Malware Analysis Report

2024-11-30 05:55

Sample ID 240614-h51dystdmp
Target ac673af6762913befec52004baef67d0_NeikiAnalytics.exe
SHA256 a477a5c056456b681d01a89f6401d648a23ab0d161a284a3e6ddbf14d12c894d
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a477a5c056456b681d01a89f6401d648a23ab0d161a284a3e6ddbf14d12c894d

Threat Level: Shows suspicious behavior

The file ac673af6762913befec52004baef67d0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 07:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 07:19

Reported

2024-06-14 07:22

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe"

Network

N/A

Files

memory/2320-0-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2320-1-0x0000000000310000-0x0000000000377000-memory.dmp

memory/2320-8-0x0000000000310000-0x0000000000377000-memory.dmp

memory/2320-11-0x0000000000400000-0x00000000004AC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 07:19

Reported

2024-06-14 07:22

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8fd6aa08c3136770.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084e9d97b2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e72e37b2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008187d77b2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091cc9f7c2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2f7497c2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db4dbd7b2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002723f47b2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008133457c2bbeda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\ac673af6762913befec52004baef67d0_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/4940-0-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/4940-1-0x00000000005D0000-0x0000000000637000-memory.dmp

memory/4940-6-0x00000000005D0000-0x0000000000637000-memory.dmp

C:\Windows\System32\alg.exe

MD5 096ce7eb5c171d865c133f5182f06ab0
SHA1 0619a38fee864063d990d96bf8439e77bcb9345d
SHA256 8b70894f7c06ecb3751c777470a2435cc41f67768b667c078fb3646b14224475
SHA512 1ef38bc916677894640a80ab476e132b737543e946a3e06812134f0eaf6b45c815167820965d855ed0419259d83fede38ed0f09484e2a3e776321b698b7f5135

memory/4600-11-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/2292-15-0x00000000004C0000-0x0000000000520000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 7b320191a5fdccf8f760f20637198ae0
SHA1 db875d7730185b0274ed86bec00025a90a3217ce
SHA256 68ea89bf75e6e55a43fc6784803a557575d82e9038c1738d02e89400686677fb
SHA512 019da72d8294f139abbb023420b61e375db310edc8462ba649a57afe36b63fc5184fc99c79c37b5ac9328b861fbb94f528df45c9da0c46b190b6ed69c6bf6ef9

memory/2292-24-0x00000000004C0000-0x0000000000520000-memory.dmp

memory/2292-23-0x0000000140000000-0x00000001400A9000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 04a2cd90c7279292ad1da7eb312a933d
SHA1 5999e7b934f91c0ba61dd82bdfda9e43dbba78f7
SHA256 b387e87f38ebc95c1a71de0f80c8a373d9d05842cf6ccc28b276db6a11f4196d
SHA512 a20c2d6147b58366ccb241c42ee0f83ef89a5232527f2f27b090294d8e668f8235645325d51f3934e51af88f1f32200ecb060f3fce728fd927c2b9b954bcf807

memory/4016-28-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 20b720e7e2ac227def994e3b1be88213
SHA1 3ea19f5f5ed315db7c1b4a01928e5f37427bde92
SHA256 d30c80621194ebcec2ae76f733cdd16f5bf47c58cb75614dfd941ddc827775ef
SHA512 e9b129221949ab61a15aec00755fe58a8c6357398485693b954ccc06339d268f0d6feb6b2d2c849ffadef2cc06d5898f40d866174375cc77292d4d7233a3ff6a

memory/3400-39-0x0000000140000000-0x000000014024B000-memory.dmp

memory/3400-40-0x0000000000C40000-0x0000000000CA0000-memory.dmp

memory/3400-31-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 e4c33a8d335abe1fbe1016d2287e16ac
SHA1 c87f42db5a122fe8ef62cca08b8d9ed1cedc2ebe
SHA256 f59c642c2e7e98126428ba4a82b3ac704bd1af46fe882b146029437fd7e8dea3
SHA512 a32b8cbebeaa585fe9364487d0d7f45fc16c2d15199d22b5d5f0a4eead0e24e6cf3d46b0f1aaf164b6cefb693e770e9598e5abb15e52cc2dafdf387e1a77b045

memory/1464-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1464-71-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2540-81-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4016-82-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2540-79-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2540-73-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d7d33bf914d79232b75aa6b73e0e4630
SHA1 516d8c42ebd766f56faaaeb0e77b320ba3929fe9
SHA256 f26948ca9105976819a97bc94fd3982ce2cbea372d1e8294fd59cdf05a18ac16
SHA512 931db62e1ba0cc3efaa2afc3566e057a961482b5551fdf72cf6d8ec55d8e071d4239543d8531e2057264d7e3b5738a1c92249ef47704af573b1e991b606f4cdf

memory/1088-69-0x0000000000800000-0x0000000000860000-memory.dmp

memory/1088-65-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1464-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1088-60-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 67768fe102b0faf68b5f8c5e8e14f977
SHA1 9bb20ce7dad4145f3d27fe82c62c54822043b1bd
SHA256 0babe2df9b001b9dd5426e77bd5392fd29e2f3bf8f9b8fbfa13b19c1c89b8c1c
SHA512 8b13a94a86d7310e1527950a6095cdeb1e1bbbdc9bf06437a8d353eeaf6c357903f567237e117ef84ad7ea4d14c7033a78bfbe20acfcffabdb68aa8bbae063eb

memory/1464-58-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1464-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4940-46-0x0000000000400000-0x00000000004AC000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 a805b4fbb54158c36d2aa6662fda363c
SHA1 51a172bfd1f5869758f4dfbcea1ada20f8c48921
SHA256 72998c1f83cbe973cc0058b606d7abce93b4b48538987e86dd8396db154bc169
SHA512 bdb4d6c20a40deebac41d9f7d7be1edd2493e9ccd6bb5a4e470df68e30229085551b05df6105b290cdb43c5a3dbf89322953eff11661d97550353bb6288f5b00

memory/4600-241-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3400-242-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1088-245-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2540-246-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 0d9c47250beb8745b35e81f974d7905a
SHA1 18e69863f3f3df4e9f398d30f90ce051566bdea2
SHA256 3c913b063779f893ebba7354e6256431c2b22d2eedeb53afb9ecfd5a8868526d
SHA512 c229d3d589f3e017122e282ac8eebdd1fc8b29e4954df2c4c692ed0179cecabfb9bf788478cd8f2a07537a9068c440f8873d3033882ceb57e5e264fd290f9009

memory/3160-253-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 15e3b265d03a25fa0980c151d83a6bbd
SHA1 2c14e71012e79f401bab037d17c48e18125719b8
SHA256 991fa438c34c16edde3190112944cf6502c71b61d2635956f174c9be87a7ad65
SHA512 a781be0c94c514cca4fc8898f673dd4d4a30249710e85fca79bbd19334fd40d9a288b004c749b0e34b64a5983d26dc6617b9978890f26d5a63ac4fcc154ed921

memory/5008-264-0x0000000000820000-0x0000000000880000-memory.dmp

memory/5008-258-0x0000000000820000-0x0000000000880000-memory.dmp

memory/5008-257-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 4435e7eb47b08bcbc586d4a633670bdd
SHA1 a7f0d07d52d4fa97fbd462e701bb23dff76e267e
SHA256 44c57e156384dca19c4930b48f462725f36bd3055c2b38f25f3fc4517971b142
SHA512 a570eda7d8f34e75532b0eb9eed1fa45586e2a132ac8cd9e571270d4f0e2c308915387aad9b7369067bcab95930fa88f7c5a8c0d640e3438f65776e6de16ff85

memory/3644-275-0x0000000000400000-0x0000000000497000-memory.dmp

memory/3644-271-0x00000000007D0000-0x0000000000837000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 91139f3badb237b65ca43f8523285a9a
SHA1 7cab8656ed3d3f9646dd0c1b79e4df6ecdcb2506
SHA256 618d00fcfdf2224c1344485f702df82410b59b4f024b658688468ff756833016
SHA512 bf6b90ef8ce0b2fd1198700b60dcd03a4496fe2f20739d3be0eac876bdcb6bd4b65ebf30bcca561020aeb8b110a8fff8cdf2e961660434c41aab04ec820de767

memory/1484-281-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 011570acdc4e4ac2702343ebe2a480a4
SHA1 abbf728fdc5beb34f6dc97fa48e489a5dfc04d22
SHA256 27e4edbf08dcc4ecf7c0c618a54de73b24713c9ba31c3c7bac66aa2baa7433b2
SHA512 d564719229b557b01beae65b8430b2a5bd3ae31d7571cb49b6be67fa6771efae6870c1809e5fa6c708d170f2d18ed17883b3c8091365c933f40c1c6a7dd873c6

memory/4932-286-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 d1e6556990ef38df642f7611c44a2095
SHA1 efb02fc01fca39963adc200eeb46a176a4f674dc
SHA256 7e2ac379967b2ecd4bc3e33dd9ec7dfdf350c8892624b62b1e549d3b1a849032
SHA512 06a8182d32d165bffba9c3de78c867ace939c14257e657bb85768bca4a91ae7647662a373e9fe8f209383eafb3995998cec909e40747c302ac3137bbf65df45b

memory/2024-288-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 22744e2e933143f6b09a285ebc5cbdff
SHA1 e41037e5da386f4c143ad7652ef236a059f38001
SHA256 252bf21b8e76cd03a6b0cdc4122b9c35f5c55984c807d321b60d7ec516816001
SHA512 142fdd90a868aa61b740c6a05fcee0ee3da18f1bb8a64dca70f5969ff92fd92a3a77bbf9f93298b99c3eac7d628c6148566f8e880fbc1ac75c84e04089bff027

memory/1092-291-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 245a11f84262e017dffe5917350bd545
SHA1 27a20799a1356961054172e1722610401f4cb694
SHA256 42c1ab45c6cd6134ff731f3da6806a2446a9d1cc44b76ceb94b20b746c7319e2
SHA512 f74d529a664077dc53603edfc12e23636116384b1b7e06c0d1537a0bb1f30e222f810019dbc44a8ccf1797cea8fb28b8536e71cefb2edb6e735185ea18cd1b5e

memory/3084-303-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 6651a0cecacd021763c9d88436352acf
SHA1 43a6d29a0285ddc95638fdf3011f2da68da7446e
SHA256 a2770410edc2fdd2a35e50b47ea2931d233408b96b93f3590c1ed8d6e7de6289
SHA512 ca06d5a0c42b57078f46207e950dcbb1b2ffd1e6c7660e695c0b0767f3d22b780d22be51289ab09b4b5446f4f5c998f9b72f47a33691d88e925a722d3bb78e9b

memory/1652-314-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 f5902cb2689b8ac2498f096da4c97b48
SHA1 c6c9539159cb53de409202104cf654d83ef8fa06
SHA256 ee97d6caea44f8c1a2ba603cc661445edc89358fc161a421477d687406e8dc35
SHA512 effc20f29e61f8b5a677b4ff71a2ae472eefb93edecd221450934f83dd74edfbd2b068cdc9270442763f2427d73a3354f4ec3f0576cf637bc406a4e05e4b392a

memory/3656-317-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3656-319-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 cfe77ad30bb8f363996e8fb742d8aef9
SHA1 d6d3b9838eb576fad5475eb562a1a28a0fad1014
SHA256 3d0e4855cecf2d4767bf7a406f942988aba4912561fd2c353e2ec59c0a0d6f3e
SHA512 4c6204571dfea86fb6e8587a44ca663a679fb8f94f9fa2419fc815c8e667fca2d78d68b703d4001a662a9b9f074a24ef97ed7dab79307b9fd761853554d23d7f

memory/3160-321-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4476-322-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 d25a53719310dd6b440ca2630ea710e2
SHA1 12adb154f3bf8c4f055ae18099e7b7af4d39bc55
SHA256 4e35d5ba91439f17420b6dd6d29d896c897204e401bfd290b8346dbc1d584d80
SHA512 089bf6eb1092e9ba9f05b48365c0970d2723b3d0a4be5b9349a8bf557e815c190643c430f2e147a777628bec368965eeda6e78da60d500a814dc97770522bd00

memory/5008-325-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/1592-326-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 e6ab1203c8a16b9e766385cde54a63b8
SHA1 2f0ac09642adf619b425246abb96d53d8cf46e51
SHA256 1b0e5f0b994637eac41106bc1ef11a4732395f5274c9a92fc4e8581bce540c01
SHA512 4b5d09f16401c9e4b6bb3bcb0e7d54de8cabc87109e38374a64e5477ee222c6250ef09a32e8faa277e4d57371856095b45c404695ccbf1a24f8037c2e0407317

memory/3644-329-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1836-330-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 b55716395f3572c053e5a0e5f5fb18e9
SHA1 7e0debaf5d5ca444cbbef839f2bcb76e5dedc59b
SHA256 c47bba7b55137d94dbd1f3db689c499f9554285f75e3207c9089a11d1445db16
SHA512 5ea87c0280850046f6fe10fddc7dccedc28e5ec56c47e78bf59b32b44c7ce5d1f44151374210d13ab26c505e55ea8d4b7c9ad48cb32c4912a3206fff5a006809

memory/1484-333-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4328-334-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 afc2a92e9134cb92f9d79e580b9ffa9b
SHA1 4722241a35667f333d03b66a4c7828d6510f71a1
SHA256 fbc1947aa790202403e0ae496e60533d6ab8809b2df0ab8ddbb22c5a3aafac6b
SHA512 71f54002f8b4deba6cce57cc6337ea6ff79f3e335f7ec4ac02b67ade35f3b0df1a751042784e8e44dc32971cc164f468cf4ba6d815d1ecad20210b5e42b5f171

memory/3080-339-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4932-338-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 cc4db6e332adf3ce0ea9de5102226f27
SHA1 e007efb119c41f1e7e08972d62cc88e52b9fdba8
SHA256 018bf9a39c511947aa05b592dbf5637de161d4c88f6b17f933c9e4b9dca750b7
SHA512 1041d3b332f286ef010640264ce49ca876aaa78b7d4bd2615ce5ce1c6acbcf6f82f8d3ede5ed2dbe6974cb98b4aaa225cf42a1ab26a4f667b339042d4a6caeaf

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 29cf4a39ba55c7531a840e86b2ad28a4
SHA1 10e7eda34ed8c11fba1a11e55dd13a898d8353a2
SHA256 fb2e2b9b013d653fa98d425206045de31f083a3ed1b65790bad0acf2236d1ee2
SHA512 41fef050c7c6087f38b2df2823f2d3f801aae3a8ca4b5a2118d45dd402088122b3f05ddf2425d25ae8a09f176bf8416b2d778ffef8ccd06f55bd3178e4517dc1

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 29f44ae484ec31fe4716bcc1543b6c0b
SHA1 73da21d180b665e42a4052bccf4fed334f4b2988
SHA256 4b7a7a1f424baef8c2304f2dc3f061f945b0f0e4ec921df9549cd3c5d1eced0c
SHA512 b1e2b71c78f0aaf0df36e3225248af3742a954eec6cc6c9921da2109e02c015521e108c23b5697e6784400357add650e4ac961abe7033ae2c76f685d3af17e0d

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 a6eac1f02547756c699a464d81d60507
SHA1 663b6afa190c76876fb88f5a3c0f4c1fdf60905a
SHA256 fc7463e3b3574a1cde1f166503f74e354e7ae5e7a0c28cd9a210408db4858713
SHA512 f2e31445d25410e0d9686da2c618107b0149f2cec4f99c5f2ea5401aa759d5642671387491f3212bd68f8e953500fad4ffb5bcbbd4f919f5fd514ee1a58e7791

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 4c8d6401072702b5912b215fd0b5bb9c
SHA1 319248d7e585f6ec217409c047ec779cc842a0a6
SHA256 25ae09fd362c8c8e09c2809dba1eba10adeaa87134a8dfb6d39d5ecbca6b6918
SHA512 f85ea46571c7c30b960d88ae97048906b55bdd273c7a4d1439dce99ad6d5a83eb63bef57fafec88be7502df4e443645dbf9892f73d8fb42b98d3d2e316143b41

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 9e422baf11fd45e69ed503707051905d
SHA1 404b50530687ddab6dc61fa11f19a4454f45cf08
SHA256 736bca466b3e5ec6abb49cde155f220a59e0aeb9a7a2dfafbaaf57c7b3d83ad7
SHA512 a30ca3bf09239dfb24fdaa0a2f2a0eecd0e8a0c38600431961b43eab39c8a1678e37380b1ff802949b3d7689b28cd5ffb3fff4e6731159c0d8b9a944e127e824

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 c6ce52a56df5265647e5fefea04b4548
SHA1 d2fd033bf2943ae9bc3e9dbba90a6befe4726f3b
SHA256 9c16e4d1136a1526c60158fd49575042156eb7d04c9eac9ebf2f6e745e778d66
SHA512 181b7e6fa4e751f3f148df9d8ce6b268563526c538fcb430d591e703a2a55f5290a32bd4f34b2e893e862b07a5786556c6650404818c678775bb616e4581fd80

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 dad1a49dbd93a2f546306c8ea9b09e20
SHA1 36d11a5cfd0ea1dbce62677187b8b2cac8b095d6
SHA256 c0329316f6d0f0e255dfd88f7fb3b9e732ca69c27fb11046a630234001583557
SHA512 12b422c32a4ae1945dc2f80829980e9d4bc4b9349a0cc79df717cce79f30e79fc6d6b1650211ba90fd8011fcd00bab250c1787bbd7cbac2d1972425d7db72218

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 c347938fa5d4bbbc6830629e5e840f51
SHA1 62f5ddf71211aebc40ad68ad28cacb1580dd97c3
SHA256 49091c00e5f70c5f045fc794d16a3996d40085a45802d6b32ba4ef999f0ae701
SHA512 e924bb675f6440689447cca15c29653c29ba64b9d3b1b781f20a1cd7b11a07bb8ac088ae833e02fb05677feb38bf7968b794a1214fbdab1ef7131c052d274d19

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 262a888569a4f3863275dc80d37ad251
SHA1 227d8da038cd266826700ac8414a85be9e1d6c96
SHA256 d20a35eabecc6b7cb72f53133da0202cb35748b80e81b8bec169de19de2f489f
SHA512 b0948a30c608e14544bc70e170d09bf8d670a7e2fd239e3e2e698dbb5e6c5007a77805b1b23565333bbfdbae9019b1c3e49f38021dcc969cbb58308b07853ccd

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 7ed8379a665a8871222e977b8e274268
SHA1 51c82e33f66c55c0f0ca1ee31b932a74c3a7ca33
SHA256 68c6b8cff726206ee761b6d8d70a956f31eed001e44a424f0327352c99a6ba46
SHA512 11a52c57ab691956ceccbde49983835813918913f788addc8a71c31f729ac1d85912abfec60ecf64722e3cbefd14fba25266fdb4b5aabab3915c5e3a17bde45f

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 0bf442bc85edcfa25b2588b490b1e334
SHA1 561c01c3fbfd8773fe39d88e72399e06c5083044
SHA256 7b9062974d36ca8feba5584b2ac10d465002c597382aef20c06ded4290322445
SHA512 36211d521617c1281617b23c9d379f153851562e603d05a6b77e5dfe46c3db18e83ed5a92a140e711b591cf94fdf630a373de75202e0aa53c623dd77c03aabe5

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 32c1d4a6e99714395f8d105967dc226d
SHA1 3a82d053c543c5fed244c24c45e0fc22169db025
SHA256 9a19518fd7565e2164866323defeda7332a761624ca1900fdbbb7b733f5afa09
SHA512 2d93cb76057a88363ccc5e38b71112412ef3f21250f8d22d66e2bf00f3c143a09791c7880d02bbb29d7b170d0c5d8171bf885b2be9f62ecf1581d6198a347398

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 d85a6ba0ec7c888c05757d370233e4b7
SHA1 2cfe38e373a0af0f58aaded60b29e4e139e25b6d
SHA256 9711a1762a534ecb0986c075271270c8183184791f98a8f9c0f1e85762d550db
SHA512 81eadc608c0d25764bd7436b3aa604a23a5ec93c9c9bd3c12bd322603d93fb5602a73521cefb2008eca3949e8e25ecfa964b6af1cebc7c74e4709484ab061267

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 2a93d4f88fd263873a056d0110a2eb7e
SHA1 4d2a7acee4b56597083e4d6b389bd327fa362240
SHA256 39fd018734b6408d9c93d002517a53869d2b5f831af5397c652addd4df311d05
SHA512 589a9deab4f0b634168ffd9d1c5e475b0896973d24deb47a88013085676ffd5d70708c92e5c99b083842817196b5a4b56693e61792ec985943a63014b8703acd

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 62df621adc3b86b8ac5ec8c7cd082e31
SHA1 6d9abccc60dd264aa5864f6a30fd6a5b12a46aca
SHA256 84a1b5407a83f7eb5ed350f7f8ac6ff2b63c4af882efc1bd35932e2d2153ff07
SHA512 912de7d4288de39be9091a5dda4240c3f0459e8b3792213c02681199a8e2e7871ae011ebceec0e5308af38b2f1e105f91ba3da3d1f1c32a736f05d369781225a

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 a69b44671486af744fbf053fc0c901f8
SHA1 f7c793face9e883ddfec2c656a370c2c2ee38dec
SHA256 42c5351f6e9d964d62bb157e1e82224a701d3bba45c7ba2902ca1bae174fb9ee
SHA512 4ff465bed1c723e044efd7131831d5ff7956e5cf6b97c0f5885dc140de1b344188b110000450f2c40f649f876f83b29bac401ca6c6985c123e8cf81eaf42bcff

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 616d78f159d85bb5368d6c82fe212e94
SHA1 3f6d6233d87a116fd38a6526eaa0b17f7e424a76
SHA256 ad22d6f18979f1b0b8ccd912aad99e6b0cada65d346b1739f3284affcfe6ce7d
SHA512 8b848b0d805e6b7ce5fb5d5012b48c45ed37f34cc650519024d581d8db0b4f68671c3df1ac11c7cdc49626cea6e851490191524aa51455f72ce1f93570ea7f7c

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 bb7fab9770b1786f048ae2449a419895
SHA1 ad1ad88ddc05387f9ffcae190d0e572d080655b0
SHA256 2650a7d88bc422fb4908d145cea2b6a8be4a737ebc38cb27e3c78efcfbf8c110
SHA512 88cae452599e72816e5c119334d055d04d3ce08ea2820e3afc908351e21566e631966104d1209122020cdd0d3702bc4b4c2515b03c85b6f8ae7734a00b444eae

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 77999831a2618e44da2aee2c9ddc3970
SHA1 2c0c64ad8eca2e2d09f12feb4a9eea95b312f6b3
SHA256 c7554c45622554c363f5a733985ca8e789df989046153d4d4c9df9f0ab4d5dfb
SHA512 713c1243a25509a2b485e95481113b739391998417f966f0cbfd1bc0aabc3077bfa9a810d8710d9af3887b2e2fd40cfe27c2328a15e7ab8bfc51687745605f1d

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 ecc0594fdeaeb13506b06f9a895ff0c2
SHA1 de20eab1371ec8e37610aaa0b834a6e51cab1c03
SHA256 d569607291883f597c86baafc1f3a41e34a8bee7254251e0a0f2ee12883a0f66
SHA512 e0e56c8e6816c7199267e75fc46cff377d6f0138772ad61a81236147fe74d9f7a37636de77fedb68c1e5d017e4d67a3d8007a50bc81c8e7cef895390cbc2cb36

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 497e5cc29d71e5a9b578c71b1b865061
SHA1 1362c144793ea8c09f7ca12e89223b8df201f25f
SHA256 ff495f50a749f773e22ad3a7dd50f1e25b25216b7bdf8961e39d14b7ee6bab43
SHA512 25da5c4cba765866464fb216924581d400fe5a6dcd3c2b7075a4dd42529938a285dae972201d33062cb6c2c9dcf4ce3af31545f239b50fa896e85b338426b4fa

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 b5b78b0b6835a79c143040980e2a304d
SHA1 b39805eee458a1918aed0d6c12a7ea199e3b42ca
SHA256 a68178d81d6f2df5961d40a2f827b9c1394f7573666292c0305f0f04b8f23153
SHA512 3018d58c727d2a0908328fb53c15bcff1be8d08a5805f3d6889834a10d0d3d8e1c6c451705ecb3f27542360780f2ae81c9477f0e573204b9099b34ab810dd48c

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 085968bf7c27a25d09e6dfbb17a2ef0e
SHA1 a08d39d3e914bbbbc365d9ad0f482d88c41f1304
SHA256 9231011816235605c68e76fa2a7d499012faa72447daf82b7af3404dc1e8082f
SHA512 a0296b2d3e35ffbc6a6b6b4c14aea461507899d9253a9a777e7433316ad8f96322f24a1cb923526655ea6e169b8a5e442e978c20404522311d5008a1f15e361c

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 944a9faf5f50a37528c06b476e8e487f
SHA1 15aedccd077c51bbf46a176b7df13380a85bb178
SHA256 f73924c969e68df500b9f64236191b3c55bc5a7df99610f255ecb4a1e3a3ec4d
SHA512 cca614d85ff1cf4980c9fd0bac73b4cc78fc0c6d31fafb9dfe0bec2fb232b08c71bd516321d9970c9a9448e4a547c9c7a924bc2492d4fc4816b7ea2703d58884

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 283523445e3d9809c9764910267e9608
SHA1 5743b1d2a4a813199e122f61b09011696f3a1372
SHA256 691374786c82a3739750aaef40516cad8b6e931352a4e6c24aa2983b0cfbae93
SHA512 1b139c1b0a31f0cc3201166aa84652ba376e2c4a4eaa5f283e8f197924fe2debe358ebc3ebf95fac2c87a74b1354a7a55a3d805fd40628bc09185692d98ef3a1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 91c912a10fe74e2193bf4889d0322403
SHA1 0ed964dfec34302e8c28b3d719736fd5f2192e99
SHA256 c6c05a303ae21cd33663284090162a22d1ea6105115a761c7b3220a5b1e3c8e6
SHA512 7902c38507aeecf2984d97cff1d4d6d342572e589d44b08f3a8d542701b5433eb4b57ea3b3e088ddadbf727ca2cf59735d056e519d46e5f9cf3414353b0831c2

C:\Program Files\dotnet\dotnet.exe

MD5 49d2c64c795022fa0cde6450dbb62d16
SHA1 d79c07882314ab93172849959f5e10df7f73017a
SHA256 54700dc4873b986e8e589d6c2dbcb53b5b13e20f08d9348e23e7f542eeb73512
SHA512 a042d85b67da1934450c98f25470041fa023d37e5f76d93bd1afeb1fb0b403f80f903ac53384ed728c2e8ef07fe24a5d73365aa04fac4fd219d401cd693b3369

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 2fb491a57861b482b3072dccfd4f2cae
SHA1 eb77ef3aab476b7a4cae62a92b92d78242016c63
SHA256 5ca43dfb90e34ba9235befb79dc6d753323ea2bfd5a34e1748416490055ca27c
SHA512 b3054e96c9d299a74081ee041a3ebcac6c0d137be8a5db6c1736ea691834a7f892c9f40089c651cf56aad4a5979c107cee81b425cdc886ec1c1098ddeca5615f

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 e60661e61690caf28e7d66fae65733d6
SHA1 02518c03c8793570bcda638233f4723cd8527028
SHA256 bbaa77a129e9660da185e65ac70ddfbded61488774e4687f48a871842dc289f3
SHA512 cb6c21c47c8cd7261eddd59bb827b3081b9baa63ab3d71b07873b39afd57cf880a35c0e99d1ea2c05ea078d363df73cdb7e5a90fdd5bfe833f3935d467432524

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 ec94b43483902493f5e76a08ed0369be
SHA1 fcc5461c98be9eef548517e64d8b1285fae1b9d8
SHA256 16188b41424562f84f2c31fd73e2cd2b718e21cb86629ecbf4e67629d58ea247
SHA512 e36d1c5d5ff1b79e97f244b1940a19f776f62d936dad232da116dc4b5943a436cf97137d2f099dd669ba34b2dca6f2f94a7e5c07803647f2e62df238b80bb333

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 caf912e50b406f64ab33522de11be54b
SHA1 5b04e29c5339799872a40f61c83f08317bcf9f7b
SHA256 6ae2abbf3fcf33a4e38441cab9539a0ab8215485c854c352a9fa13ed423a7d40
SHA512 38a2b8c1c10a8dddc1c884dc77021a38b5f43ae11dd5e8f65d4ab418dbe86ded6082a67fe2384f54a4ad2f97f629bbb4cf33e562f62374e38a54d8de1a7647ad

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 a1a8632fcf67307f50f8ff86e1f96b49
SHA1 0742d3c95b2c0f28eb37ac3f14da2d8d515bce54
SHA256 3ca0b7608053b406b32401e774c1b5b3e7f668417900a1f5bca064721092bbce
SHA512 5ed7413e8ea68777757a14e7222bf555d9d9574a61cb70d250a2868113bb9eefb8dcafdd50e4eedb7ff73ee0dddbb26ebc9bc212a8883cae201e0a4d37cb0605

C:\Program Files\7-Zip\Uninstall.exe

MD5 364bac9a6a835614b52dfb3bf34b31ab
SHA1 40766cb9eca9471f0029751263d14ffb29086bd6
SHA256 d72e83d0eb071ce5cfe836e68e583440b9f446b23da2aa4d47d6d59878aa3d0a
SHA512 68d795c168bf445c6d85a12ee82e2a22c8b923fc4c7f73c69fc75be4e953ada8d88a6097171f81966feb01254f2ad3785bacfd306858fe994071f650fce40c4b

C:\Program Files\7-Zip\7zG.exe

MD5 f33888393be7fd3904694ff87636b507
SHA1 ea92c6ad9aa895997d15a2b376c63bad327dd6fc
SHA256 6098edf339d35257a2dbecb9b54447a7002e1031b7c97b83fc1288a5477e1cba
SHA512 9d603cb7b4db2e65ecd31abe16b5b38e56fa927dd7f49bff80b794d25d1133d4ddae68492ada2734e891efe34e604c27a055438638ef76ad9a4e1803c7fa49b0

C:\Program Files\7-Zip\7zFM.exe

MD5 7446eac8e10c7453a8725c8125aa5493
SHA1 4da419ed337f841a3e70a0ce919d33644c0ad13d
SHA256 0cb969e56fbe84cd3a6a70b87de8ea0691a52f30248c78d894f1bc2ecfa3fbb4
SHA512 e445a634c102e347fad286b6fe2f28361991d9825c96aa997b1c566574c16b5fdcc2b8cc2426221984018ebec2a2854df0b47b42554881607d362044ed988e2f

C:\Program Files\7-Zip\7z.exe

MD5 9543fa9b655b9273fea15f8930d0d8cb
SHA1 dd834e07facdf58a57022256611fd204325c4466
SHA256 8c4ab2d841637e18f492fcc1101a9860e4ca3b2677946ff27a0ba3e890674ada
SHA512 f6049cc37ba0e59c5d078853d5d8be0efc73b90afebc910601dbe925045b01ad5846b4bc128b530a705133ef8fce7ea4fc4e2e0c41d36233681719775bd85632

memory/2024-478-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1092-511-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4932-512-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3084-513-0x0000000140000000-0x0000000140102000-memory.dmp

memory/1652-516-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4476-519-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1592-520-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1836-521-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4328-522-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/3080-524-0x0000000140000000-0x0000000140179000-memory.dmp