ca6d85f5e361d8485a2bfa3c3c87d39ebfc299af8e10dc2001864b1174
SHA512 42c0b4a0aff6e3b78d49c2f9132ece5b08d7faf2f40fcf27c94c8c711976aa49bee7cd1bae394c03069e1bdb1ac1f39b2657e63f2aa57af6bf4ed2ba1181eccf

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 c64a9cdcad34855ea630daaeca04eaf4
SHA1 9c60060c659f25e6d90505caade1b1f18dc6801c
SHA256 974825925be0b7bc697b253079048f2ec8f722576d49df5bc81378027f8cc22a
SHA512 a99f8a36a092ef4bfa374654ebb153322e1b1cc679905f502d043c4e5a534efaade70105f7b15287fb798804e4d21c00fcfb239334d47cb3a9bac4c98e86e464

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 a451b03e00016049b07deb18704e2a9b
SHA1 cbaa4c069ecb91c87fc96fc74825491d481db691
SHA256 317c81bb48b9d8eea744845a0e8ed3c44fc5aa500c40adcccc853b23d0f0b1a1
SHA512 de30325e9a686cd0f2066ddb80a65e211a8905cfa15038c2d1d9677c9c8698a8e728ffccf32d0029ef711f3980ac8226565a8ad1ccd55e062a0fbbde153da27f

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 319faee8769fe1c5805aca6ab915faf1
SHA1 78cf93111fbf39fc4dbbddcef76d7188eaefb1b1
SHA256 b25add824691786bbd9dc2bd6cd9122b6b66c31388dd846e2c8d7fe292791559
SHA512 888231e738385a6d94ce7329cfacc3f62428cd94e3ebd9a2291ec3b13b7c62b4f38494ff47eff5606a7c87b38f959c94972fd8febeb6d3b411f5f01f49a8680a

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 7a76ea39208dfde3f45f1522bcb9b423
SHA1 bca858ee880d3595a139de467b4a67ee94a6e36e
SHA256 8b2e65c4c475e0275ea49559a0dd05cdcf895ea77eb3715d188f553caaf293d5
SHA512 b58a00af76367abb1ac290902d5a6528feaf754df8471149b8a90c297829f7ec57411f4f50f0212805168beb37925f9afc72f0c3fd286a2a04b8fca7fbb3015f

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 75e6948cd1b9aab2e1a93b16a5e56087
SHA1 8d042026d4a2eefa9747154571e3478fad5eca22
SHA256 dcf4265fbd6dc3f51ceb9521812c615f1933b1ad7a8101e1b8629dc88f8077fb
SHA512 c2767f0e9400f61df5ec9c99f11ea0c84c70b5f5f9fb684c5bca36777f4602838ee2c3efcc6267d12162bf42788c87dd081a5e970d70d646dc820dba467c4405

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 ede064be619fca4721c78f2b43535b57
SHA1 d67d6542bbb11feb9d3c322b9e9a1366fdd21aaa
SHA256 f2ca4697a11feb2e52da776fa72e44e63d07bb55f613a3eba33957ab0e109cdc
SHA512 27bd4c86a4b3e9430eaffa55608451c7132f49fd4186e9960ed44b297a3b0ae8544037072ea5ed9a1fedef092595e565569adc7f0be635398bb1af61096811a8

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 1253ffd9c99710b95791c3689a303245
SHA1 2352fe6efcace95f36829b1c1a11dfc73d5fcab9
SHA256 e7116b7a29859bfe6124a06b8681f8a957f1883a35a5b74954375e081055957f
SHA512 ff7e0a9ecc6da104d50a189d4f18dc8f0e189b20bdfa6326015df7f9a8fb105df2b0f722655cc766428070c92cdbeeb3df4fe3d807d8c9683015ca7cbc8a460f

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 28af085c2109c3e7bf3bf766692a0085
SHA1 29db13e966944fac736aec651345bf6fb92af300
SHA256 962920914632330279e4c1ea581c8665bea692437fa608f304e1f9514365729d
SHA512 5e06d5b0620c002ee2f94c84497d13b17cc9c2b6f06d3b597ca874848e5e639fe88bde6be8c91c04b02dd1a481fdee431894d0a2b6afa8b57eedcd12cba5d9c6

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 09666cfb6b23bc11cf45aadc2ed669cd
SHA1 b4766e0bc3859d4b523de40fbfff14a16d22150b
SHA256 ec6c4d12e6c4f06331616ef862cd9633180e280c5f771495aeb791fb220f90a9
SHA512 5e0df5778b8f8ad1bed9ba033a64ac8bd95d41229057bddab137b5c714085c17550d338d12281588abc76fac4060d6ae7ff09f084f936ad690646acbf6441372

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 13252f6b20fcc4d819ce94e2609f1209
SHA1 aa564ccaa17002c12fd095834556533eca649957
SHA256 0b2164f1f22eb9abaae640fbfe35f542e63706ad384ff3ce70ad03f0666a5d63
SHA512 7ec2173c4dd8d4f96b1f8c33d31fb3e54adcc5bd0636c87dba5ca0091cad5f3645f30f822c45511c67d1c292e3997b1b464081b3b7d3306ef5dbdec493956850

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 6c26cf4f257dd56ec2bcadc9d4b4cb2a
SHA1 dfb9c6daaed29d3f54c94e84376556cd44c3ad7d
SHA256 49470a912cfe00720ba2e1f382401d751d511614a0bec6ec85b93f44cd1467e4
SHA512 24c22a8a422061289bf9f7626380d507ca8c38ef1a4051f38b7482aad5822baac85ad4c63881cf6d25ea71e85c2b739b96796a324f221628a7f3f17d643bbccd

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 7ad5f7e7f71e1cb94a8095edf9c796b7
SHA1 8f5c7564b729f6be9b49ec586fd2d59006ad2b8f
SHA256 eb98800c1f4b2848bb4c10d313ec527ed293deb1d9a9f71ce002b3e52d4bdec6
SHA512 2c0c144ed009ab210fc0c450b2d225411fc30e1ae6a50b3bb07ddfa6431d218ceaa9c36ac1d2795810486be88c8a14f7ac8599cda10f2b32cc93eb20c716bd09

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 fff9c5463309105d2a8bcbaa82127057
SHA1 ffe6b940372e97689565413d46c0cbe88ebd1a8f
SHA256 49efc12623ab4ae46e2f36c3f20540daae86283ee2d89e5727500054ce655060
SHA512 737c0e9a55323ed16cce7af7d884d16f061443b98b575c9ed96a586a0b0889c1b40ea4e6ef1dc8eca928d64bfc5506b4dc9605963452f49010606b12032e29d8

C:\Program Files\dotnet\dotnet.exe

MD5 c7c4b5f2452a0573b328f560e95724ff
SHA1 20fc9a4aa41367798c19f96dbf4897011174dff2
SHA256 e4462e79a60f1de340144cb186bb3c4bf1b67a29e322e849cd37a8f1d6e97a16
SHA512 17ad40ab3dbd213ba870654f170eaee1d382438862c1eec940ad2087019971d91111f4a77a01e75ed67c3d2d8b986de34cc6521c3c13daec352652e0604a5cc8

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 abd5da8dc8cec508d54dd8eb7d844ac3
SHA1 b155707c5cef1cb8b4c40808dcf57b0f361d2df6
SHA256 2592826aa6a8614dad143db08823c08d7fdbaa3546827469b09f6775f92d2838
SHA512 7d16de673b5dc7a685e943e4a4640e18d5493d7e4c4e8d4aa639416d0c23a42f9b96aa286fbbd964c9ce17668ad7b95a13cfdb87152bb37ee8964f7f6b1f7518

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 9430d0510a4249d11bc3c127ab5d6fd9
SHA1 a710ed31a0a83a84f14a29688dfef311b4a538f7
SHA256 4ae8fbfec4874b505d70fff8ab4b16a3ea2262358de24e4f699cc11941449da6
SHA512 290022602281d8cc8fab3775c92ff26b8c696024bfbe0688d3f3fbf11dce3dbba2a1f9e03cf2b6137259a72f2cc2f16dbe2a6b77dc94f78f8a33c3e7750a19bb

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 2a5f06ed869b9128c8ccbaee86955ab3
SHA1 2a3aefced93162c91b19757c746bd5f5233250fa
SHA256 e4a61079be673c50f2cb72469dd4e3dc1556a5de150a40f60d16082d75325766
SHA512 c626101515bbd94039227a8940d85e5d895a3afd98d6077acdee0de7697297326407ec1d227723b3a42586b12eb1e7f385bfc2b482e3a8b7396e45a7197c37d9

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 758201256d4a43a1e8a051d1bdb96417
SHA1 2c2d29ba0ac2cf1f859271ddad557fc53ed1ab45
SHA256 e32acf2ab002775e17a209cd54673669e5fd4c18c8efe18384591ffddbd76c99
SHA512 4e8f029c34f580617320d97fc01180831952fe8dd70674da410e84194da2c4092030e2f498e1710b9ceaf6a9ee80661ecb2d3e6fa29e24292222ba3989f21e7e

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 c461ee5c6adc50df03befb066c92b7e2
SHA1 8d24dbcb9e06266186882382d19fd475ea907cf7
SHA256 3249e8711ba37455de713ed2d1a7141b5901f561990ce40563f0083e2a57f973
SHA512 76b44c8037f22033f2f00bff3ed8db7de2e34d71f3a3c7d2a385e5bedca04846042a289bc52cd581876122388e39e2ee04a8c35466d294c4a150fbce7bcd1540

C:\Windows\system32\msiexec.exe

MD5 756398d23b2f8843f22502a239f59905
SHA1 a00cb604c8fc5881193d8a4ab4061d6b5507548b
SHA256 e3ff461cfbce0d1391bb0d725ae2bfefbb849e0ccf3491fbf7ac1c1a08eb5f24
SHA512 625a73d3a4fde77845b9a0a10970289314dfaad418dd74554b15a2e241acae4b0f08208ff2677e660f97fdfaa5623cc434ccb26524dedd73aee73320d6aff568