Malware Analysis Report

2025-06-15 19:50

Sample ID 240406-fl8j4sbc2w
Target 2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7
SHA256 2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7

Threat Level: Shows suspicious behavior

The file 2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 04:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 04:58

Reported

2024-04-06 05:01

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe

"C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe"

Network

N/A

Files

memory/1952-0-0x0000000000570000-0x00000000005D6000-memory.dmp

memory/1952-1-0x0000000000400000-0x0000000000561000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 04:58

Reported

2024-04-06 05:01

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c8106fb3990ca9c2.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118578\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118578\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118578\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c9bc869df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dd45b68df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026af3568df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bf8466adf87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072ced768df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015420c69df87da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe

"C:\Users\Admin\AppData\Local\Temp\2fb85bbc997fde43bf7bf8757015a1759225f672032851dc45d455fb667518d7.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 195.201.50.20.in-addr.arpa udp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp

Files

memory/3756-0-0x0000000000400000-0x0000000000561000-memory.dmp

memory/3756-1-0x00000000022C0000-0x0000000002326000-memory.dmp

memory/3756-7-0x00000000022C0000-0x0000000002326000-memory.dmp

C:\Windows\System32\alg.exe

MD5 ebd9ecc2ad139e5ac23f4c799122277f
SHA1 39e7af51facc8926ef852a543523fbf3fd607ca2
SHA256 ca4a0e789304ef9ce205bf6981dc59ee4ff23407ba98b0c41a5e25fab8b34929
SHA512 5e212cc4d257717ef23d50154b67365c301e672af6f658b02c5a6f26dec23c18f51c85b5ed9de3a4a4fa83810fdcbce09a8301512ce6763ef1f9709b1829daeb

memory/3756-16-0x0000000000400000-0x0000000000561000-memory.dmp

memory/1712-15-0x0000000140000000-0x0000000140156000-memory.dmp

memory/1712-14-0x0000000000530000-0x0000000000590000-memory.dmp

memory/1712-22-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 c2ea03fdf48e0c5fbaedab15ba2ee548
SHA1 2b0318f83af79cc125c6d46750ba8886bf5098b2
SHA256 11f94fc843c1e34a26a7ba881a2717e84e3d8c800bfe38b793932a964271b0ca
SHA512 71c8250677166f95c6e4e1bebcf8e7483cfa7591323b4e776cadc3afb47270f5c5968b81722f225a747d823a7e2ec7b5766ecea054c5bc6c5b1242750ca7ce77

memory/3020-28-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/3020-27-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3020-35-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/3020-34-0x0000000000D80000-0x0000000000DE0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 48f22bcd7d95a12685255f8e99b56af0
SHA1 fe6e7f9f5f6e729a595b3dbfdb919b163e4de63b
SHA256 2e36815952dae9cb7f519622aa05f6376f5aa08d86086ce0040da29226171a3a
SHA512 9faf535e2b258394be0b98ae865e6e7a0f683a13100ba37ed16a5d9051212af33990a1dd2b0028c7efdce54a18e9093466c8e343c20a8fb8123427407138998c

memory/4464-39-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4464-40-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4464-46-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 fd0b8a58ef308c487b69082e84a96348
SHA1 dee7b8ecddc4636347d0a1ed6b445d3d5d0c0855
SHA256 8f571d766bb107a212e12fba3f111da0d75413e82cc6a01c0e5818af7de2b8b0
SHA512 df340c29e77bc28dbcd7b584feed8cd92308eb3ef77e022e9ae3d6e028590c81a700a112d17928412cd0858e8e3fd2791579da1f48797f91c6bc28ff766d0fbf

memory/4472-51-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/4472-50-0x0000000140000000-0x0000000140176000-memory.dmp

memory/4472-57-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/4472-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 06002f1236735837694b0fa11098a0f2
SHA1 18ff3f2b595b28262756ffc40a1c00fb08959e1a
SHA256 3a37abd0d2d66259659400231c3dbe4d3634ced15c110b6308c968fc2efa6384
SHA512 d7c58cfc8fef4f3d3063266c3c64094061dbe114bd79ea380d1e656a85d3c1762057efb92542bb0c93df9a24459778884f882889c30e0ebb9294cafc0ad3c758

memory/4992-64-0x0000000140000000-0x000000014017B000-memory.dmp

memory/4992-66-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/4472-65-0x0000000140000000-0x0000000140176000-memory.dmp

memory/4992-72-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/1712-172-0x0000000140000000-0x0000000140156000-memory.dmp

memory/3020-228-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4464-235-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4992-238-0x0000000140000000-0x000000014017B000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 fcc8ccb9921ae69f55863b18d4a55a03
SHA1 964bcc84b4fc2229467f594ea3a705e1adfce51c
SHA256 f40bbc288873afb037c8a5c4bfb91e4f9f72f1bf7238b4501faeeddad288f76a
SHA512 8e70b613eaba91d9b6e1978f6ca407f0ba80e1c1284050815d66b91275f128fb339268196e5e663aa6f312ee267fed0efb50bf44903bc619eb470ddcdb4d9902

memory/3420-244-0x0000000140000000-0x0000000140155000-memory.dmp

memory/3420-243-0x0000000000700000-0x0000000000760000-memory.dmp

memory/3420-250-0x0000000000700000-0x0000000000760000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 dd49dcc9b3a3fdb980c904c5cbb6e5c6
SHA1 f900e0162e58835d54f00a69122d7ded7617b017
SHA256 040b152a29a3feb6ba8a5860cc1305788cb9ac9371d3b3df1de63b736ba232f6
SHA512 a6fe4d47b01ae6bbcf06fe2a5c4ac6347dd964a15b0ac23533fd9bf2970b4e722072f517f5c5d4167908a3bf036d13ed91fef31358f601e91c3a8c7f9e2942b3

memory/2200-254-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2200-263-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 5ed30ee8ed086284ff7c94daabe4dd81
SHA1 6105909d1b34f21c16f831d81f9a4601c69bbf2e
SHA256 f11893bc968c5be310a69e448c1cca04f51b7a7e8598d3d3a3a01e465230a5c7
SHA512 d15b144c7387bc6fb46915d356ef140437aa1d6e09a5801f7d2e1369ba8712679164ad46a1e3238928b0c2c194bca20ef688a7e5c87eb4f8d802ed6ba2542f22

memory/1540-270-0x0000000140000000-0x0000000140165000-memory.dmp

memory/2200-271-0x0000000000530000-0x0000000000590000-memory.dmp

memory/2200-269-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1540-280-0x0000000000D20000-0x0000000000D80000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 f68364937f8e429d591e1d3911e2779a
SHA1 86da1d57fb72e13c0cf88dde68fbbea9bfc474bf
SHA256 4f27a68951244a6c8638c9c4854102195eb954cdee6a2cb8867c00e6f5bdce24
SHA512 09537e6f57ad90ae0ad182633cdd30eb8b4212d1d15037a17231dce06ca13056e5cf9ea9b576a11877e6b7834433a88be6c8666684f2092376767e9b95168454

memory/4136-284-0x0000000140000000-0x0000000140157000-memory.dmp

memory/4136-296-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 2e095c8fa52f49ce0669f9d70b68f442
SHA1 26e5dff150e86a45be89e051c6cd0a58d71f878f
SHA256 a4b277edbd6e214602b823e5edf8d51fbf627986e68a3ae5e65b5e612e7a5234
SHA512 a0a67947fe4c7620174b3e828e7699425fd1ce36293bb771c8eecca37de63cefcd8b7f019fcb33cb08ba781d42db5191bad93d34228b4195a83c445fc73e69e3

memory/1604-299-0x0000000000400000-0x0000000000543000-memory.dmp

memory/3420-306-0x0000000140000000-0x0000000140155000-memory.dmp

memory/1604-308-0x0000000000620000-0x0000000000686000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 e4f8b880752c490679475faeb0668f5f
SHA1 0e69daeebe0751e7f5a2565d307dcd178edd9fcd
SHA256 3a970807544e188b7ef1e030554dca5756145b2232ab6f8310251114f859e9af
SHA512 b972e9d6944912271f60de10987539bcb38bef555193c9657608ecac9ce4d0ce152a2aa988ad26075736103ef1cba2b63a4da70266030e2108dd03842ae98766

memory/3444-311-0x0000000140000000-0x0000000140141000-memory.dmp

memory/1540-320-0x0000000140000000-0x0000000140165000-memory.dmp

memory/3444-321-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 8c5d63869f6549605a5158ad9fb1a7d8
SHA1 e7bc6b540260c275688ab12cca6c455ab75b5bdc
SHA256 52ee9e9ddceff6b3fe56fc576a247b06c29c02415c2c78e1f8dc69f29cd4740f
SHA512 c882fafdcca7e56b9a9b6a9d34c98ed0fb1c95f7fbcb7a64b20cd10eab9770895288504191b71e96cc1768d7bbc7f5a54cf150765fbf69ec678f768958a7958b

memory/2204-324-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2204-333-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 67687857e1c45f386a7a723b58e8d5a1
SHA1 30069b286aaa01c899bf1704c8c2d67c0d152946
SHA256 fb9d3e95feb10b0942127248ce9410c383c4a8e87c02247acd7670c70ee0531b
SHA512 e751c2585ad636b1bd253b591a754180b208176ec6e13b23f93c68df845e0ef162f3f160b307855170bd02e84e84b9f377e65df0e894b438e0ff07e65c58e98a

memory/4136-338-0x0000000140000000-0x0000000140157000-memory.dmp

memory/2852-340-0x0000000140000000-0x0000000140142000-memory.dmp

memory/2852-346-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 7a370fe9ac49d1e114c2f274cd037b42
SHA1 f4a016cc2ef07f5e157d0faa58e72975ae823b22
SHA256 897eb94b4387605979170f9a57c27a455172cade98a53930cd04d1c146f1d514
SHA512 8daeac7cac952b9f190185d5c29bddd3cab6d1e5f6fc2c6924b1d500ba3d5a9c05d24f364e40186e5dbb47df1405cc29fbbf16fa2d73022c029c49316c121331

memory/1604-350-0x0000000000400000-0x0000000000543000-memory.dmp

memory/1980-351-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1980-359-0x0000000000570000-0x00000000005D0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 1a9aaef8fd92855e8596aa39c2b1532d
SHA1 25cba5dba0ba1d2ffa1edb717c41a336072bb623
SHA256 88f203272eda8be285556b46ec38a04f11316d928e4bff3452efa8f4992c4653
SHA512 891432e09d51174e6a6330176e37399abe19214a7ad8fff1f912120561c7cccbed355aca31d922e292abe2cc9ec623d8bb5201c2395fc2d50fe282379dd85f1a

memory/3444-364-0x0000000140000000-0x0000000140141000-memory.dmp

memory/3912-366-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/3912-372-0x0000000000830000-0x0000000000890000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 04085e252244a3179679934834b077d8
SHA1 c6e4f39011f5067d225de77f6cabbed2e9917360
SHA256 2e5a412259724e1ee88fa087ae45e55e8c0c0ebf905b94f146bf1e1d4d84632b
SHA512 c95d83c80c98ffbf4c38b6867cad1995e5af836c4e94ff9a1b1ca7012c84e49808fa2586ebc6952566fdbb3dc9704dc043fb566444c2ae3b7318a1e67f0efc38

memory/1292-377-0x0000000140000000-0x000000014018E000-memory.dmp

memory/1292-385-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 5c68eeebbd4c239bcfc45cf5b7d56135
SHA1 f90056a1e78bfbdce905548ef02924fe06e3b948
SHA256 eaee248cc15b0d423c24f71ddb6e3b6aadfa611193dec78b7d928a4cfdcd2754
SHA512 761e680dd1b551006bea34f5b6c2c490ff111b2df1373ef01944130fd33d73ed03aae9fa5bb876a378237b65c8b3e425d31d0f0d1864ea4edc59e7d64d7853fd

memory/2204-390-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3768-393-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3768-398-0x0000000000500000-0x0000000000560000-memory.dmp

memory/2852-400-0x0000000140000000-0x0000000140142000-memory.dmp

memory/3768-404-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3768-405-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\vds.exe

MD5 da3982660a9fd238a249692949658504
SHA1 c71b45cec8dd7618ed3ae50ae25476f6debba03a
SHA256 eccf12e6ac7c246c55dc9606d519727262e2e1300d748a73f2871e05c1920ed9
SHA512 8a903b7a4f43e1ac8c79874355adf3a51d24028c5f5f193f8745131dc84ff1df541b504ee06c2392adb25e93c565de6bbea50219112f59c9e1c26a65e0e11e50

memory/2852-407-0x0000000000750000-0x00000000007B0000-memory.dmp

memory/2620-408-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1980-417-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2620-418-0x0000000000C30000-0x0000000000C90000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 236b0c4132bf448f48a86425159c2b39
SHA1 99d88f18ca3f9a4ae43fd1381231b270ca1ab710
SHA256 400fbf14a2057a54b73eff4e2e04bc76b989e7eaa8886108ea09d1f117612b11
SHA512 a3d9ba3c75df712f4ca07df545eb73bead326e71baf091d36f1d857e189e2279682814b985b969da590ec5315c6d27846c4b571cf9313cd09990a280be3af56e

memory/1384-421-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3912-429-0x0000000140000000-0x00000001401AE000-memory.dmp

memory/1384-431-0x0000000000760000-0x00000000007C0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 e13f0f48e9483819cb6a0065764fc879
SHA1 b036e048f5fe97b8758365a50667189e59c7c694
SHA256 88a19644c5b3312a1533b2aed9b56b5714aa7c0de63daaeb36d7865411e7583b
SHA512 4f194ad3b96b8b3878fd0a95a32358f25f66bd2dbfd01d961d121bc63e0b936cc056a7f95ae1c072f6a3b12f715e2930604ca21a68efac4ba75de5f32b48db70

memory/3912-434-0x0000000000830000-0x0000000000890000-memory.dmp

memory/4432-436-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1292-444-0x0000000140000000-0x000000014018E000-memory.dmp

memory/4432-445-0x0000000000BD0000-0x0000000000C30000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 e4fa66aa7a471db540ccf860b1490b5e
SHA1 e536ea992d4131c3c167ec9a3aaaca0135fb2b50
SHA256 3c1989066f1ab89c1bae5ce2b8b46c7c45852159901194b713ebb3fe49a6ebff
SHA512 b9644da77e0ba53dff714972d3c3fcfb37810fae470c98f27176b1332698ad2d787bf2ef925658cbcf357f62bada88fb6cb83182cc695a9c4f8a1906667291fb

memory/4396-448-0x0000000140000000-0x0000000140172000-memory.dmp

memory/4396-456-0x00000000005D0000-0x0000000000630000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 853284a7b0d7d648eb291cc71cacf9ba
SHA1 951ac53a0e2179b3e3a6ed5447d9cbea7eb14eb3
SHA256 7eb44c9e0cbe63011da2d8a16e8fb38bf7b387a1f955618050c414f87a0af020
SHA512 15059b18e2e537f59695da5dc07ac97985e74ddbd6ea7925a9323ed7dd99c19d17e9bc6517be2281e5c1b7c188452b674fc4f0a11830f3c7f87ffac41f1ed028

memory/4300-461-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4300-470-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\Program Files\7-Zip\Uninstall.exe

MD5 0583476c4c991ca0906d8b061f664bdf
SHA1 8279ce564926db9ef0e6853acffc7fd7d5aea98f
SHA256 6489911f018c619b15b0b2e8c0ff9c535f2c3177111106bfd94d37e73aa1271a
SHA512 cb8db5fc3a326c86518a899a8f72ba8d426a984c74f57244ab08b54340c6d92a5e5fb6ec8002f8b2c5f402a71f2e06e733f5396991440f13b71449e4927cb65f

C:\Program Files\7-Zip\7zG.exe

MD5 4e79019de1e3639623f76189fb088e89
SHA1 360133ed28e857089337e29e0e3f1c43939a6912
SHA256 9ee56b00b31f0d2ba4527c2edbc0513104a72807d09b15c7eb3ad0d4ceb1ba13
SHA512 bea9f50572c6fe654de8f8d5449259a4f63d9bb4f740e6f8025891ad47b6c5d80ee575a90e215a84c4740f3051e5b6f4e3adeac2ef8797729025e2b698a71a24

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 e5d49d54427379a830f4d241426863b6
SHA1 38d00998fa3ad1fe72e38efb9b69059b330e4d92
SHA256 c38e53d900a51df434f94ec41beea8fa732c60bd6d3d5a9766ee1a9de0867f5d
SHA512 5ae4a47c633c3b04d28d8e80d77f8e058997ddc8a069b384377e70a6da0189dc2b097cfdbd469d52346df9174fff9da31efeadc4d56f76723f3e556f6e7af5d8

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 1033c588624a667eda1ce38427b6314b
SHA1 243320ce0757a78736453e12634ca04ff2ee2a0e
SHA256 22acbe79ba0c245ef2b355188624ef1ceb63b11d460d248deffd2fd9ee738467
SHA512 98e9d5ad0d67b30fe561e1ce93aade476a718313e4007e7cf2e8c2a17215cbcd5250fee22efc50c983440118a86ac79fb76874f05abba4980cc441a087c964f3

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 3a4978210404d3bb6e9ffbcb8f1594d6
SHA1 f9139815231c08fde92cb03e2699f6cb524cbb08
SHA256 5de87d313fae08871a5fbfcc66c9a84034815df416a282a408ddf89399f40c88
SHA512 f687f1f12c265d784b36695782373ddb0a4e4dff19a777b43682c22d0a61552346a76710c35357d833ddac81c5f501c8d0cfa7c4e7ca0aeede9992c794c27efc

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 5386df448366fe7fc50e1197d6584b51
SHA1 6fc90cb22cf1ff0e440300f3e6268b694f866cad
SHA256 6bf029a6073f08af039b198b00e9397a204b0b22ec3302374f64dfeac4882525
SHA512 ae434e5ea5ad3d1d8ee10abfa96ba5f9ef2127b083f4fdb5dc92d485059dd5157bd2e999bb409f74efc2f6bde8620cd6b7ef663aa19973b44973ac2923125e93

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 7414f1827c9c3ab98576093763cfc391
SHA1 8c5a068938f81328a7e2694ce5472c8ad62a311b
SHA256 8924df9a43209e2bb3d27b809ead5896262a46d7fa17cfc724c405cbc2d83555
SHA512 167c8a24f77468aae3d99d94a535fb59d0aff0067c7c49142f451fdb8be87bea92cc6f6b27d9230979d6de015fba4b612a2d0bc701cb40901609599a1e477a70

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 4b63c9ef1619bc9740b4594081b813e7
SHA1 df294612a94005f8f1cd026ae61ce6dc0abf0d3b
SHA256 47d48d0453b5c12ad1175258c6997dbf0418c9eff1e4aafef3ee8f45ee725aba
SHA512 c9cc07704202ff8f52c5a431309dff2aa032fabc69f704876e7b074213dc8ade6e7336b0d17fe425130beef766ff212a0860a0a09e1239ff4a24723ee2d6bbe5

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 cc48f418837c87d181d332b83c15cc49
SHA1 e1ebe2d25d826297f42456aa6e841343be685c74
SHA256 42ca5c97af577024d26b2aa2195d349cc32f1d420879a47decfcd28edb289f30
SHA512 e1555e6266790d5901c1d9f40e86ff31d209da2be4d86a3f1cf756e91f213c323258501fbb3c34f40f18addab5e3ecc16bb558f72b3ecb6acab62b6b1ba7135a

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 04bd44b11a9456e82192da32b1613634
SHA1 2cda151b345d1db8724f38e665d9f2437c957d19
SHA256 dfeb4c89e8d6637e93767dff962cf8da4c0bf00d2907544654ea7d924265ae71
SHA512 78100ed8051a13d67f073eacc0818cd260f75431aeebd1a42cf97a74bd9765b970e5dd156910b57a3f436c915f2ea69815a6033ea3686763067e4b291cfdfea3

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 49f9da9d6cccf13efa879b93f9843ba8
SHA1 e62cd9aded8c10e1fc723f7cd8e2dbe0d36b85d3
SHA256 7932e89f4c61080c83e42f33e01d06221c105ee2bbfbe19dbe21b844a85646c1
SHA512 0688ab9702320bb050d0cd90aad05ae92c19339bcd78d64440e0ef94bb90679e599e9972f18e930e68c1106555fd67a0e589a7fd33e5b968c6e691e70045f49a

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 46e0f59825727900f7d612a596f4b067
SHA1 cc976b18335f57fa43b6ea9b0847cbf4a0074bc4
SHA256 95288d30b34815a5b24aaf173cd99d10c95f6d9a29d5aa5a4ebacdd8f69af896
SHA512 767ed7533c88c281f750b2859f281cd33b8a4c0b12d037f7531072cfc29b16a1fa3e411bdee4e42faf36b29a8f8d197a89de774ba822b04fed83f469486bf23c

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 730bc59cd71f3d960514904bada5f4b0
SHA1 3a58c1a6367d96592e1d046739fe03713969457c
SHA256 af332d8a8d71809157c17eded133cdff478c0ced2d64c392d2bc4bc0de067e40
SHA512 ca26e638666febff24b9c8d99ad4b9b2f9f96f3b8ddc047bf46b0c016e146832892a1903bca8334b409650c7c2244832ca11a6f3327dbe51b578650bedfcfa99

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 64379ac102d2deed2c63e95e24718adc
SHA1 7857e50dbd4a5ccd24233aa8537b4fda8635e4e6
SHA256 7d24c0645d9764cf1eb6e228158453ce8cb7cf4bf4aef97b34510f822659cfe5
SHA512 b200b8c747f67be524155262663bab1524c771d2dea088d89807bff564711f5baf4fc32cb03395a242fe3a500f95e1457f2ac12b716d2e13a4bd7da46feb508d

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 1c1d972ed11e479fa4da8a10f66ab99c
SHA1 5025147e0d560cb51314410a54f2f139bb7d5429
SHA256 5658818e50cee4db8968bc0ca66fe4131c2edf6724cc707a842197eb654f4820
SHA512 b5493865de65d9d787871c5e8980ef51d600868f63764ebcb5855c5b4967146eff788bc1e315afa7e9355756d9025b21b6866cf633938f4ba2bb8547113368e1

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 3b4953a4affd0c3570927b0a8adee859
SHA1 a805b91b82482d832dec698a8a9c5be533534585
SHA256 f8f0ebba7bccaed6a350622892e8f7153c7f8a090e7c4393fe5fbdace20bbfbf
SHA512 1ad88791ac9e34d8914b8b58fd7d08baf414705a72d5c570769045dec8fb75c6cd37124d0e7f5e98d166cc32dfefdc870ae0e59edfc68e29f94a829a49747f5b

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 a7443320b18bad05efd525b84e914218
SHA1 7269cc9db70c34174ca906eb6ba13f80a88695a5
SHA256 3d69b207811ab57542896245a8ae622c2189925f8feee73de027e5dca1da35bb
SHA512 7d7d1324c995c126b6d946532d60ddca84cfdca29d852b2476c728852ddd126f48af5ef7b40fa21c70368f1c81558b9fa258585080dcb525bbd64d4c63c96729

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 4ed3c2796984db8a06e13f5b96c77c70
SHA1 ff9a289a95b440f97c3b4f19d0d7573844eccb3e
SHA256 b7a305676850bdfedd7f700305527e0d234193e7cd9c111302f98bed1721e10d
SHA512 6429bf252729af9df2891dce0a3c4d56c9351ff84c086f4e8fb5af44fa6fbc4d1faf5569c7f03dfcdf078caaec9d86b9bcd50be34d9a47180ed89c965188245a

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 2e35e65eb81676ee0b7bf079c418c374
SHA1 c864bbc055cfcaf3e4f4b4604089cc31a71c643f
SHA256 77e8894843de47965f6183d87745d793ccabcfece77d4f316f3c893f56e50bb2
SHA512 782d0c9a0240e8a97b715601dcf267e191b2160981f60cdc95a181e39af4b812314d1bee3df4fcaf657db0aa90f112a9a3975f91028041d5874a3cc88101fbd2

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 a157ba29b3cad55541a0531c90e581e2
SHA1 d48ca671045804bb1b39e4bc4dc8fb996aa6d393
SHA256 2a32843064ed4a225e77a612de646a9661cf71a3309263e390df6a8152960707
SHA512 55dc82d4752541e80ea10675825e26988987b1cd10cd118c69ee95697db5ecb1fa54e5a5ebf8b92bd0a532cce528d415b2eea162f06457dd6c7b4af83af8e89a

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 01d2e1c3b022d854a0a84916d6c8fc57
SHA1 db1c5e19dd817f3768a0ec77c18b2bb5c9905fbe
SHA256 60c02b2d4015669ed2cbff7f69abc8d3d4da72a153057b4683816e877c7053ed
SHA512 8e3856108a9071507d9c7480e645c3e424cbd370ad816026fe43a23dcf85e3d05906cc8107d001050b92fadb298fda1114480b6fed361ce147d8a1a945978bb4

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 2226d60a140a44a2215c1fb2a6a993f1
SHA1 6494424cbd76e70b74ea71e0511bf602ed9b3991
SHA256 be2fcf33d563bf574af55c29cce57ea22aa6188270e03d15c131108a8305428d
SHA512 8165463e9c6f5274c224f4f22b18f59360aa1b1fd69229f9e7ef2693b9a3e666348ba52116fe972c22fcfabe1b8b2d1087874e3d73f54dc96d2dcad0b918487c

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 fcc06798e0f8088657524488d6f62574
SHA1 4a7261ba33526b3f37a1ccf2eed24469398da349
SHA256 f810ddc85048ebf1c346fb70a9a9b4b33ed623fb0bceae90a3b1983f6c617ea7
SHA512 4c5707ff772c9bb9e6e6bb88198869d0b84423da036f6aa1ebd703f6b87404cefe0fe7a4ff9288055b94bbfffb6c9632c5fe9cef5e6d781da399ed1b9fc560cc

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 526ad34002ce71579121831b8ecf37a3
SHA1 c059c066d7f8348d9280ab054c47052fa108e22e
SHA256 85015b02356d4b5af08a86e457e741fe616feb99961040c4c9131d17ebc63da9
SHA512 d688c0670a9ebf73c9ef3e983209b7e697f9cc728c0cadfc82b91de7e61e8c8395c060a9c7e12c245ae0804c9aea85918e7c580102c629eb3dd2b2d33f50f422

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 aba2014c6172342bf086f044c1ea6f17
SHA1 b80cca09c6a51f78ff7adb4b0795505e0971f1c0
SHA256 9bf354d3d873281e6f261803bb52dff04498277af3033e50123a7a601c67b904
SHA512 3fa0e558925430212790cf44803c0a6a9af5bffa3d0172ffc4442fa6ce70c755cb99fbf1bcca89554b831be1d4231ec7cca3977952089eeb65b5cd068ce192cf

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 fa5628e42ad51ca97c7e69a8b7556759
SHA1 68eedf19ee2898a1a1c859ae00f8184fb583aded
SHA256 600d116c081b12aad593230eec5db41d312300218272fb1b183bf129628d10c2
SHA512 c52b8d7ea85a2b6d1f47dee01bfdf632a5bec56286455cd762f82b24da353dad9cf565db1cf763d485fc24ffe711a9e81d51a8de1f36b94dd038414925a59534

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 a9f97f6ccbf95edcb0ad32cb3c54f456
SHA1 1c64ee7de8e128ab3a3b4f31abab0f9f4e8b2617
SHA256 66e6c81f6727857d1e397e5a8b2aca9b183766f13a1ac38d07c570df1cf574de
SHA512 f4436d6c7b07a4e11cb3ca929e3fa24d2b661d4b9b51ba130bc49b1cdc67d9fccec0e9429f4f26f7d6ca75431fa0ba31f6bb658bb22576894fb9ce616d53af3e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 22c94ba7486fabf4162bbccb3a44cdf0
SHA1 f55e99b32e0f638dc7ba72476a69b0865757847f
SHA256 886c11bfaa3135359e68fcee6b5fde823f15552ebc49bd12523399259dd0aa4d
SHA512 eda9aaced59d74a7620921bd20cbd667f945424b8f764d88b320ccc50e9c70f6123d1a637ea919ccb6fd0ad64af6f094c8152c90d06fd5b3e2cbac81f8b5b634

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 288c93bd6c0ed552c2b5ae43897ac234
SHA1 a9ca9a0062b2e7268b805b2b954126723404fe5a
SHA256 e7d32a5007ddfd5b05add9ec39dc8e6f9aa16a9d33b59c24ef97f7423d3f7406
SHA512 e831e8f0c8f058e69f2c04528b4a660287668f87a22b931f7e3f6d68cee13bfde36e39e07c81347c57e451cb5b6d4c95acb6d68dab4a2cdb5d103ad095954a6f

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 82430ec82d7ebff08d192cd9ac19b55f
SHA1 57a30c866216fce69ab6894ddb7742a130e5c2ca
SHA256 8a4f81a374e84782126d9e4aa55ec65d15914b0b4f39feb7e9d4f6ce3d8f760a
SHA512 497ec2a1097676549056cbe9bcae6e51791d395df83b4681fab8e5229baf291594e05cbc2c0707d59560afb13c53610162946a9a8ac8b54fc03cbf8ee14c3146

C:\Program Files\dotnet\dotnet.exe

MD5 67a301e591c4f2002007a785629693c8
SHA1 6ca96df87a93d1e12b41a1049ad2488ddc35e913
SHA256 f0f8c38522b4aaf08231dc18d9d62f0b6480947269db7a9c63525b56f3f766d2
SHA512 4da745ce7870d0763539b12d2b0b3216130bdb59fb1911a534ed6d30a61cf049c6d4a6cb65892f4e8d22911b59840b62f23a7018882a016067adbfa4743a9eef

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 2422338c81263a8b17e47b295950cb2a
SHA1 8bfa6d0922f6fa2e824d6eb2cf0c73e48485a4ec
SHA256 fb74f6d8cde8c5c236d5442de5f3bebe4490466e2d7f0131ae9235a2ffbd3492
SHA512 d627d07dd81c13f940638c5754f8b9ecde8d4a8d251b729e307826da098e787f7400b831fa313f3a62553a1b8aef34c7c063635e17c3a3832a8313d74b97ec4c

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 3fc4e571a400a04f1635a51a1addc59d
SHA1 49d40dc99385d9ac5ac65d7cb0546083ca25865d
SHA256 ceb9d43afbf819ed14ed36ca43ecab352ff5a6ea96d4eca9e910c241ccbbfe34
SHA512 a681248693e3f76d8725cadf6785823380c4d3abc4d0a9aa03aa23a46caef5609e3bf9b232fea61faf075006e8db5e27288176c430d9a805fb00f4063cc28986

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 1fa34491bbb3bdf8981a08529c03efe6
SHA1 8e5ec7cc7bbf56cfba617c92f52fb82f90777b3b
SHA256 0e6a6b3cef1258f68a0784944b55e0a47a58c8c735f0f0e09de8e61b9174b861
SHA512 3aa62b8296b066ac65ee5d960af66407be98fa08e490c584f5798c02a008150952677eff429f4762e793c797df57eb11c04c2d5390a2e7e6047b0f99f07bd3dc

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 0a8837a8fe7ef5f2c449250aa9a632b6
SHA1 91da4f68b1f15b299b5197ff6963faedda8d3744
SHA256 5eed4eccf45400118ceaee2b6d456a7a5f70fa51e0af7ff861684c9bc81ebc28
SHA512 18d41af02db4ebf569e6bee9dad3cb3a2c72780eb9170c008c3f3e65d7fdd90ebb4e3dcc5354305dae29e0917a38b7c4973a27a3159d27da549e476337822af0

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 1a5f82343b70c01c0e4bbc450c5523d4
SHA1 0ada643ef79e2f969d3f4a65bd2c3f92ec0d2ea8
SHA256 15d10a87c0fd77569fd5b4d74f87cf8e77f044d2a5cbc590b466a65872773684
SHA512 d2e88f6b5a7b85206e36ad0d1247071b22a938674af546aa8beb8d25b29d875f6233950665bec0b4b6e9e160c6180f883bf29bd1d63b343bf221916850c93539

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 7b15162dd8988eb627d2bdbbd5db8854
SHA1 9ff6c07de75a9544a1b1f2d1e79470228b9f217f
SHA256 1fc035513aacaf2278b2b7962eafa4f2656e8689725e9c615a4bb372e17ebfaf
SHA512 64d5260727e6a133f95348d6067ed4e1b94e53a02397cca254924c7a7ea893009b927c7ff60a2908c34e436c04d0408af4d17d2fc0923c6f62ec8ebbc057b11e

C:\Program Files\7-Zip\7zFM.exe

MD5 83e7cfaf0aa3963fdc83270768e94d31
SHA1 1bc3895ec2cb190309c29a1654de1d907a6d3cc7
SHA256 7ec39b18c00a99bff85ff80021de5b5d2ccb7b2a1fa470e119b9c40d49b9247d
SHA512 861cf2644e6e00e2cff9eabd0eb39930d8481f40ca761a308e0587a8799e45c12668da163d4ad28980c375eafce4243c54f7358e7e4048f210cab18a4b47b88f

C:\Program Files\7-Zip\7z.exe

MD5 db69016900c5b69d74e9327d963639c2
SHA1 d582d69a486d967674754c034f0ba3f74920d109
SHA256 d70a633936aeeae1ad0c218c22d0aa05f5202b73bab814c7512ff1c79aaa1697
SHA512 c3df7555ff4932f3f280ab4d3e2ad0e321d25992fbc50b3c3c035c4ee03811cdfbdb7e122e281feb6ce127dc7640502687a8bd54368746f02eae78fb93344b20

C:\odt\office2016setup.exe

MD5 f87877e535c2069a50c2ecaea0b801dc
SHA1 51c91d01fe51f84cc7724b9ecd9bb39fcb0d5499
SHA256 42d63bf5ce01274dc4afd83499e6714b0d1cb6c3033270615685f4203fc6d02a
SHA512 885e509d928b55fd749cb2fffe378fbc32c717049ccf2b39156e131244ad8635a1e079c536e44d1012368f3034f9ba6f5d07b5ab849038322b9656c813c2fe51

memory/2204-547-0x0000000140000000-0x00000001401D7000-memory.dmp