Malware Analysis Report

2025-06-15 19:50

Sample ID 240406-fl79cabh59
Target 5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6
SHA256 5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6

Threat Level: Shows suspicious behavior

The file 5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 04:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 04:58

Reported

2024-04-06 05:01

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d5b706246f975ab.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM33F1.tmp\psuser.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM33F1.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM33F1.tmp\goopdateres_ms.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM33F1.tmp\goopdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ed5022df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dac38722df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047a7a54edf87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095ed0729df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b53f1f4fdf87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d80b6c21df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dcccd21df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f468621df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e765df28df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009447654edf87da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe

"C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
N/A 34.94.245.237:80 tcp

Files

memory/1872-0-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/1872-1-0x0000000000B40000-0x0000000000BA6000-memory.dmp

memory/1872-6-0x0000000000B40000-0x0000000000BA6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 675e7c242462330639574a195c59da60
SHA1 f446b628d5158780799bbda1efeccfdb72b56a34
SHA256 e81cd44fa9f9fd58836a30ddde0fda20daa8e42755613fcd6c112c56d7a1e70c
SHA512 d2fd891f3301613a3f3817796650a873207f2d93b18f43ab5b46bda007313e720e98111649856a53f6839c690e0a378b819e0053cab0921098117cd364faa13b

memory/4116-12-0x0000000140000000-0x0000000140156000-memory.dmp

memory/4116-11-0x0000000000720000-0x0000000000780000-memory.dmp

memory/4116-87-0x0000000000720000-0x0000000000780000-memory.dmp

memory/4716-93-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/4716-94-0x0000000140000000-0x0000000140155000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 a973b905d0ece406133b0d87ff8d2533
SHA1 a545c27e55a30a841ec4451ae2174a3771b24bab
SHA256 19d3c82d10b78acb9f483f3800ec8f506359e180625f45e772e1902c237af46d
SHA512 7b13af6661cb7b175d6323085c1e745ab303c24f69852b82360947a093e49945220d184909cc45a26265152b8e10e0e98ed367637a4cdbe5968db933a96f2f94

memory/4716-101-0x0000000000580000-0x00000000005E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 ceeff11718ac2f64349c2220100c3efe
SHA1 1f836e0030aa944e82fe7b7dea0cbbd457b5390c
SHA256 28852a8eab25a90cb9e931fc47af6155eebfa78347bdde3b00cdde74033cecd9
SHA512 62b0d4f91581740e48f07ad908a1c456e6738745f2413f0cc855a8e07e5cb682ba54871ae6435bdad6f0e4ab0b29d0890ef514b05cd27a410ac4d047c9a42fd3

memory/5184-106-0x0000000000E90000-0x0000000000EF0000-memory.dmp

memory/5184-105-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5184-113-0x0000000000E90000-0x0000000000EF0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 e316a8c8de6ac009d7f9b891b7962f54
SHA1 acb9b05b5a7acf1dd98fad65630b3fa6ed54fd6e
SHA256 32ecc88c26f3e1771a227d7bf9bd641ebce5803dea16ee088920bb1ae0339158
SHA512 da20dfe7005de9b1e0bb4264f4e3c3a29b59d6feec7c695be229afddcd66b521aa46c0a98540b8da24b385f207fe1f41af05e41e7a05809ef8b9f54afe1d7bf2

memory/5420-118-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5420-117-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/5420-124-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/5184-126-0x0000000000E90000-0x0000000000EF0000-memory.dmp

memory/5184-128-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 a699dc139ed1a2c3d9b3ad42a8bf9802
SHA1 29098015798b58e4ca1f91196f648e58825f0366
SHA256 93b74209dc099184790fb58141f3224ee74dce50f8dce99faae6c73bceac6d01
SHA512 32582aeed7c6752778770ed297f96d84400c3ebecf62d759a2acc55ce81dd71d5c9e16b84dedad9031f21b58af9df565f4d35206985393669aa0569f3b84e304

memory/1468-131-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1872-132-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/1468-134-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1468-140-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 401b00382d4707c7c3d566d5c0b2d6da
SHA1 4bef52569c69a3dec9dd30295b1ab5949d747df4
SHA256 1c5c0e59d6e37e91c4a4ac21a642bb3bcbb185502f66f0dbb32a72affddcf913
SHA512 c3066d45adf2f6670ff70e5735e4aacbb8a487492022af328bdf92c12a451b43fb312ac8023f2b85da1ddf92742c2df56575c0d1eae494aee01d2686435c2ad5

memory/2116-144-0x0000000002A60000-0x0000000002AC0000-memory.dmp

memory/2116-148-0x0000000140000000-0x0000000140176000-memory.dmp

memory/4116-146-0x0000000140000000-0x0000000140156000-memory.dmp

memory/2116-152-0x0000000002A60000-0x0000000002AC0000-memory.dmp

memory/2116-153-0x0000000002A60000-0x0000000002AC0000-memory.dmp

memory/2116-156-0x0000000002A60000-0x0000000002AC0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 09fc874b9a4c4f9d2c07c6a8ef6e8b82
SHA1 14a4ed1b4e715b56af35d8339a2ead5400334881
SHA256 7eae3d6af3362ab41a83526323361101082f5d4f4bf7f0587502aac4188ec94f
SHA512 83386e2fac0a4c1ad36096fe37fe9e2396f4369abdffba1daeaa78456c5e85dff2bf8964947d6d0d3573f3e917c57d99ed38a4564550032eb4aa141f3bbcdd44

memory/2116-159-0x0000000140000000-0x0000000140176000-memory.dmp

memory/4716-162-0x0000000140000000-0x0000000140155000-memory.dmp

memory/5692-161-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/5692-164-0x0000000140000000-0x0000000140165000-memory.dmp

memory/5692-169-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 db10820952853a0ada47eccf2e0963d2
SHA1 fb0f6efe8b6c0b421022d086ecf52a6c06591808
SHA256 8e88a37960561efe8c83c50ab3c317f3385ca7b9b6770fd2032d85cf5c345f81
SHA512 32ed2c7f54cc9df48af3b36d2eb1141b41534707e90ac21220d44a3002414fb9196fc4c7590d5427a587f188148d13f32b7b1f786bf895f7cad78bc4030bd9c3

memory/6056-178-0x0000000140000000-0x000000014017B000-memory.dmp

memory/6056-187-0x00000000008D0000-0x0000000000930000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 8d63c1a741f02d01b16823c4a5a6741d
SHA1 81a8c84a77d0dc0ee146c053001c32b425aeb03f
SHA256 c551c275e5fe2ed096553ec114013c47daa699832434c3791893c80ba1dd7487
SHA512 cb04eb62e29df73cb9c73d1f0ce983e9ff6a327c3e515dfce23637eb69bb0b3c210482a17eb600853cf73432194c94a12bcfd7d74906b83a48baf774657b0ddf

memory/5420-191-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3124-193-0x0000000140000000-0x0000000140157000-memory.dmp

memory/3124-200-0x0000000000BA0000-0x0000000000C00000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 c7b35eb1ecf97fa70dbe78e9c595265a
SHA1 d3d88a84195502343208640dc3ee49b4512b585b
SHA256 15ec488adbb3256768b74ebce4b9918fe8589cde6a8ccf443570a3a7827f1ca6
SHA512 273ad8a6c343758faa4042e4e88ecfe7d38e912ced0b2efd36be9e03aa546be7b6460e609e510299ebd7429bf44e87627cc515447289a2410ebd2b788168a6e4

memory/1468-204-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 5140667c7d098964cf0f83168d5744d8
SHA1 af8cfda2f340a8e18e3ff999f28692252a9d3114
SHA256 e7d813197229e121c2cb145a1ef4fea7ed57015175cf84f1c254dc6f7eb2eef0
SHA512 2a1f9738c65d88f2d184b926d86caa5abbb63603d4a8eb4adba215bef18e3f485dacd557a60aa844705c5615ffe0ecf07d5c7dbc4b4398f9c33c83ee92fb3efc

memory/3240-205-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2660-208-0x0000000140000000-0x0000000140141000-memory.dmp

memory/2660-215-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 9adf729b7312e74897d30dbd2b58d11c
SHA1 19da50ce988a0fd7d7b95d6d8b5101f356750931
SHA256 43a65355a223d24e12cc2accf8b5d1c82ac12806e0c16077f1bc39ee19422c05
SHA512 d7d1e2c9d4b5153a8cf4e9b96de7d48be8dbd48578ae185f184adc1ffd9f38db6905e4acbfad4cd43da59497955caeee2e00075ba4a52247ec99fe4adf7a94a7

memory/4788-220-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5692-227-0x0000000140000000-0x0000000140165000-memory.dmp

memory/4788-229-0x0000000000790000-0x00000000007F0000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 7305c38ec04a5c2b905e786faacadb9d
SHA1 8a1a0685c180f3f6a87b2a0610ca9ef525d7f4f8
SHA256 a0bdbfb9cb853b8a7b3f7a769b8283ed02df30dd3857e8c1c6ec4b0aa333b632
SHA512 ffa23aef84c75c5ade09f95a4bf37b2e028c5183ab2350a4916dd3f9acfaabffa6a1322c4a883e9fbf54129a305e2be782cdbfd72eca4280f6d34a3eb8c6238c

memory/5692-233-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/4640-236-0x0000000140000000-0x0000000140142000-memory.dmp

memory/6056-243-0x0000000140000000-0x000000014017B000-memory.dmp

memory/4640-245-0x0000000000710000-0x0000000000770000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 2c2a9e2627d834e47d150fbc4c5ba621
SHA1 2d05e60d9c326f57f9a813f4108a6beb6224adc5
SHA256 d3c62f861d54aefdcead5ba298a4acfda35c1954763f2981e8019c80025acf73
SHA512 e7800d66854c89ca79acbe1885fdc85b852876c667d99a849b0f4691aaa05d882cc92d43957e58af4e11d8d3926e3ddef8d8b755080dd8ed09baaeda0d752944

memory/5712-248-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3124-255-0x0000000140000000-0x0000000140157000-memory.dmp

memory/5712-257-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 8dd69a1b30f84824daebc5958d534395
SHA1 312b1a5f9603662c374104a7e86ccae5198d580b
SHA256 d370da7a3483545770a3db31d76935b0146d510100df2c602b940e6364b2e645
SHA512 a56348a18fe7cfc341a353f157f37f37b3f48d48cd7e74313938c9ee88382f5de2eaab939ace9c30596dbba2ce8af405339427878d9f69f4a541582095885919

memory/1228-261-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/1228-270-0x0000000000D60000-0x0000000000DC0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 6d93fc897b84c1e605db6693104d7dc9
SHA1 5c29e7ca46686d600be0c0745fb7e7e8d427aec8
SHA256 eee3e3f3a77937c88b8abb3a2cc8819c4209bde40e086d891ee0f307debb511b
SHA512 87e8418064c1ba9b51cc1dac12250e5fbda93856db1bb76e5288d8963d0caf90783aa401a5602e98c6e44b57831fe3e32be71a52bba98b6e7d535b3e5feec0fc

memory/2660-273-0x0000000140000000-0x0000000140141000-memory.dmp

memory/1092-275-0x0000000140000000-0x000000014018E000-memory.dmp

memory/1092-282-0x00000000007A0000-0x0000000000800000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 fb84524b14ae29466c565215b279ec12
SHA1 20dec186155785718bd57f8edb8179f6cc578ff5
SHA256 ee1613184cf5e1f5e1f250f6b188fad573d7238c9b0ddd54d0af2b91a69bc880
SHA512 f3146cda1418663d6f5137adbc49b4f8324958e92fb3e94f25453304b511ce4ab62de61f49a483c68c0015a1e3d3f0c43e5f02a14905245ec731ff43b1fe05e9

memory/4788-286-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2720-289-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2720-295-0x0000000000B60000-0x0000000000BC0000-memory.dmp

memory/2720-300-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2720-301-0x0000000000B60000-0x0000000000BC0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 ab45b1fea59dee69b9baecbc2af8964a
SHA1 204031911eb00ad5c60b2fc69e9afdff00d3fb51
SHA256 49d0acf64214ba572e2d297c6430cae7280e887bab9604339b33e001935ae0ac
SHA512 b4ae1b5a7d66d71e798d93c60ec4385a96058fc12f1f956700ae45bcc46b693da27480776c27ac32a4c56899641b5ca25a08995cdcf1e21286e7245ed669d35b

memory/4640-303-0x0000000140000000-0x0000000140142000-memory.dmp

memory/5496-306-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5496-312-0x0000000000B30000-0x0000000000B90000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 5734ce59dbea96139a94da77a241187f
SHA1 8d78fe597d55b6b2f48033b60f50ac97b5f36f67
SHA256 08700138006109ecd267cb36ec0bf01f5def78e1db8d9a33782a6619e21b2311
SHA512 186e36a8dee61829f2b8323bcb2581d1dcfbb900290da01837981d243ba2a355841d0960f2675e90292ccaeb8fe9f9a493f48c15c402c8b86718c0cf340b8540

memory/5712-316-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5856-318-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5856-325-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 5ad5de3e651c7ad9ff1601ee4bd6bafd
SHA1 b5e1f4090aa589b0c42568f31b95efed11ace97f
SHA256 8833cce38bfffe57020f06579e58db1d0d319369df132c988315ceb91a3cabae
SHA512 22c0a7eac25e275e8ab814d894293871ebbdaa11dc8e10ba7083b90a0c436d72d5824d083dad8cd0828d296009f69836d7500984d697dfc809f5810d48f3634f

memory/1712-332-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1228-330-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/1712-338-0x0000000000BF0000-0x0000000000C50000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 ff97ed944f62f41f1c0935725d78990b
SHA1 65df63740e165e10c9df18980196cfe36b5aa90b
SHA256 7666ba697b2bf60b1196616639ca9be1724d86bdd01c62a77157242d4bdb83cd
SHA512 14b26560c99d472a428207584f4b5b020fc4cfcf7b041a02b487a477477717a3e0cb4e47d3375c058036fb46b13552fa4b9e8952d927c3676c52e6a100cb17e8

memory/1092-342-0x0000000140000000-0x000000014018E000-memory.dmp

memory/1184-344-0x0000000140000000-0x0000000140172000-memory.dmp

memory/1184-352-0x00000000005F0000-0x0000000000650000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 b224489dd4204640d023ddc9776183cc
SHA1 9221119b35831f35445b963a0f418d3b5d106ca7
SHA256 76d980a47236feaf0f0e680cdf157b6b1340336871b662336398e670ec4642ef
SHA512 463ec5caa13a160a1457f2c15d56e5663fd4ced7a1c5775b8d6f1545355470d49df61fd6945097a0f44e5abdd9687e25ea0c01b6452ff1121a295ca535fa6697

memory/1604-356-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1604-364-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 836893b7c14d355910b11c8b611dea69
SHA1 f858297112bce46ece520dd23470333c4e19acc4
SHA256 8818aa7c5b18ae48101a627c67273562993d5c20e28d9ad79a0a700b520d4e7c
SHA512 5fe44b0b567786037eee827de1d417056637d39a8e3f220e6c7edfff3c50b64c89300cdd3b1bf41b8e9e0ee27fb82b2cab6d6aa5e79986937f5be985a21450ea

C:\odt\office2016setup.exe

MD5 582e6d994e3402b0fe9995169546414d
SHA1 257a0967a58198e73b4724cdd00ecd1df6f317bf
SHA256 60bed27f156715ac4eb696452fb1c3a27ecb36575967e7d6f1380a73ec16d48f
SHA512 9cd5ce1d0d4af3897f4732ca78d70232745b2dd8cc37b7df2772603a6965774b243fa6f5f8045e185343736b3a9e38399c597bff11ca30780594bf0ac040746b

C:\Program Files\7-Zip\7zG.exe

MD5 2a367ac85a130cc80f1b13b809d0efef
SHA1 0b9d5d6981dc8e28f06bb270e00a0018fea9f5bb
SHA256 4e9e93762b8823fa8c3e240631a2441b9a6b94d4e3d10ae3a4815cefcdc58d92
SHA512 6cb66a509aaa7e035e30d2b9f55053aca2ac46cf07a18e92084e611cf6c5e52c4de7baf1bf84e055035d928e3bfc642e9dd00c62b7790e0a773d41a2f226bf40

C:\Program Files\7-Zip\7zFM.exe

MD5 432485c27f80432452cd578ec0664b4f
SHA1 1d7c0bda451987da7968859c811150840caaad92
SHA256 5540400ad514a152e9688f0a8c27b488b51d8a26c5add3242a1ef01237e9df2e
SHA512 13a927c1897b3b837437d82c42433022dfa89da6d45c5ce0986b408b8e97a0661ad36f5976af47df90497c67a2aae67822d034de69b39b01bde9f6cb18477d31

C:\Program Files\7-Zip\7z.exe

MD5 6d282fe128f700a8bdfc4c7558362ec8
SHA1 a51ce94e00bc0b260c5bfbd586fcf90a88dd58cf
SHA256 62e5eb7a50eee037e1a7abc45b015650a9c0a45f1e48eeca880b7b5108ae02a9
SHA512 c2e885c9ae46b3e7d79f95d60a3ab2768a9998b217b60e8916eaaa687b0b261bd5aaa18a7e0fa0f02c36bd8631e23829366cc36a7795109a237a265fe8756eeb

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 221c5921631de2dd3e1117bd7d9b3545
SHA1 93dc127d2b913f157e4e026a315bc173907f2686
SHA256 034093c2976b0d122b3cbf6a44e2b600598e275b4669bde069b9be211b2df9a1
SHA512 2d28efc9de0048bc0e80d9f722c1c029ed2d57789dfb60e929cc1bc1d81a41c7e84070595a8949bcc82c7cf71940f32c7129df34444b9f444a1c7309e12529eb

memory/1872-540-0x0000000000400000-0x00000000005D4000-memory.dmp

C:\Windows\system32\SgrmBroker.exe

MD5 0bcd5513e1bf728caae9b4ca74cec372
SHA1 65199d63c5ab44d7f41b37f7be08d73b051b0acd
SHA256 8162cf98cb80bcb06f02415edb17ef4bbd51d5e55cc3ac8342f7d9fc7d5e51e3
SHA512 ef8605a9c3917b48024f9ac6f13937b217e02644e530a24bf7b04c5e18ca33cee011c3741466c8b1eb09fb2fde71c4751ea31c8636d759907e64116997989711

C:\Windows\system32\msiexec.exe

MD5 93851404361de2c773cc085803fa1e43
SHA1 ae29b781c97bb40bcd617b7a8545fb701987d1c9
SHA256 b895703d307abd49b780b455e2a53fda5813c9e88a6ea06cd988bf49170709bd
SHA512 b48bbafecf99588483a1d8f278d51ba8a6f56d497e0fdf071e75d77178068ba8a6a8e9ada52cc0eb594397e4ca025877ffcbcad635c107db10cdb5b63a0efebb

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 cfa02d00a9d4568448178d111c8d7443
SHA1 9c34736f23f5bea30df0ed5a285f3e2c5803b45a
SHA256 0211d918cecd1f49fd6bd941b41b7f2555efd383eca23262215c409b12ce2e74
SHA512 1f14b6d53cf31e16c7781d4be1dc10b79d2cc8ab6c27ec6f43eca0cf9331c4a58a871bff54dfeaee9ae91b62e8624b6dc9da8b5ce2dd9b0e2c94abf73d265efc

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 b433cf25f3f4136d7d3a699bd5fdf4da
SHA1 8e355aa08b5db2b330321d388edc61f80dc9965b
SHA256 c9fc5a4bc47ea96b1d26d62d4479c27ab295f4931d142c0e9b1f346c8485d687
SHA512 034eddb6c386d82d32346a7d20279e95803954d226e2c1fb2830f02820afd00de5896d08ff25d2b0afd090c54c7dd470d65cd09180229c7d500405ccdd942ab7

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 3b4b445a2a19451ef01d66fe8c3c1480
SHA1 525ba50cef0637d0481b291bea50f5680af8b0b3
SHA256 3fef3a6c87f4f3512793a3727ece919789972bd725bbfa6a296c0d5cad26f207
SHA512 fa54b3d59267b6543e7c1e6d8a30dabe32cbab9e873d814dca8f81d439f0d1cf1b4105628d1303601495a5ec9dfd03995dae3283a5ca70ab4e99709f1b8256ea

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 ba6300d86445254cf34f266ef5688229
SHA1 ebdbe0767c378b7d5208934e24a22e2d488ef072
SHA256 8a7d1469e5cb2e897362b439990e1a3768a9e5401886a58166d8e181f0868425
SHA512 b748444a2821699b7401abced6cb41ca2df747ec1d943e17d4cb0b3155593239035d8a182bc01971e1c22ca0ba653fc524651e07872b9acc5c95e3324118b2b5

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ea4f596be3dd5a39339bce3a8ec85612
SHA1 e3e63bce51a7d2222bb8db62a23dc92fd646843d
SHA256 a8d63d7fe052392495f2ee08494938b9125258de1f80167e6feb65d6503f061a
SHA512 0792a64f048078ff06f35ff7fd2e4613ed8517a760272a4adc78a73623922a2e8acc29c6eed3212c7ab5743dd429170ba1df3a23e83e0d8cb9e493d1f73783c0

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 d158c9d105b63ba43b86c52a4daa4b9c
SHA1 aaf210a6ae3e5c4e99d4bbd4da1e91068f73cef2
SHA256 7c08b8cbe5f598d8b818f3b216fdd8b35e6a93f24ad580bd6b734b57bf45eebc
SHA512 1cd067638a71a31ce815c1130f375206c509d5a5cc03fc2ba162951d96613eaec473fc16d48d4652628b86c1f7f6e64c78919f1ea78a78c5650ed92b1341b2a7

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 bf057c04fa929ca331c67844e3ccea2f
SHA1 e2fe27be66c2cdd87e191a1303f98624543732e5
SHA256 517012cf08d5a15d04bbe233d78439a00e60169e54ac32df453a2657d7715ffc
SHA512 07bd48ae6e3632d15489e09a963b6696c7fe60b0ddef2ebfb4f54b35d1cacfe5a707185881cd4b71456a638f624170a028115ddd20b1b86266458aefdcd33d94

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 2a542c753cdcb47331df92cb21343ebf
SHA1 b819be6be77d3a396dea6828672c4ee42bf4cd1e
SHA256 1d1d6a318f73a868ebc46d8d49897b8e6b3234640a2161bbe8364dbb258979f7
SHA512 9bee4cd6dcba8c745631255165ba046b11c406235f1eefd4c6e1d7d4399d378febb6f1bdf7c2726f4482676fc5c75f437f5a4617312e2db8aaac2a55771e4975

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 0d3e2edb4160fbfca8c6212dc4937858
SHA1 6bfd8c5dfbe4c629f2e0146d220545b775ce3603
SHA256 b21fd3a4a116dfee7366f52256681722623f8a74b9469cdc0350557a7d36289a
SHA512 4c6fdfec48bc82f08b64969dc19dab5f88bc4a3d1948915f11be254c2adb2e829d85598b0d5a9b03b5093c1ce1a6dccf5cf4b2b89348e2f9484d7ea1714566d7

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 8eb69293dd0dba4d9dc54c0a6cb577f6
SHA1 91f47708780bf52f53e3a184e2694c1d7bf43568
SHA256 3240541ff2a52735f79408997e8ee92c4853b340a5f09dbb4f6449ee5a84724a
SHA512 b61c7bdfe77128e62a60226498b1e869924da67a58f2b0ca7eb50cc443c6ee2d4a62b9c2768ffc3d7f91ac4a23d62b6380075ea74384bfb50ad0c1112ba1d7fb

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 ee857869c6d95e62458610902a650769
SHA1 7753abbc522925e5fa0594ce1d74e64b2cd1eeab
SHA256 82358987bc0506adfd90254cc917b59ee072f1fc682ed1ff6b490bd65bc4750c
SHA512 41d664be9d9ef82f0a5abe530626f8846d3b68c83b528c6d166b26cb18c8ee1b10ead81c9e85a63e2e15601cbb00038a9351f435558b5067c206e270e3e2e945

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 07c7ae606f1e35124fd418fcfaed8867
SHA1 84e8a64940d03186c9e8e2584b894521e7f5006d
SHA256 287c15367a45e97ef3ead07bcdce72d2644a2e8fce335aaa1c2260aed1cc39ad
SHA512 6f5693433941f36f75d99f586e548a98130da6e7db57a8c989fd5d967e1f82e449190f54f01b8e8d2bbdc1e35ef1e7f18f88668feb051a198fcd6fef92e4f55c

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 8eeff20b7a7a1f770c86df7db6110180
SHA1 62c09fe383f10936884760d047e79ecac91dd81d
SHA256 5905ecb2b9bcc78a89aa925dfb287c97121f502e10b6bf801fe30ff84fcac326
SHA512 343f02b3b680325dd1bc4533714cbc4e91a78b37aa94afd2a7c03279f3ad4a6a2512c0415de17db98a6a0e6b71eea2136e815fe11fdb107c0acb66fcf4948cc1

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 43511a02d8648de5283e4a7465d5a272
SHA1 5ab2b7dbcd55b6e6cf89fde55a55083185595601
SHA256 8e40d2659c71f9ee0083d7cd5e3d4e497f51a7b81c47c2b11e0b552b8826caa7
SHA512 b8f6b16027b9633189d4589757b08c33a9ab9d20a99cc170ecb6186a7f199d9a4b4a7b206f730bbf64ddb5a77745e2d7dc9ec9749b839bc8d5d88368bf198f59

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 0ec078596d9a5ef3c51e430957ff6802
SHA1 57013cdaaba9a5efdd5055619a234753e8d4fbb6
SHA256 54dccf9c8ad77a6f22c2406be45990cd86f58fac38986dd4e63e3e11f62252f8
SHA512 06eacc1e807bf5d71d065c497e13973f97fda2b38c2eeb6e2cd9371f2de10d35b21da6c3d50162858321c9921f77b6a009f1c332ef9013baafa2e9a51c9ef5ea

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 17d30228b8e934ae31c05e03bed4384c
SHA1 c86086882734f641ee714dbef90aa43e64e57339
SHA256 71225b46c720ae6e7769f361a7c18df3541d7ad3777b948469020d3d7931f2fd
SHA512 f8258653e8212ab34c08e211e766e0aff2f645b373eb3c4019d3c9f3eb1ec76ec1d5f69789d907b233903100b88f2f1e79152c80d648edeab42dfc456003e49e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 63c22ecc62783b700721f170fb9f5264
SHA1 1b438e95306f0c147664e0d3140c2d3768b91004
SHA256 edcf0c9b159a7a7cc77526fc43abdfdeff3bbecda09b35e7538471f515f8e409
SHA512 defccf912a46706ede82b6a4a9606d6b8c847b757bdd01a8e22269c5974fecbc00e937785d013c9a8baaba5f81e89cf03d016d039b08265528c4795e97b9b5ca

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 4f686a09c0468c6d3af45ba2bfc1e2a8
SHA1 c5ef1db18c68ee7c5ab92e20803e7ff9be98bc6f
SHA256 4180d1633694522cf2d60a2348ccd0a1dcf4f33504c11586b32381c6d8ddfdbd
SHA512 84fd05403a4276c25399dd6f05eba03e95cf6984bd23c112c0c5b6f12e1596862ea985e4e91c3cbaa6c0d8aaef0ce796e148012cdbb80b8ab546a7b1ba27b407

C:\Program Files\dotnet\dotnet.exe

MD5 044409f805d4993a9e2a93cd95529ed8
SHA1 d046d632582587460ca881b5e4880d74a0bc9bbe
SHA256 1dcc1b3a637c7d908a3e707026516445fd0a9f78962934161143221a23e57056
SHA512 422aac0d4f947295ab5777ec3892d721f271818fcd8390810391aea2bb77793d95e4bbdf61ca844b06c7f848fa3396ab15b46d0a042c8330813c71feefe67b20

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 7e15387ce39eae998e23e9798799130c
SHA1 85049df5b4df0f0c2c15dfcb1590867136b158b0
SHA256 5aed2a896b8b4b9d677c62a384961a683e9b35b894b3893e48bce938aa55aec1
SHA512 99b0b429ce943510a23cd719f2d7508cb746bec95468d9e5728f2fc514815c0a5c95d58aa8be94bd5477a938101ce70a8392bf9eee20a78c713eb3e71d6c2414

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 8716fc0dab37b8f15bfe93b0f0544d6e
SHA1 62563461052a426d70a542f5329485e8aba81e7e
SHA256 58fe9f6a5ad58be32a21653439355a40eade8e361d9be54b269637e799442cec
SHA512 c71568d3e5af2158173bc162998aef261474196e2e8456da16cd5750c82278d823c633521caf6014f50e95df64ddef5148d2febde20c8c08bca6a40d671c0129

C:\Program Files\7-Zip\Uninstall.exe

MD5 08dd11a6f3abe0590d69f5202a78a3e7
SHA1 3e16f50e19567ee5fd3b4c4045f008b985b88afa
SHA256 ad3438186a94e20198bec240561043e85cfdf846020c9b0bca9dfdd2ef91aaed
SHA512 731bc6ce6975e011717d0bf76020121a4c0f19eb5f2d96713993d6cde468a8f16896c98aefe65711c7e728d3e1ff9a8154fba562825fc60c6011dc41d17132fd

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 99a755dc33b413f665b7c57072c66252
SHA1 22ccb9bf5fa84eb6b4af644761df62a42ad111ba
SHA256 adaa7275bb73af47996ce3ac74e51dba0dc4f302831d2fb8607178b0e692f9ab
SHA512 12162ffd1955fa66d184064f5fdfd58be3e2cf22b16fa27b4113a1ba5802d60a5dfa2bac94b493aced41c75a145736485b500455129a824e34bcdda6971172dc

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 bb1194a0e1c91dbafd8d23a2cea2922d
SHA1 68fab4f3e6144df0c1b63fa527a35a52f26f8424
SHA256 244ec350f84f1dcaddd7fd267707f733bdf01c92558a51b08abe0a6d6ce23be9
SHA512 802e9d0e1bb30a9678a4c867a241109da308a287d64b87057a89f7cf4c29aeb1630d122215a760e161ba7dbe44fd1f7d107ba2268db4560c758111491a726c80

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 c20b0dcaf30b992303bc9764e64832f5
SHA1 7462a26f4dcb702f17a8b0ccad61f5335cff3d82
SHA256 82256df3fed952760e2b9bbbcbf7c6b45c88632217abbc11e9f689bb5536222d
SHA512 a60126de5d9ef2defe842df10f526626d09bde42ae9215d58198a3aecf4fba7e4766586fe20736b13c64697cbfd0bd048c5fc0093677bdeb000831ae9789d5a3

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 65b4ad96977ec95f8dcbaf65d297ec27
SHA1 dcec4ac4f24fe5c75ac9154e0594bee6b52aab3a
SHA256 70c73a37bae9f2fdda29667c77007d7129ab69c82c89ea884c0183607ec85e12
SHA512 e4540a18b1a1eca8d8891ee8ef089994e51b2e61c58fcfde7422cd25cf0ceeaaa6acef96fee0d3a028f265864a42f516461132271f4e0cfbe014f056d9a14f6f

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 bc520886b59462b57029341564d706fb
SHA1 281ef96e32994db815c214c6c71fbceee67bdf99
SHA256 1acf5df26bb34ff956d928da4d9cee1e60dfffd0d63fc6d431d63e28e535c5b6
SHA512 2618009148944a487181adab9b7d1fe271981dac290cbc71d8650aca7b1312bbece1f1b2de8602ab9e1b053fb17c1e8fe578b17be3e2c5a71a0059a15b43f363

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 5e798aa878d5970652a521975523ef76
SHA1 c542fac6040f9f2fc95bb6761220a68491ea21a9
SHA256 e25e4a7e0f34eb910e136f5cc725f4608abb462c12f2916cf9c694bae0965bb8
SHA512 618804785e17035d76cd1ba7116a50adb0d848d879834283b2035f10fa951b72218e09fd7bf955d952ce37ce591ff8f82a6110f510ad50f0e43b228469e59d3c

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 01e03c9b81b3ce909f4b1356412b98ea
SHA1 600459ac74b8a68d7436b0d2c5f0f24cf88a7620
SHA256 fc6884995a584370bff1a8af28b6da5584a34b672d42de44365065a18a03220f
SHA512 337b238714f4d824350f19b6f6ce3b210cbc58257ae65814c3d45630c21356649b760c051fe3cdb3c9618355d58a49f0152862e88bf565ce6ad6e54243e00e51

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 bf4db6e2ff06d62801315163298fa8c5
SHA1 7b7da59e619f0c01113ee315fd754b32ae9df8bc
SHA256 0eff7d75d432b75738a95baf58b55fb3c8ee9f6999196624fac404e0fa19b2f6
SHA512 38eed77226df6b046080ac88adb2ebbc79c1cea3cd5c59e30584b01cdc104dc9309c600f975c4b43c0fd07ef934f30e716dc5aaaf4d84fe98736aaf8ea46b1c0

memory/5772-635-0x000001B06C1A0000-0x000001B06C1B0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 04:58

Reported

2024-04-06 05:01

Platform

win7-20240221-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7ce3ac269a3c2c1c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\goopdateres_ko.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\psuser.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\GUT4432.tmp C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM4431.tmp\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{09676612-603C-4A20-87D3-7533B88CD77F}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{09676612-603C-4A20-87D3-7533B88CD77F}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 524 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1628 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1628 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1628 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1628 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2500 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 328 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 524 wrote to memory of 2208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe

"C:\Users\Admin\AppData\Local\Temp\5455dd98fee880bd046757c5284e6c3892e73f325182d46e604d8e72d252eeb6.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 24c -NGENProcess 250 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 264 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 25c -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 26c -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 260 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 274 -NGENProcess 25c -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 1f4 -Pipe 278 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 27c -NGENProcess 1f4 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 27c -NGENProcess 1f4 -Pipe 168 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 28c -NGENProcess 260 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 20c -NGENProcess 1ac -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 294 -NGENProcess 284 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d8 -NGENProcess 2dc -Pipe 2e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2e0 -NGENProcess 304 -Pipe 2e8 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp

Files

memory/1896-0-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/1896-1-0x0000000000330000-0x0000000000396000-memory.dmp

memory/1896-6-0x0000000000330000-0x0000000000396000-memory.dmp

memory/1896-7-0x0000000000330000-0x0000000000396000-memory.dmp

\Windows\System32\alg.exe

MD5 bf7d88ebfd75219360bd24e84f447a6b
SHA1 014f9d6f18a18ca298c8661b3008726646b35643
SHA256 1ca1b29d2c25fac4c16c737c6c86505cb81f31079ad863feae9843f8ff5be52f
SHA512 7e89b0561a5c93be763991778440498d1ba401719b9cb75c1aacfba7d63bca609f3945fe9ec3a199553e080c63632f710a607d5efce0bb2e3b39895f6c538204

memory/1888-28-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/1888-32-0x0000000100000000-0x0000000100150000-memory.dmp

memory/1888-51-0x00000000008F0000-0x0000000000950000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 879b4c4ed97cabdd16b374442d20aeed
SHA1 18bd62b8dc345523615c8a21e0da6ea1c14efc26
SHA256 6f9386386268ea64cb415731e78d05650266b3fbd28ccd02dfbf6947407591bc
SHA512 a082a2251d5278dc40fb3e779d3900486212bb90c9d6283abb178041443951bec2d93d999412acb9d164e865bf42930102dbe06cfc16fd6197d63dda78497ece

memory/2452-94-0x0000000140000000-0x0000000140149000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 7fc0ded292c5fe8fc610ceba23f85f6f
SHA1 8a45b36675d8b9720a7d8a0047539fb787d11800
SHA256 92f89272877ab704a96dd3f12015459535e2ff5177c3af14efa1606f15b87cb4
SHA512 61b392b9ce5c9f6ed962bf92d07ea8a8005f6cfe6399d335a33c0082ad4c64a9af54ba43d02b10c8c78317547dd80970540fd26c6a6d15495f703302f3e3c7ea

memory/768-97-0x0000000010000000-0x000000001014B000-memory.dmp

memory/768-98-0x00000000002C0000-0x0000000000326000-memory.dmp

memory/768-104-0x00000000002C0000-0x0000000000326000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7ad81662fca2b22f7436178c24c1d807
SHA1 8617a1bbfbcaaf7ac63f82334c391ab0ab7f307d
SHA256 b64d2e6136e7b4349349d1d989d29308e9cc13f907f6a17d708be17908119062
SHA512 33e7877c623d3c7416aaa2c1ededb0f577b3176722625cf05185445c37f890e7b1b317745d213d45c9927d703c8ac92415e037d04d87f8e67c53afb85c5a156e

memory/2612-113-0x0000000010000000-0x0000000010153000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 229c5daa9ba3856fa0448848e0b11e41
SHA1 494bd47755bec654b3ce11aaac8d02bed80698dd
SHA256 16e362b4ec6262ce9a61a6c99646476b6012797229f15fa5aef04574dcb1b5c2
SHA512 56b5ab826e404ac2a0e873d3b57c3bc2dc2e0634894282af2ef30ec6add0cfa4314250236a1a2cd38b6141308b4e4f8d99c512080a86548fec8df7fe47da71a6

memory/768-122-0x0000000010000000-0x000000001014B000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 184da71623b7332372c18d978f8d61e3
SHA1 9e62a415835485e0602167aed0f7d96b68e7d55a
SHA256 33251da49b7a6e5833e5de5b90f91e8fd71683c931296ef14597d4e2576ed9b4
SHA512 dab5770f226df55bb1ee3583d9bb91140c28063552ed95fa0111eeed7ad8532b477f383317f33946aaac34256f2097e29934a37f9592fc96273b60c1f1c97641

memory/524-124-0x0000000000400000-0x0000000000554000-memory.dmp

memory/524-125-0x0000000000560000-0x00000000005C6000-memory.dmp

memory/524-131-0x0000000000560000-0x00000000005C6000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 1ee3e046c9103e28bf09223018b2a7dd
SHA1 6ee0269f104f3f98b1e1064b00ec26d9e973bb4c
SHA256 c50cc3e5b9ec26a15fece53894cb1a19cf823a868308ec47ce2885212ee59d6e
SHA512 7bd3ed1bc901ac5ce01aebe39254a5c657ba66b9488554ecaec44572212c313a114174889f2645191da083e955aaf4978587f0c9cd4101bc1eea1615441ecdf6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 230848af72e569ba3b2c5f4da0112254
SHA1 cc0f0852eea680e28be420f2a1ecea830eca56e1
SHA256 2ab6899cbc90bd860ad5d78421a60592b20335a89b5e846805ced91e047ededf
SHA512 06f48c2f4bc5507c6f47a1c8efb842170eff2bfff38a9da331dbb1b3ef7875d1c13d8da708528f001122837584f2ac87428642ba28b01e498a02144e293440ae

memory/2612-141-0x0000000010000000-0x0000000010153000-memory.dmp

memory/1480-145-0x0000000140000000-0x000000014015A000-memory.dmp

memory/1896-142-0x0000000000400000-0x00000000005D4000-memory.dmp

C:\Windows\ehome\ehrecvr.exe

MD5 8e52b52f5008d5729498fee65fa392bc
SHA1 cab21f1e07b20145e0aaa66bcb8e67ea63db5903
SHA256 9e216ce89a9c3f45eb0ecae7618d290188fa03bb75f9401e84af761f06c86089
SHA512 5d108c93c908ea98bdfead60f9a25b928537430e82fffd0b2d2f8c48edb7706946add29c511c5d3bcbac86eab56db44014d92dd74319e86471eeaad02e728cfa

memory/696-151-0x00000000002A0000-0x0000000000300000-memory.dmp

memory/696-153-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1888-159-0x0000000100000000-0x0000000100150000-memory.dmp

memory/696-158-0x00000000002A0000-0x0000000000300000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 41dabfe729d02ec13cb7248b82b7a845
SHA1 2af5cd4ac259ca5679a95dde52dc7d094e83585d
SHA256 002ba299551ed8466c06b857c4c87ae3fa1fd3ed231a4768440b33de287fec6b
SHA512 4bc773b7d4d540cf90787de2bb48fa0264a9688324418040ca9105583da1a93491b946c817c32d295535d6b8a956e02eb78325b2228c1ca39244e3f3974dde21

memory/696-167-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/2084-166-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/696-165-0x0000000001380000-0x0000000001390000-memory.dmp

memory/2084-169-0x0000000140000000-0x000000014015E000-memory.dmp

memory/2452-170-0x0000000140000000-0x0000000140149000-memory.dmp

memory/696-171-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1896-245-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/3028-249-0x0000000000230000-0x0000000000296000-memory.dmp

memory/3028-250-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3028-255-0x0000000000230000-0x0000000000296000-memory.dmp

memory/524-256-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3028-258-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/848-262-0x0000000000B00000-0x0000000000B66000-memory.dmp

memory/848-263-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3028-265-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3028-267-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/696-270-0x0000000140000000-0x000000014013C000-memory.dmp

memory/848-271-0x0000000000B00000-0x0000000000B66000-memory.dmp

memory/848-273-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/1628-275-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/1628-276-0x0000000000400000-0x0000000000554000-memory.dmp

memory/696-282-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1628-284-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/1628-287-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/848-288-0x0000000000400000-0x0000000000554000-memory.dmp

memory/848-289-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/2644-292-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2644-298-0x0000000000230000-0x0000000000296000-memory.dmp

memory/1628-302-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1628-303-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/2644-304-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/2700-310-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2700-315-0x0000000000390000-0x00000000003F6000-memory.dmp

memory/2644-317-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2644-318-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/2700-319-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/2500-324-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2700-325-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/2700-332-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2500-333-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/328-336-0x0000000000400000-0x0000000000554000-memory.dmp

memory/328-342-0x0000000000230000-0x0000000000296000-memory.dmp

memory/328-345-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/944-349-0x0000000000400000-0x0000000000554000-memory.dmp

memory/944-356-0x0000000000640000-0x00000000006A6000-memory.dmp

memory/944-357-0x0000000074440000-0x0000000074B2E000-memory.dmp

\Windows\System32\dllhost.exe

MD5 10a2524c0216b7c2d2c252d76f4a9a89
SHA1 8cc6ef4df857b55343a4cdc0731d897ae836f376
SHA256 6ea5fa83f177b8dda2a508040c9dbaae7ab37318507e4b2cdf835bcae385a82c
SHA512 dd784249744e0a64ff03721589addaec1fb299c733e0598c298fd1b57b66d0790be74a2f5d635816b0c8add48d7441cc2ae4cb0b060386256464805e8a0aa524

memory/2500-361-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2840-364-0x0000000100000000-0x0000000100141000-memory.dmp

memory/2840-369-0x00000000008B0000-0x0000000000910000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 3890e32eb0335d944daf273c4a4f6109
SHA1 295c2a498e5b0b338b759875618387edaa9fc8d6
SHA256 5055b961f5d629d9492b24691a10d9093dd4b6873d4d11c88329b79a573fae14
SHA512 b6df5eb7f30663eb4ad31c7cfed2e713db0ea2628a035471f6a777f3f0198dd0fef461e86a595d7eff4ba11d9420253700489e479c7477c9ee7d0f248382eb2c

memory/2500-374-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/1452-377-0x0000000140000000-0x0000000140237000-memory.dmp

memory/328-382-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1452-384-0x0000000000900000-0x0000000000960000-memory.dmp

memory/1232-391-0x0000000000400000-0x0000000000554000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 8d76db474ba11a0069aedb6b25be84d7
SHA1 96090855f5ad2958f19c07f1cdf3cc1d8b4aaf0e
SHA256 7fc7d69549889629e71fc7efc6664a59319eca79cab32aa92a6ca24ec4384170
SHA512 a7cf55a30533af70330b331c3998ccac68b911287b9b2e7ae887f7bf7f0fb3c804e24c4e1f899ccab14bc5d562357ac6d625e5eac00fa616df3d326389cd99f0

memory/328-400-0x0000000074440000-0x0000000074B2E000-memory.dmp

memory/1232-402-0x0000000000300000-0x0000000000366000-memory.dmp

memory/344-409-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 35b72d896f76820a04297d5b35a2e2a6
SHA1 41f9a0526773285211f16dd921261d612aba7815
SHA256 87a74635f2f3ee1b73df6df3993fb0c2b8bc8976e53a5f860359753a38e88b48
SHA512 c280a660b1ef7be16e760b1bcad3f5f86cc3f2bce5f3aacd048df84c377a1c668141a30ef54f29ae9465beeec1aa2d43ba4ab771eb45262fbf3046120a7285c6

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 97d2f2fd063b3e6880c0da248270c786
SHA1 df1d79a784c8221304cbfc351e5e49cd4072eec5
SHA256 d98dd0f3284dba57e0f1daaa9a1b81c875c4404eace5492f03597b84c47e8114
SHA512 f4363c115669bfb5b466caaa2ae14ccee4e0b2b506f1e9e8388e53057d12a64c1967cad740537c2019b6c24e6c6030ebdb34fc398a0663506cc568442f7a975c

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 4480bce93f62923285bc7dde96f6ad7b
SHA1 8ddbcd502e7c32ca3fe869b41bad6dea1882c0ee
SHA256 93f3a39742087ccde4da4268554b34c50968b113ac3e9efe126fd60a95922572
SHA512 7511e5e8d3c878f1837b9e1b765f6559173a7ae452103c9563b944ff893c9ba3dc8417d109e59f534322414f260253668dc5efc28d31016fe4fddf667d82d46d

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 d133c7baf837d91a4ec7063d4588f8ba
SHA1 c5681d5cceb9dd8958da74738528072a4c15539a
SHA256 d8404a1bdd660680cfde49684b371d66d8c625a77696411f40986a5a30424501
SHA512 b0a0f911d7f7236599984c17b8e427edbc569a9f1ba16e7ee105f889e9c263685a2d287017a3b9cdfcfb59106cfa9a3ca3ef779dd7cb7805f7dec146d3fabbe1

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 2cca1c68aa8ad6cf5099d8fb0e169f4f
SHA1 f23bc6c5e0c3c6ea006a9e16ef37cdbfcf4f29c4
SHA256 0f82a6c8c488314eb645a36a429e8206144b9db11a585ed832c1d708da742bf5
SHA512 4c98b0ea2c519791ce784809623df3779b7e6ecdfecfaa0fdc2c84d7bad237eea138cd58b7293b663e9e0400203788033645d4f9b949835e7669c3db0752f32c

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 761d4ec7a94d7667d03f512e4eb3fe09
SHA1 238044c592c08e2ceee49d093f9659d41db18a8a
SHA256 78607625591f0c28ccda6997c98831d6a9fa9744fe9d5071ac6bcc615277a181
SHA512 3195ac582827916a4f3c5882ef30691d40d640ea4b912dca205940d429ada5eb545db4b8578bea70e3dad0fcc69ba2ede221ffb9c7c62fd1cbf4d1d406301d66

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 0dc94b321c5635877d2fbde117a3bd5e
SHA1 7129ee81818c2f4e83186f3a46ae73be74f32e9e
SHA256 669542b9f5238868632c641540581b4cf944e97b72b978cd5e61f028bd346a68
SHA512 73ad3668834cb8bee0682d0986446002dc4b456c2288306c916c6c81a383f58de10f6540613576e040e8ff4babe6bad42e1b302b8a3c5e0296851ece78c5a89b

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 507b1672a8c1384c6ade98e5dbeec997
SHA1 0868ad25c44669274e6401a8a7e593070e9de7b8
SHA256 80a706cf9f527c3f79c22f79aabedc554b1fa15a9f60e7bca0aa81c029b8b813
SHA512 8af2f514af995d139e0d97de52036cb4ab8fe48571ab995595eceb4eef325201a602242d1fc732eb758367d7209200045a5c820ea6e9717e7e33bb33d26aad2e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 330759855021cfe5751be4b2f4a55a13
SHA1 ac69a20496a57ac06a4c1a1ec0e479cef5f99f54
SHA256 b5e747fa7b45eca4ae7185aba703a175a1bc5f181c867a6acdad9b7b2963fcb4
SHA512 4a6e974aecb171217cc036df1dafc632dbe8daa5e4c144ae8a0fe16b4dd32f3bd84e059e5f91132c9ab6f442a9039e73d552fe216d515a59efd952fcf266aefd

C:\Program Files\7-Zip\Uninstall.exe

MD5 042e67b1c72eca3e40517fb7db969d5f
SHA1 a66668a32d7d6e5be55099bdafc39b9680a08cac
SHA256 a3c9cbcc337c4c36a13b133b16e708f24ab29e2c49037f15d42b010cbfc0563a
SHA512 a1b29e1886ec768e590d4b2083fe26b5744aeed68269e01da61651ad7cbdc81b35113d383f355dfd18ec5d53534fbb3a2c792f7a5500789996e2321f8a51ba47

C:\Program Files\7-Zip\7zG.exe

MD5 a766772eafe94eddb5ccdd034dc700fe
SHA1 0b765400ea79d2cbe1bd87e0a11254b43252ff4e
SHA256 09f29d08d1a5d4b0594a3cb78cc86e3dabd7dfe0f8643e1790039313f9116afe
SHA512 7e149f5c778e40860e2cedd625dd6319d2dd93b3f956855d2266453dabb6b39d0ffae285890a36dbf21db3a50ca57c61a31f062f9b0b4c48d5e27f87e626eed5

C:\Program Files\7-Zip\7zFM.exe

MD5 8fd8341c2d02efbfc37b4c743130822e
SHA1 a83d0ef221e6f6e740ea43d3c4c2c188c6c5e4c4
SHA256 f5943786d3a257b8376bce75db0a5a014ec1dd7d3d56acd60b6b42ae76c8c47e
SHA512 cec83ef058c384519aabca66cdbf0695227131afae102080e2553ffa95856221052a347588563a8cab2c400c29c6412d0757fe8201ee1dc99797028c54894cb8

C:\Program Files\7-Zip\7z.exe

MD5 dedfba0a1b5eb83d7e3c63d7b5c0d3b8
SHA1 6edb8e1d5826de6748ec19785d841e8270e920f6
SHA256 642892aebc9e03a5bc669b075ed03caf5bd5c49dd196e6a052c0773700704109
SHA512 cbaba35b26f5e103ed9610ab001d286fb2aeecae54b1e4a59f2aa31d843d6a2d01398effaf2211d7dd93bedc1af1485abb0361ec1a486ef9c8937064835e1ed7

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

MD5 ed1f20ca6f913c8747588f1693c81dcd
SHA1 65ddc85bcdd0b5d1d480bfb4ff8bf8d126c400dd
SHA256 554db1b7add2bcbb6e95338401acb557c3954cdac71e256a1c02819a115a93e6
SHA512 d460ea3b7256958daaa46e47143b1087fb2946d09efa3bbaf4fe620cfd25277a398cfc0dc5e227e28838bfcf8827835e14108199203a2aad8c5c44cbf224f6b1

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 ec43980736c501c37162c9b2df69b721
SHA1 e1c38d57f019d7fed3d431f364dc2f8202879263
SHA256 d2103325b252d7eca36f0098e01ef2252aae88e39d0796cef22fc3037bbd1ca9
SHA512 b151b0e51b2ef3f3e40843ab0331ad1986c767ccf8dc74eb585c923db6fe0ba457b6c8b004e1b6cb122830aea0e1b0b8f48246ba20bed9f28394ae0bf75ec36d

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 8a9722071ff32b75427d5216a41c6e63
SHA1 aadd19d63c4b24abc901f75654b4d58a62fece6f
SHA256 653a5030ff5a96fb344d98b43a290d904ae0e07bf256387b7c48859abeeae3dd
SHA512 eb0426e8e796e8e56462075ca90e244c79b8d3c5c27abf2446de6e35a1c519f71a57bd2e95bd0761a5b7aff46392c2ed829c0dc282cbd99eecc5b514d7c28796

C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe

MD5 7e1e155a14097342364e3654fc08563d
SHA1 81d8aa14722980a27045cf8855d224f3c724fbc5
SHA256 3b248ad39b92d576cf04a5b0d5cbd875107b6defb6736895e1801f834592bd1b
SHA512 b9c5b206d828e5605bfdf515c7dbd53ac92787c9e623df3975a773a22449291aaa16b803128f9502528b0c2ec911ac7836b9d2808ed7822d02ea18b70b1255e8

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 f6badb2f5f5b276165560e7fbde9b378
SHA1 a3330b63dc67b18dbd5ad963f08553ed3e3c627a
SHA256 7b8c3bf25d108ac38fa5108725ad2c5f91390ba422e4ca6a72c072d454e67544
SHA512 e090b05271c1a47dc96deefbfea4a5427e15102a2b8dfd7669c51aa34f2fa85edd66a404313d161f7a9d59069dc6ca8e8b94e27a2979888adae2a06e8787ab40

C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe

MD5 029bb245ad5293bbf6937e66c51519a6
SHA1 1782585d9bb3b4796eba44231b72b00549256957
SHA256 b563dbe0558944cdbc43daa5f1b305cc6f509a21a07720fd48e67d835ad8a3ba
SHA512 fd719dd3db9260034e1f1d2a11b1e1a834851d0c5826bf84e29b345e316959b4a3211464c93adb700fef96849ae59ab611a7eeec7c4844d9276fe34dfc7ac06c

C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe

MD5 2b6e7db117a2a24f1aa8f9ab01d5a263
SHA1 2efd101964eb43cb2f4bc70b3f8874e61e7db159
SHA256 c0d24affeec71630ed7300cf2efdac2e7b9a2a97f5c8c9fd24e51aac62407268
SHA512 022111460af0eba5e23510d90f446c2b67ec9668d6b57d845d716aa4bdca88a50ebe205f7c03c45c90c9aed923965abd0e800354d516320d49e346328f42faa6

C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe

MD5 02cdd7eed4a423c1cee5261313373a84
SHA1 a23461a648f232568347ea90d9647cfe3874ced7
SHA256 f3abdba1e517349ef1e5d0cc4e1bfcfe7d55ce631f9f852a255777206d751574
SHA512 8a870673a4365ee01c70195a33047d6f38d6da99c7c35dbde6410909a24e77e3411f0960aef6bfe350dc5a943460a2b8e6f099c2f84cb4c25435a06015ded0ae

C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe

MD5 939f4eb4d796feb32ca16f28a465e777
SHA1 c57c54fcdf265b5b2ad1c4e19c7b8212203e9f40
SHA256 4a894493904e490703a93b26c8f9e6d16e41c3bc65709eba8a8110e3cc8c1311
SHA512 8b83e5b84f43c1e21eef43aebeb39105a1bb1d6f81fb2db68cd16ccc5e360107c1d056ef8341cd10431018935219142ea61d8cf1412491109074adab657a4eab

C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe

MD5 4363d61b70e60faf22c4dc09c0785ccd
SHA1 cdd7493d168287b9e9c39317441c2bda3a3ff793
SHA256 a9a4d436bd618c1ab5dae62b99cfbebf216b72a1f9c95b1d15d3df58ae7389c2
SHA512 deeecbd1391c5c05fd7cf1a5fdf0c78852ad122d59c9a26bedb4b7c183c211eb0926d220e490eb74b8fc7688524adc8e235716d364bb05607a4e4ee574dac2ae

C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe

MD5 7871302d07d6cf5c44a267548cdc54c9
SHA1 57c9c398aa336f193c245a4d0eb17531e5412182
SHA256 309d31453fd590854a1ff154618bb6c764a83f432ba75f0cbf8ee9d2dbebe243
SHA512 da26a1911973cf307e5df7094e75be2bcb707f335162ac686a3ade8bd27c84ae4554b97cf8093aec31b5bba01b9af59303b4ed0360ec069152ebd1f5f72b438b

C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe

MD5 23acf349caf0401861987d93439f1e92
SHA1 58068179ef4499213459b4e178ed4fddf4747a2e
SHA256 00d2c643a80520890487bdef0f3d93315fccafe83bc0b6a5c61942c62774b321
SHA512 e4353426431205366a87f450675b1767be76b5fe253702ed39b0da9db302512539d4b3f39186d0a4970da6b5b63718f4ce136db44d5059e933361df9bba389b4

C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

MD5 fa94667879a1ce315b92a2032265df60
SHA1 015246586ed6dfc694272e3f194bdb926b273038
SHA256 eddd3289e9554368224125702cd5a67721fce2cdcaf722359cd53f51e2365b95
SHA512 9a4783508e5a442fbe2f63a67213f274803dc7845cc857574e74fab27e2fb8dd6056c5f1158485a213a7174fd8237866bfd6390c5310dc7df133594635ff4970