Malware Analysis Report

2024-11-30 05:59

Sample ID 240614-fxcxkswemf
Target a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe
SHA256 bf2dbbb24f3983f3196457306827847baee9d5a577020808b0540cc0494384c6
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

bf2dbbb24f3983f3196457306827847baee9d5a577020808b0540cc0494384c6

Threat Level: Shows suspicious behavior

The file a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 05:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 05:14

Reported

2024-06-14 05:17

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3feb07aac3136770.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000131617cb19beda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b7819cb19beda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d8b2ccb19beda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ced2ecb19beda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0b4f5ca19beda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a5112cb19beda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a4e32b5c6ec714e8c9646c67e9bf0840_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/1108-0-0x0000000140000000-0x00000001400DD000-memory.dmp

memory/1108-1-0x0000000000800000-0x0000000000860000-memory.dmp

memory/1108-7-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\System32\alg.exe

MD5 07793f333f791bf966d66aba48fcc9e7
SHA1 75be0d90dfc0bff80691c4ef4423077dfb997f7a
SHA256 5ba0c8424413fe4f02d1c0229376d92bed689a633e53a62f033a73de432d2bc6
SHA512 cc1488caf589f23eea433d1b864c3e04ee130a5949975941a51542466897f792f56b05d7aff1d9ad2339a3c93c41861c9fceebe1be959ae6ed111cca1da993e4

memory/2720-21-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/2720-12-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/2720-20-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 e9f592c6a95f22b15b36e773f23b9374
SHA1 6beb9af67d19f694861b57021adcb76841a76760
SHA256 29796e7232147e306d081c6b35d98a4f69b2cba8a98046fe31048b509928b673
SHA512 21cd72ac49b57d499d96b538b5536eff21e0c934830706aae729c1ea52df51eedb4b06299df5152adb549bf76cc9b450f2e4dc714e4ba26df737be4553e164e6

memory/5084-32-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/5084-34-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/5084-26-0x0000000000580000-0x00000000005E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 ffb493f15391e5ae976bd1a0c04abbf6
SHA1 5842f306949694c57b482b0e49ec2438ababf653
SHA256 67ff018507db5c8d5fc0fa38d41c969b2fe14e23317b3448bf4ef2ccd3ac4f78
SHA512 5b5624b5c63261959535518687c1854b851315e661a0f117f1c65c7363b7fb9768e5c0ede0dd0e95a689d3051bbb6ff08a5806367016b2b252534f4126cb1734

memory/4772-37-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4772-38-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/4772-46-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/4772-44-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/4772-48-0x0000000000D90000-0x0000000000DF0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 937ccbfdcbacf000cdf10274479334e6
SHA1 bb39c6a0ed83f0540b8e3927bd348d9f0be1d0d3
SHA256 066cdb0f88b191aa312d1a451bd8267bc821230aa23663cef718dfbee416e49f
SHA512 fd2f72c2ab7afdda9d3e0a3b7ea083f985c79aad1b22c164626375c2436032b353d8f66e919707054eef63332b1e71021a517d2ba66912bed812887ebc41d452

memory/4984-58-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/4984-52-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/4984-60-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4772-51-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 697d800d8ecb512832e53527c4ed50a3
SHA1 15b10215c20b6f87112026c81c33e37e1446ec78
SHA256 e0b5d6fdf59bae9df443703a378b92d919dd9507d759bbcded86f1b6e4dfe74d
SHA512 bfdb6a97774ace30a873cb44830fab483f357b7284f7541dfcf406cd62a500d6c229d714955b6ea1a6401d8372298e004bbcb43e77aab60fe91af2d217c405bd

memory/2208-69-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2208-63-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2208-71-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 cbb53ca0cc876294babf6475448db624
SHA1 52f3062a30500ccbe76b654367e56cdc5d273019
SHA256 1792b8ddd4ed660b4c4a7a37e4eee634a1ac339208f9bd7dcd23bd90459142ba
SHA512 b42f44b1d5914365992b51db35052605b0b20bcfa09cdfe1ff76b65543c906b2467ff8710f0aac61bd455c3b50d43a5256ba1be3559e5c5dd65240b9676f6232

memory/1904-81-0x00000000015E0000-0x0000000001640000-memory.dmp

memory/1904-87-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 dab133c299df6cc423d780e6d3ca1fd1
SHA1 ea2d2f21b8163ca0bd79ce9fc3d029dbb6bc8225
SHA256 976a27de5873d102be82b8b4cd452a92d5bd8c1426718b36993d370d926073e4
SHA512 0ac6957a701de2385263e108a0dd0181ee2b3d8d4350d3cf4afb44968e29d55568dad40f1bfea0f8d1c40ec936f2735b1f02c160b15d400ea5f7b569ac877dd8

memory/1904-85-0x00000000015E0000-0x0000000001640000-memory.dmp

memory/2340-98-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 2db1ba2193c4af57baf6d5115b95d88d
SHA1 1c0b3c20d794bf51f0ba2b67850bd75762a4231a
SHA256 c5eb213b11413b41b83661e612cea114313b64aad27f653c3f93c5f7b7a97869
SHA512 8412efda4cc8948703c7069ecc3f7634221fa30875c80c87f589b9be63fd2fd4dd33510600b112c0039a318f925b272c8c854521e4227a6aeee855f88a302793

C:\Windows\SysWOW64\perfhost.exe

MD5 1c8920bbeaedf8ccb929d5806b24eb18
SHA1 653eb92e8c77852b228e8db43e7f1d1898d53c6d
SHA256 a28f9fa69174ea24ea00d53777482e511602decdc843e182cc7fceddc32f4d9a
SHA512 b5df426a5bdd64e3f7f80864caccd5f9709ca2505907293676a51710dba2b299f52f49f8bd48b42a00551156c39e8f48b026d93901e69340f2dcaa7b206d8dec

C:\Windows\System32\SensorDataService.exe

MD5 43776e49187b611cda74849e525b72ca
SHA1 a5a8a36c74a826ee2ae9881555f3f7fe22087c17
SHA256 718c6ecf5a28965ba0fcd8407a7f75a6863c4381ece175fffce223eb3da3eac4
SHA512 6fdae3a11728ed84ff0c1ed42850f5fd6a85d7ff2d3a8c5e0b738382ac56506e6438493c34f414e3c242bb455410f7429ad76727d4c45e77733efad6f33582e5

C:\Windows\System32\snmptrap.exe

MD5 c6131b0c1289561e55703f4616ed373d
SHA1 a238b4085d4b275ed0c51bf3dc5978329149322d
SHA256 ff72c1bc815f99689e6d96c703b3e8b1ccd41595d200a8a6a533fa5e12da3a52
SHA512 5fc24f6478d47169da199b1effb9eefe47977b17193fa3ecd6368f19900aeb3c6af6e0a74351aee0acc3dcc15a6fc868a86c07830e1ab6316a651902388bb893

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 7b4d7143739639637920a5023d1b4d6c
SHA1 1d6cac1b4dfb09eac5c57140301fc4a768197d6a
SHA256 17e43283bb86837226ca60d8181e03e4ac3f4768cafc737208e963cc8bcb29d4
SHA512 4f1031c5bb146c81cd7b119e11a280d681f9e8e6122559df31e3131563a22af1c71481722f8c26dd724548366a8bff72dbed276e98466292cc799224691719e6

C:\Windows\System32\AgentService.exe

MD5 e4a7f363c96d37f34290b16c77305019
SHA1 c6b457236ba0e71af21077aec8e4a461dc2b598b
SHA256 ea15b1e6121e0a4ed967e319af4e78b7205b37c313b2611349e671b3b75e1bf4
SHA512 f843624c27a76ce759c1052a0f01a3f1aa9820b4fe14161d83db6e7a8fd0b8adca9741f705d008c2737a6912657316e6815f67bca1504ffb6218b2a04e7dbcb4

C:\Windows\System32\TieringEngineService.exe

MD5 9631b341cf436edaefa5ab961a0153de
SHA1 d2f4f039ccd1b1150dadbd3d62ee654e93bb7d62
SHA256 2db77aba870bdee7132bc78437a40dff88a9d023074f907efc74ccbbeef6420a
SHA512 6b4d8e2382d0a2e358481944d2eb36998936c97eca81382137a1c7f814f99119bc38e0f063eb316152d4f440197ac0dad608b3d0727099f014c022c439e2fb90

memory/4380-202-0x0000000140000000-0x0000000140095000-memory.dmp

memory/1352-205-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\vds.exe

MD5 500207af84887ba88540210c52b59a77
SHA1 529a99dcc7597086ef4c5adbb77099103aa69f72
SHA256 152330c669f80303daf4ac444afd9c6d7f92dc41f0204d01bbc8c471fcecbe62
SHA512 9c7c0151d05efdfaa6d1d7dd8144163951b6ed020251b21643fdd9edb9833598d9212fdad2ff5ca15f14a88902a405725e15dfe6b61742bf12362770e1fdcf0b

C:\Windows\System32\VSSVC.exe

MD5 075ad345f73ee70b0664b0bb0670f68d
SHA1 5c75146ada7b109bab449ed45db0d6387c81cf52
SHA256 c6759e1bf35dff9e0bb1a534b3d6b65ec42db1a90348e5296a777b082f65e224
SHA512 507a66fbddc8115baff53f423730626bf29457f73c823146fd927ac9053627f3f8230c00337ce278afdaee8fd215e86379d3da601d79ae6a80293ddb7b79432e

C:\Windows\System32\SearchIndexer.exe

MD5 35db1688a2f36429401752e068abfe47
SHA1 86fa3eb31eccbd504dbaee5251ecf5dab827d2b5
SHA256 64dd4768dfeeddec63fdd8eaa8420819a57e003f646cacc884c29a527a490b6c
SHA512 41a3c07273f231cd69c41c63230a8a379f864b11cfdc996e18d2710ca32861bd354e2cdf66ea77d56073d2c94f6a0e8bd53db4f26f909fa1907d0a5ab3984dd0

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 178b44d32a39f912b5f2712750395fea
SHA1 512a124e24766f2abcf90774212e0492483503f8
SHA256 660d1cafc46291bed3925c723a37121b90aad3452a99c4fd83d5b8ae60243f59
SHA512 8dee65ade651ad413665df440d93192dea63f29ac96338fb32f460763fce899856e5e30c6a05152d78227dac63dccf103d83821fb6c46399673cd7edef37b85e

C:\Windows\System32\wbengine.exe

MD5 88a15b4637c5ffa6592bf268c59962c4
SHA1 29f00b6cc6d45b2ffa0700a2f9dce2406a4236d3
SHA256 f4dcf55d0f5bdffebff522d2e97886fda1d3ab19a1c8563441249bf12d265d25
SHA512 48c5d22f6ae55c975b92aa1c84d0fe73137122f22dc0a5213c8a2ffb25d60c9f895402eb3fa19baf1b609a5a90cf0c17307e6e3ce035fe1a5f93e824cdec674c

memory/624-209-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/2100-206-0x0000000140000000-0x0000000140102000-memory.dmp

memory/1760-204-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2296-203-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2552-201-0x0000000000400000-0x0000000000497000-memory.dmp

memory/4160-200-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3876-199-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2720-198-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 b1de3d314b792bb7034e0744c12c85fa
SHA1 49987a890a41579453b8173baa3a470c3abca2ef
SHA256 ef8b2f898027ec7574a40b6c09e884bebc54999426888bf12f82f5f6107c25e8
SHA512 e8021b64f6fd4830e8f80e6196a537f508ffad3b1609a06b0dffbbb11e647e7a27fa757e7c2fc6af8fe75c0f2177dad5696f98c59b70d59b51050612e9f883ce

C:\Windows\System32\Locator.exe

MD5 c14ce3fff9d39202fe29119821498f5b
SHA1 6856e6f1c1531925b2033b883e9407910d0ff0a9
SHA256 3ebac6af90643201b76caa2f3bf2020d97c87a367b4ac578ba84e8493c48160b
SHA512 89dfb27011208eebc1d49fd27491cec1b2c77bd0ae427200cf88f3ef0705e775a6c5d135e14589fb8fd118e9c9e726117e97d8d18f082a32d68ac4af59a6f87c

memory/4236-342-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4528-346-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2880-355-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3708-356-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1036-353-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/972-351-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 276feb062a087b54aec29e78b5a44c75
SHA1 29a861302dc730570d251bcbb80045def55b2dae
SHA256 329828fba7566d8a5d4979732edcd2fa5b2ad4e5a0592f2fe395b6bdcd7d1269
SHA512 6ea6547becc6649a07badbd7a3a468ed887b654c58aea1a677e0b1786ede338c7f38640bf77b33b6fa4abca40b302e5a46e7df6850eddd9a2ec83bd0ebd51af9

memory/1108-97-0x0000000140000000-0x00000001400DD000-memory.dmp

memory/2340-89-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/1904-75-0x00000000015E0000-0x0000000001640000-memory.dmp

memory/1904-74-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2296-526-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4984-529-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2208-530-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4236-533-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2880-534-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 f01ed4404a2fe039fade0f70388d5a2e
SHA1 ed1ff76fa347b1efbebda34cfcc4297d18bd439e
SHA256 18cd1b9e4d40f530f37116cac3c636c8be581071277f8269602f2d5b84588669
SHA512 4af18152c7976b6b31b74043584d9f27f581e334d30d8317ca6cfc7673116fa2285add3a9c878f0c30316e40f3ecf4fcc7c17da5661af3949ad62b9a442cb40f

C:\Program Files\7-Zip\7zFM.exe

MD5 db6508092acde74a7ec67c56775d8fb8
SHA1 f0256434edb9c793a82dff953146e41849b2785e
SHA256 69c5c20c256e5a6c9db56aa4bf5cd0b65b93ed104a9d1897ee61ebfbfa073519
SHA512 1c4524fd20fc67db926efe3b46967800f8c0788faa312d372f7effccbbe24d5fc0981fd85fab207a84fb62629cd7d6cb3c4d962fec8e073e9fd637b8a821a511

C:\Program Files\7-Zip\Uninstall.exe

MD5 8cc9568bfcc487a6f4799a9af589825e
SHA1 a9cb5190e2039e93c4abcdbe7e18abc2c033c304
SHA256 33fdac2a77be15e62fa8f5772d8f5fc36de8a58ac4fbcd71e17793f553f72dd3
SHA512 92d79d45369ce2921c7766f73e6a9816cc92aec1b2c90c39b9083433576f0b93806356cb142bd31a57c17b4800f38bfaf13777d7306a9a8b6cb4548772d99be3

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 5a7004be89a646049937b9598ec00741
SHA1 d70cfffab057665eecf33d3be8bf67a574d5b25c
SHA256 9018c2ae04f963eeed0865f493bbef589162bf67a9b74b6e1c5186a5bdc6f69d
SHA512 da21809d6919cfc76b6963de7f00067824fafab4838dcfc15c46158ae50b233253f54d5e64a291e9c538a56ab38a53eb1fbe9023c84d5ee9670de2c5e8bfc216

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 08108d91d9ee2d77bc9673f5bd9c56cd
SHA1 d1f124eec54d2cd029a561d47daef8e5a5376269
SHA256 7ea8f8872cce6c4a11b007abb8feb52072e689ad69b3f33a5bc45780ed4ada45
SHA512 8e1e0b86246362e65cf9427b7f6de82a285c82f1a55d479189c9307a1dc00341209be795da81d223eca52e586b653cf5f916f729d31de70e3c7cd30e23b0594e

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 3c71c28b17a104337c86e2ffddf04d28
SHA1 7c27dbe7e991e41bf2262c856572c34eaa32b227
SHA256 6f3cb9be1c3a994eeee60bfd2dc6c0eefb418264dbc6f14a5e1c6c6f61ce69af
SHA512 1703e5bffdd5b698f5372550c488dbb0653897157ac787234398fabf2c42ecdbdaa2cb0cebfe386d1b19bd149f8855ec982a84eebee389c4372ff434eddf3522

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 c18dcb4e19759f6db8cab8677d086b63
SHA1 a2a27461ed98161a59b25567704aa15a703c89d5
SHA256 dcd8d64b1180ba28a626b401ca300e940121b90617f3f0d1761b646eb615c054
SHA512 b967c88cb3da9e4cda566e33561dcba07b00d036ed8d66af621cad78a34a315f900967ac2e183329ae69341ec9e168254386e00ddcad874c9d8582d41952a9d0

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 9c4172bfb29ac5a25727d03828a13cf1
SHA1 18ee36efb60720cd96a808a992a3d8ba6d0901bb
SHA256 a3e6c15e9da0c9ee863e6839e5551cc66b39c1219528b716b71249961129c2f7
SHA512 94a379b7fb1b023745bc6eaee40355230f79bf2a6d7d64ff92c4698fbd143fd64a2cddee317f0bf7d30ff94f04c0dd9f1490038db18daff0d9fa9682d50e1adc

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 437ad6957355739bb27d8a2b28b39f23
SHA1 55fd5b46cfc2ea33041815b0f79142dc772966a5
SHA256 ea7f29fd7a0d5ddd2707f9c58bcb8bde9e27f7615239f8464bf1c8ad82c7eb2f
SHA512 a12ad96a849839e5831a19b3353b43941efc0947ee4e0031d226f15b2ae2747cad737e5ae2a490f126f5e5b52b900902c1b2490274bdfc4662b54d627534a89e

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 76111017112cc544a8c29b1d81474d86
SHA1 49889d9b874ba88d559585509cb57c9b1855daab
SHA256 03ca36e9e4ed4c99865961d57828a019736d9ee33e07a86e5286ae5620b9cee6
SHA512 6cff72c1957afcdae337f5b3ca0fb9741f81809a8ebde5bdfa885a5c074f5caeecc5872a1314ddb7ce4bc2ed919a345de8392639c2b46a48c5c2e90f9978acce

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 c72b656f7c786124a92b380de3ab5b7b
SHA1 f0d5cf83c6622b8cb7a74adc7c0fe81443f88662
SHA256 764d21f744a39d908ce91eb133b7b3aae440a36ee455a93ffcde8c60c58f2454
SHA512 2aca20e1a8bb05769e0e4558eba23f842966228fca2643b1babfed07a492209bae791ceeb5ea990c900c75e67222bb9e57f00dd6ea7269606ffd2d90fd41cb72

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 39180b1de4fae425446539c6ff043813
SHA1 179f8fca2a0e56aed88edb7535f6aef9485df7b0
SHA256 b017f72e83e56d8cdc03e05578a1d057e7333a0028f681999aa187bbb3cf9c76
SHA512 2a4466ecfaad72dc9c9230b95a9b0de69d8155054deacf3c3de89925747babbb159e0b7608e37ec4973e814805c98221af959ac87bbe27f366b972ef6b007e9b

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 b1a3c0c42b976552c70a39cf5e513637
SHA1 7f334c202f3f4066d58b43fb3777a0dfc358d027
SHA256 ddd60de693729da00999fd776981224a0a9a6dc3d8419d87affc0317f5e83312
SHA512 a42fa03f1802a72d5985e2528cc744c53db64d61fad8c3f329e46c0def7155ca76528c278751a0bb1f0ca9ee30977fafbf80e859d052f7963f5f7c5d5bcbb4be

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 2c2f2241ab322f977528f2779aa9fab2
SHA1 023081b18b94db4bae88bfb35209428a2301d5e3
SHA256 a1fee184bb34fa9f5c131676b8d4a27a3d9fabe1a2768bb4c59aff94c7c6d1c3
SHA512 093f4a260534ec490eae23833f160c8b2b08b38800d82855e9340a3338a5414d442a55407ea911baffe9e51448832328e1d631d2f1a09b9cef9ac2462e5471b4

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 5fdcd2951a5794d8b3668b17ad388881
SHA1 346d30237d8fd0ec2f0112cae4cb04bef9f7b307
SHA256 0f7e5e071af1fe85ce189992d2e72eb708b725d8337734d7c71c27642e0ccbf9
SHA512 3ff857db897627cadf3f55afd632d2c8572258e3563d895eb480c8da6c38a4ad919457a854d87a25aea2bbe73eaea8a24b3e36a04d3d517ec127e61ec0ee3e46

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 2c639bef2fcfb282d1a422e5b31ac263
SHA1 d7e73a9ae67527a934c8075d354e611957adc28f
SHA256 84a0440ae4872038efbafa5d84edd10f415f94dba4ef3ae23d642c70606ad2bf
SHA512 7188f770e7bee40de7ac51211b5baafb11af179559b4cd4f2043acb65c34f0d38bde71e6629989e7e76c764a4b6f821ffa4e0edde4d15f13471ec45d724ea48b

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 8080ecb0701cda27ccc64f9f191ba33c
SHA1 13b632e9f402f66bdf10c55f3da03c96735640d9
SHA256 0c44be9451b197553f4bfc5a98480a6317c60756f7cac5cedb16ad18eda472c5
SHA512 df53120ee191225276a44d10833e3033b48cad8abf9cb29d265369acddfe7bfd13d44882572b886f49dc885c480ab6b242d3437086775b51dedea1677189aeba

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 66952cb204c405d5d9ce19f61ff90ff4
SHA1 d93e24b0b46af07a92f326315f4c01153d76b778
SHA256 e3f5733a3fffa79e2b21cf6da7d5bc8d880c91611c3d4ee962415fb6cf696099
SHA512 196d074fbd0cef2790a69019ebc7988aa23c95a7bdd3efe00b5a5e9418983c19ea4549cc9b0b3ebd293c7a9e7f101840be3df947efaf9cacfddc956170de5368

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 357dbb5e6dcb9c40fe1c7a55fc98147a
SHA1 6b0759b81269bdda0f58442406e3c7cc6ded2ae5
SHA256 045e380268d8f854b1f2f37b9171557c716bf780d027d6d9dbfbf3a4ea3420f2
SHA512 a2792232993051c0d8071cd06ce48b02eb52bcbbbc36cc73789f6f6e2f8755b471516f2beef8e95027301ffc11615b074b9a5957563b1c5e0988aca4848c4c0a

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 481e149ba6af08e76e65c4c5c61ba1ed
SHA1 368403d110f472fcfe743ba07a8cb339376ea1f0
SHA256 31e3b6803749566fe37dfd121140f5a84f565b34e53c8ab5aa675bbf6f197fc8
SHA512 a5874f3ed87eaa9144b17975c0ae5ae36c39f8fac68981b975faf7ab514b1060f9e399a35723f120283fce3b64f1766506e0c37a92734e8173c97eb0e948a2ad

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 4585a1b62a1491a68e1886cecb0b6eaf
SHA1 ac6fa797a3fb478cd5273ba936f05fb9108a706c
SHA256 99070454a64be2fecfa7d5a21d4c9506af451bda57acea9bc9d6d2a645b16e23
SHA512 0db430acf88e7bfee55e9bff33462c0805466c4dc593f6ce5f85d86602d0edae490a6561aa63805241d4a97767913f96f4e9efdec1d94636349381ab44179002

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 786e3c316d035cdf552d300a875bdbd5
SHA1 efa28e6d3cec003bbdf0ac896b43359e2367c3f5
SHA256 636b5d5f83b4125c9d61e09c844d09c97b319298e1114bc33480e1e7c57a208b
SHA512 6be2c5b5d51b462165c9f2e1494e41abf6566a274e6829e0ff3cf01e4dae5b0150ced0cd4eddd3339926db55a60397759977128f07b5a8993d82a6b42bb2495f

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 c109f9468a3eb0bb8288f228f22dc038
SHA1 557187ceb0834208e9af89f63b31767f90401574
SHA256 a100fdb77c997c8b4de81cfe9438d4c1253c84c2fbd5b77a084c11a05d5fa84a
SHA512 942e3ce9b53b2d60649da8c42e19e38cb7e4d5a2e9efab283a1ce87bb2118f4486b445a6aa3e8066ce67af8aed6be5a2da593d0cec18dd5d1949606149d3e7df

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 67b2020a3ce56ed97f1ae72ce2671a24
SHA1 ac47493bc87ee9f55303f2f1e9919546ea728560
SHA256 3c9c24b2394ebcaac52506e5b72948ea10d8f6d0c59c34dc6e502d78680f0813
SHA512 5bd0e303e68e53fd0d92ac2dc4df4a87959e7a02e3df24ab3b0c005fef1923490348701314f22f8dff5dd7670f5d8b23373f3f52c62d6d87f0b4a54e1a805da4

C:\Program Files\dotnet\dotnet.exe

MD5 24896b3bc974604ff5526d44d1d57b50
SHA1 a84cac4705e7ffb29ff652a6b1fe8e13e324ec74
SHA256 e4b5d781de61ceede591791fde6491e0b094883eff226f474540f6c147a9e6e3
SHA512 edc502c24ff4cab9df46a65e709d4d2de2d65ee969bdb8452fb44ae78f39de81997d6bbeaef9f68f454ac9053b82a4268f60c027a3604b30cef66c65f3c1e58c

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 9361bdb43968739260c07acfb9ce2a5b
SHA1 5815ae534029d828f73e526a508549b67eddfb0e
SHA256 9e5f762cc17345244b4302fe762a3e327eb9885a781fe9494831de4d8363b137
SHA512 c2df87549130a8c61111c4e228488308c9aad4dd31201a4d98cf353d9cfaf6a2e17bc5fd3480e269b2c5aa6dedaa9f360f0038103f6579130c7513037f86ae63

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 eccef66bc04f70ec04863ce711230396
SHA1 ada328269e74076bcfed2d3f5533c062c2f149a5
SHA256 fc7dc8cb003c603b36c0ea2b6bd82ffee2eca824a0a93e3d5d86c4dd003ea92a
SHA512 682f87e373f46eba933e07bb4c239aa99f5b6359feadf0dd2e445b31ad05b97de441d61542698f0098ad7fd1c7760701517a149b1c14b5ecb98966868465012e

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 512f40051eb600edba107ee25e3624aa
SHA1 0c9cfc4535eb1d68b2339b22d7c6aae57a006b14
SHA256 4ca89e3c0a73a403c05eddf833d7941f21dc07ee2613abb9084785e24bfb53da
SHA512 8e07fdaee8835cef93565798906dec56062ad5df0ae7e103fa05991d9ba7e41b499c3cafc89b2075220fabc5f0204086d3ffbd5e7e903be8e9f71ef46420eb0b

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 859603d18fa7960391d35ed465b98ee6
SHA1 c2b54aa7a664789f4f4f2eaed80b27ec2aa2b221
SHA256 5fa096dc29a5069ae0e4bc4d69f9b3d1a8e17dba0304f5ac9085447e479ac218
SHA512 79d13342a6fb6630546e11e3906dfff51d14fa8a9c409619518d36954bf267ff47e5e3f51692cd5d730b9408e19babc13aa328b1013051cc21043c4a87d56be3

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 ccf98447ed63fd1252855e80499ee05a
SHA1 95c6ca882ef80163f54b472511292902aeb6f1f1
SHA256 db8f6460f420ced13b91117c4bb0aec09766b4239b8aaa434c5418fcdb725dda
SHA512 c1eaa183d00cccb710c73f9c4d390206cf3e38b9a702ce1288a58a3e2935b1b9704519581903b834bb13eef77fc157a3fbaedb700b2fc658a8b3b5edb96dfde8

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 8e8f507044d25692feb9dd7e75bf3d06
SHA1 942ba28dfe38f07755963ed2ae64c5af1fe27d6e
SHA256 c7e66576b6cac85475ec51536b0ed9a508f8357854659b849b85bde1a0e571fe
SHA512 b6c68693fbae781226e458d9b5d1981ea8518e37da0e99b9010ffe39f85c757ecca125f84f05763574b5957973f2adbd1cf26b166ff026f1a29f69baab1ee537

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 e0c875970be0097c1df648463e162800
SHA1 86e8f63d02a9e35612eae56f67a1285b13cd6419
SHA256 c123ca06d45dd2f95d32372cd4ac90e1b940115162d9730149981acd7797423e
SHA512 7abdda32f9394b50d03f510ca7144ec1a6308a94e1f5e026182adc5ff01da9002f07aca075f813c5268275078139af7dcc8cf5a9769eb68aae5ecebe1a35a778

C:\Program Files\7-Zip\7zG.exe

MD5 fb56b75843714fd674b1b0fe331dd4fd
SHA1 dc494a8916c1a601638c05c08289ad2d0c954bee
SHA256 06139bb253ddf02a8dc1d2a04821234c545f248b86b66b8d0a943c54774ceb93
SHA512 40d95778e1904e7edf295e0637dfa8757f4ac4356c9321e517adc0f2c93818f536ebd0d0daddeed67071c2079b3ed0ec2e3ac4fd7f0dac09d8746253618b5673

C:\Program Files\7-Zip\7z.exe

MD5 0b8966bcc46e9dcdf96af217d48ff468
SHA1 b134392c4d795f549580baaebb45f04ab1227d6a
SHA256 661789b37da8c48a8d01888339879332e9b031062e8e016cf96f2d983257ad5d
SHA512 85ebfe61ac0e67d9d2fb57b7ec999c1e2ce5cdc0266397250fa9ff7c865f35cc1de8e2761ab635b654f414cab7563c857e9098bea375019fba7828913ef481d2

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 e9b9caa07ea3c81d36a33195c1d20776
SHA1 2813e790a58e1f8d9844a16645c0b9d3756f9182
SHA256 bddfe7e62ed0ecec2fae22315c0f3f487193dc11e15c3db493a10cc1ef474183
SHA512 faa3b03401bbd5174afa246533318786adf80b58ac064e75e45ac67c539ba6039ff11719e8c53c8be8e1481f53bdba7cc0f44d8b6978627c7334dbcc825c3eb3

C:\Windows\system32\SgrmBroker.exe

MD5 d2964682916889bffeb5a99fee9cadaf
SHA1 154101bd8467bf7ef9a743fcd5a8b3cfef279fdd
SHA256 a06fda7893f041d7d4b33f5cb3af4fd66fd638e7b64d4ff4e6f2f4a16c556855
SHA512 426be73bf1e2b8b25eea6ac4554121702b02370058c18a4bb9c47cb37c7c61789975ad2556e44ffc3c11c2971ea39586f30ac87cadbca116eaef47ad3d648e86

C:\Windows\system32\msiexec.exe

MD5 7cdeeaff54421e03bdfdace59ae3a621
SHA1 b9c1ce9b72ab10640a4d36840d9b74aa1aba4843
SHA256 aee17abdb4f4906a0b2f8398db788aa05ea5b35ec71e2f18a3f245657dd96936
SHA512 bf0064aa12e03920f1666091bfdd9b817e5a12c551fa65556c7e9ae45864e26973737f723c70580571a7ac97b8e683a5940e96a6f224f68fb7accd4a9f6d8a7a