Malware Analysis Report

2025-06-15 19:50

Sample ID 240406-fp7f8abd2z
Target da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a
SHA256 da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a

Threat Level: Shows suspicious behavior

The file da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: LoadsDriver

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 05:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 05:03

Reported

2024-04-06 05:06

Platform

win7-20240221-en

Max time kernel

122s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe

"C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe"

Network

N/A

Files

memory/928-0-0x0000000140000000-0x0000000140237000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 05:03

Reported

2024-04-06 05:06

Platform

win10v2004-20231215-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\22e4d4c8ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005915e608e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e2e7d08e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e7e6c08e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dce3c08e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000357f4d08e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046944108e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ad82809e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7cb7a08e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4227509e087da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe

"C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe

"C:\Users\Admin\AppData\Local\Temp\da0a557701c6e26bb880ae32cf6e7eb68ebe22a1c37aa5894c32a9a79a73582a.exe" uninstall

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 138.136.73.23.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp

Files

memory/1896-0-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1896-1-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/1896-7-0x00000000020D0000-0x0000000002130000-memory.dmp

C:\Windows\System32\alg.exe

MD5 bed42e799857e4ff9e2578467ee24568
SHA1 e62cca00853b2930da795ab92f09072bf7dd060e
SHA256 e249f9585572cd2f77f92288daa0185434ba842c69fe1e78fc461e4dec63853c
SHA512 6d175530d5975dce17e991b0b591a06d9c7dbed1ea9ac51363af26a9cadad3b092937362cea767ef58afa0180955855fb227b9ecf4b9a9cba8037ce7f93fbc32

memory/3952-13-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/3952-12-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/1896-15-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/4344-17-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1896-19-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3952-24-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/3952-23-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 9ec1574ab5b8a22dc2348e60707b09fb
SHA1 ade57c56b99fd380fc631b4de31ef02f78c1512d
SHA256 5c1c1911c71b9e53eba82584f0af70048e6742a8c10efaf44e05a5a16f23a74c
SHA512 d958bf45a9101816a92e7c306049c46f96e3b6d86a8d0785d5303d8f6cf21b955c5a814f7bbde1ccf3f3c899e2ca3d9e68e753bb604998fedd1d3ef44ad77474

memory/2752-30-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2752-32-0x00000000008A0000-0x0000000000900000-memory.dmp

memory/4344-29-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/4344-42-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/2752-45-0x00000000008A0000-0x0000000000900000-memory.dmp

memory/4344-48-0x0000000000840000-0x00000000008A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\22e4d4c8ed1090.bin

MD5 edf839846070a8f13d111d3970cceb35
SHA1 1540b87dd420ce3a3ad6474477f675fb4cc8f1e9
SHA256 ac162600fd1336d31c545209a6e043cb4aa9a93502ec7f6f1ae3390f57cf637c
SHA512 5bc9313cc96ac688e69b4724249e6ddf94f90246fdb0a0c2cfefa6a27377dd321a887e6025eaed791d083820918b1ac12a8252aace0d96b67465bcae84cfaa3d

memory/4344-50-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 2bc4e83e41ea100e7b705a43c8a20e3d
SHA1 0e9683c1d33cd53b5395fada5877857e4beeaa76
SHA256 f4fcf06423a5fccfae907bff4f7d34def56f8cc0b0023f344984f2354cd2dc44
SHA512 11f1a5ed75f1e76de877cc1d0ef474b8709e4d3503d0279c3e69c783a84841165dae66cc07fe50efba438e5c90ae41015037e934a0420297ad9b0a86c49825ae

memory/3552-53-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3552-54-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3552-60-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 55e9821d9751082cdb3e2fdba02e67bc
SHA1 bac83d2be0829efc397f050f6e773815169ac3d7
SHA256 72746fa02e154b02b31ac1f62ecdd2db47a7376ab20022bcc9da4007433ded83
SHA512 8ae20fef99dc318051c9fc991ff7bc232550fd4cc290e631ce3a273c13479b0b8a6a5a9747f6ab38918bb16e03c6e1007f39269064e54757a176cac0011988f9

memory/1580-65-0x0000000140000000-0x0000000140211000-memory.dmp

memory/1580-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1580-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1580-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1580-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 d32482136c42e05584d0074f35005c1e
SHA1 26154d1ce71954ccd4035478474c12426c349d09
SHA256 a4ed182034cf6a4c592c7ef203c023988a9934a4875dae10d1b32ce4de4e5a91
SHA512 3c6e1481491cfeb4a61ebc5b90a6b8e0180639bc103c499f55b36bd7bb5c2da1225471d2d2d728f454f9dbcd9637cb6f53544d4b3b288b94925d3494ffeeface

memory/1580-81-0x0000000140000000-0x0000000140211000-memory.dmp

memory/3240-83-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3240-80-0x0000000000420000-0x0000000000480000-memory.dmp

memory/3952-79-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/3240-88-0x0000000000420000-0x0000000000480000-memory.dmp

memory/2752-249-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3552-250-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3240-253-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 56ba5d259aa35d4d638f9f0c872fcf88
SHA1 9053e0080430af2c1f6ad941c6d48955e92cf24b
SHA256 9f5a78f79169ddada7d1a6face7dca2bd9a3bbbc31de0eb46b8a35be4c1e45f0
SHA512 17c314b1212b31af62edc0cdb8a49a59a8f2929210e1b2bb9bf96001beb6a457a5755d0de6a83bda47d5145ae71c87c0fa661a2de8a98e02986d7787f6abad34

memory/2196-258-0x0000000140000000-0x00000001401F0000-memory.dmp

memory/2196-266-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 f189b014ff223641a36ffc8537b27982
SHA1 68845e7e886860d8e50e2a1a34b1e72ca4f55fc3
SHA256 5d340ff8dce48922a69bf3f244eb6c17968bbc4561cc25d4f10352b07f60af54
SHA512 135d38b0d87975c229a40350f947ca4ad2dfff1832b36931efdc0d4a98b4c67d04254cda40d8a06905884446f28b148056bc40a14c83339ecf11bea742a9c1f2

memory/4468-270-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4468-280-0x0000000000DB0000-0x0000000000E10000-memory.dmp

memory/4468-284-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4468-285-0x0000000000DB0000-0x0000000000E10000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 59070d47fb3c0314926a5d016bd0f716
SHA1 6557ef0b6b4addfc0af1ed304328bfead1eb0261
SHA256 f74e403cf2487fb61908af879248ecee97cd34d3cdf39f1dd49c79f4d70587da
SHA512 9e3aceb26051e4cd080d483c548ba5c53a291959f19692f8712e50a2ee1089d3d3e380332ebf8a60d41566bf28c9331efe316d4253917e8d27311814209226e4

memory/2644-287-0x0000000140000000-0x0000000140200000-memory.dmp

memory/2644-296-0x0000000000D60000-0x0000000000DC0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 5205c7b97f2e5654ddc205b53f7a4613
SHA1 b024945348344de1d2517b58f3775286ea2d45fb
SHA256 08cb15c96aa0bb597035b1f0b086952bcc91fbdbde0e66d2cfdf36e8a82b55cc
SHA512 045c17a07edb27a000d50b531997ea5bdf57495802e3baecf9c3db5cbc3276c9febebd8695b3c2bd32ad6202b7adbd7154b63b11edb29d67f13cd5d87a9a357b

memory/3036-304-0x0000000140000000-0x00000001401F2000-memory.dmp

memory/3036-311-0x0000000000BF0000-0x0000000000C50000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 7fc228eb36a7d4d4627843c212b788de
SHA1 dbd58dd2c9ab5580da4d407356e51f7d6ea2458d
SHA256 2691371128f6eab47e2d34fd9f1b80ce1385ebce876ba22356de1a294737bd6b
SHA512 bb087bd990749717e9358ccaadd1e90127b1d39d1319d8094941d71b0032375d0cfb0af73238517a35a4e489886f710ccfd86a5d031bf9cb2521011a823c8260

memory/1896-315-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/1896-322-0x00000000007F0000-0x0000000000856000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 3e15d38c3a85ccd61750e077c7c8949d
SHA1 2d1af5b03ddf30c85358939dd1650ee08e3566ff
SHA256 a5df40b4831f6bd4d95d2b1a593869d5a97fd2f22ce088deea9616c47e993da5
SHA512 a72bd3d5572e90bcb378a454d6fcdee0559565f9c1fb23ae3d94a121fbfa9982db97d97331d89cd507457ffc3cb2df7f0d70c8dfe088134f0128ff9c8270e55e

memory/2196-326-0x0000000140000000-0x00000001401F0000-memory.dmp

memory/1184-329-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/1184-336-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 4c910ac5a33126d4f5ccf8ea8c6a454e
SHA1 7f8ff480792be36922d15d1a2140b4305548b0df
SHA256 9cdb8df5f8142b904ed1a9c238e8fed46e35701784de91039bd9875e315e1dfb
SHA512 526b3f08adc1dfe8b803fa4935eab350956425b17e3b69a69e2a72aacc9d5532fd8b9f9dacd2a05f162133e5bb79ef75f4de65688a44751a12e22e7759a9d9e9

memory/1736-340-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1736-348-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 7c3e37ab3443570cab2a6c7b8d7553f5
SHA1 185a1d41d9e19f2852e400eec13e6c61c533bd8d
SHA256 1b2d9142c322bc0bd049fe595857a023f81dddbd49b4e47bf79f4a03830ea50c
SHA512 7ecc402e67d864a2c20df701790b032a4414097edd75e5abac7f5c675b386147a0e19f47efdf4ddd58461b6ff3fcc47999ad3ac8cca7bdc7a33a258080435bec

memory/2644-353-0x0000000140000000-0x0000000140200000-memory.dmp

memory/2820-355-0x0000000140000000-0x00000001401DD000-memory.dmp

memory/2820-361-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 d312d376f0e0da8872d7fc3c46cbdbd2
SHA1 c10b0b5520630ca1b4ed3010cf63d9614ead339d
SHA256 dc00b1dfd0a9a02eb40812030067101c10d8caf8d78fc64738b299adae426b66
SHA512 e91dab068f8c731257b4310c5f3644bba827ec602192ba527817798f80ad2f2c11e89088190e0402a91304cfe0b204c82852ef828ce4e383352fc392296d25f5

memory/3036-365-0x0000000140000000-0x00000001401F2000-memory.dmp

memory/4656-368-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4656-374-0x00000000004E0000-0x0000000000540000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 23968aef104b735bdd523527f3026127
SHA1 18fa5d910d4240f58c4129ff12eeab2d8dadebbe
SHA256 4b4e1241b98ce4f3b58b477902c8946bbd66eb66904982fc2a260f8c61a192d2
SHA512 b752541fa8986305cb5b872ba97288b687723e3d973afbdc26fddecf3c9636681e3f9af8073ed121ef811a5c007fe4daaad080619ae0eb8477df1b4a8741e288

memory/1896-379-0x0000000000400000-0x00000000005DE000-memory.dmp

memory/4456-382-0x0000000140000000-0x0000000140249000-memory.dmp

memory/4456-390-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 652f8ec7804482394efe053aa0271717
SHA1 ec2d10fe9dccb8e678585e8c8e31b12e1017cd4e
SHA256 eedc442492f33ae18aa495040a5eb39a35fe5bc4723aa445c85b8c0fa944c2f7
SHA512 9dd1a115913b8990cca9f7489d10ae6eb658a1d15645d9ce6c4506d63491492be1fb9acc937d40ffb68be7a4dba7dd10aebddb0d7e4ca30afbe47d89874570a6

memory/1184-393-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/2664-397-0x0000000140000000-0x0000000140229000-memory.dmp

memory/2664-402-0x00000000007F0000-0x0000000000850000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 51b9c978019817ad5842a9693efd34b4
SHA1 5f57abbbbe25981495c6e9295681dba7b1f282d2
SHA256 a767a08e6675fba03315ea75c820d6913ea37b89869390ba5ae20f8fdadf7c65
SHA512 4d4d1a0fd85079ca76a8560860886dcf204fb3161d8ef2ac0199a008a18f8fa50fdbdf1890f849369126f049a3fcba0c22b85b3446cefea09f856c4bfb3bfa4b

memory/1736-405-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3636-407-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3636-415-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/3636-419-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3636-420-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f16d67e4d3454c76787906f4b5073a9d
SHA1 6ebe607c37172026c9f5c221457b52129b41d848
SHA256 352202dd4a82bd3462d9cfc4afdda2191c891ba5bd2e005c63515becd313b8e5
SHA512 e8cb46f04af3295bbd377f9f6a5785a6f626d071a11b82ec045618e26655cb0a15bf73c14b21b6e2ed3d31ac11db2a8e07244819f29074cf5d25dc61abb5e362

memory/2820-422-0x0000000140000000-0x00000001401DD000-memory.dmp

memory/4240-425-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4240-431-0x0000000000C50000-0x0000000000CB0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 535b28c47ff1a4b74f2876735345fd89
SHA1 e11381f8b94c22549f80533ce3c787d16a2408ec
SHA256 20af113ca20093ddeb35e7dc2b7466ccdd386ffe3c38ae3e5b176761f33f28e1
SHA512 f3bc30c35b110cc44c06fc8c4bec0ca8cca5f4d1e5d98625241a9936c6ee72fc86bd50845a018044e6fadecbb4c2dc7f7d0fda8d19adda9e5b30c9b92e8cae79

memory/4656-435-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3948-436-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3948-445-0x0000000000770000-0x00000000007D0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 9cdfd614217d39be18874169e4c66c16
SHA1 84f4e479dffd9d989dba5d5c7cdc1e418bd9b94a
SHA256 0f9ab8bd75bd82bd415e2d2d507dd6875eea0f50f3a1f910e833b527301e90d6
SHA512 9cf7b2ace97049fe05085a84decda5444e878652d7bcdb88b77038302609689b65f01b3b8ac25417a6e4116210c2bfce58fc63f8f2037cb99375ae727e6233b4

memory/4456-448-0x0000000140000000-0x0000000140249000-memory.dmp

memory/4332-450-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4332-459-0x0000000000C60000-0x0000000000CC0000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 de2796be5e7acec3278448594e4d77c9
SHA1 f8574f8a8694130aec280eba287f537d0d636a37
SHA256 dc48b02cfd8f059ea58dfb03878e489794956d2cfb8db6fa523ee5fd76aee00f
SHA512 94c940ed2929169696a6252f62fbbf31444a37b9e9477ba2e4b81847c6ff3843c3eb76a759c8ce433b9ca3e5ffe2028ebd58241cf644061d1f8ee0a8c217a30e

memory/2664-462-0x0000000140000000-0x0000000140229000-memory.dmp

memory/3112-464-0x0000000140000000-0x000000014020D000-memory.dmp

memory/3112-470-0x0000000000670000-0x00000000006D0000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 4f63f016948ea15bd0719ab85bd47206
SHA1 1a98e8755b8bd842beb0b6e19f5a53e642d79e44
SHA256 64cb41283038188800dd7bd18bc974543ad8554b3e9fdf76aad8429ad45f035d
SHA512 1a76a23e5df41ac5747bbdea1da8e8cb10419f78c9d7af0bee28bdab121b6e417d404d5dd10f3ee9f3f7bdfc917612611231f723d605b342037a0e2808e3338f

memory/3024-475-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 ee9b5c4fdf3e81480626c84c48156aa1
SHA1 c5d184fe3fd4ad29f1c58e94bd99dd071cc76992
SHA256 78bdfabe346c90fc788a3669a2d462ab7c6805f98a4668ebbd284483b9a1b497
SHA512 a4f9a6ce3ccffef21f7e2f7dcb9d73279b528394a1d7a794ca1b02bbe04901eb98cd12b173203444f285509bfc9cff20cf694aa09e29c8f6138e60a51b53e822

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 a60aaf4d6ce2b9ed9ced230c1b05e5d9
SHA1 c5ee051c3f401220b2b384ef992243c6aa1e77dc
SHA256 4dc8eb6f26aea20ffe03796614e3a0382437888d4787d22d33034e6905bb015f
SHA512 2aa29ddbe8096f6cef94a4d4d16a431acfc33f96bda7307a162249f740594a32df53e6deaf9a053896d767387b332dfec3dcb3ee5d7160d77116e1cf2dc8aeff

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 d8216a1301f92e173db54e36803eb384
SHA1 5d8818763a2e24df360186543fda7ce75c22769d
SHA256 bcbc0b1a4a87105e44b9ad629d5fc7ef3cb9c6a9a5661f18597e56f1f6bddc33
SHA512 defb906c6d7fbd529308c0fe8ab488d863fdf679f3d27be713e05dbcfc9f4ff0c25866f046cf6a8996048dbcfd50c9f98aae0e3e1e3acb4a17dc08a485630d67

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 3e8f6b8621f79c53f66a27dc70925011
SHA1 9816325ef90bc6b653ac00d6283c265b05b10976
SHA256 d18324b0d915951e98b12bb85a332dd9befd382129d21a0d9ebd80283345c52a
SHA512 923b04c956b19db7803e6b57eb09f7fd3769773c211acf452146dc23e3b9803fce50450821f4b19275bc8247ae76062b357ccc10c13de7fa11e9740c20cf4e69

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 4af32642199884a7c7e90f0808f59d3e
SHA1 2481cb16b9fe57517dafbcd7ada515c6ee0492c3
SHA256 2c4427a50176d2bb65d1bc5ba905534a37f5d5dd4ce78997c275643d6d19f881
SHA512 c0c8a99a4dc6cc25b6de0e71aaf566be156a95229f13f5e49d3965c381af4926682a2b22ba894f0b50ef5084a9819fe8a1eb923665ca7993703931fa203bd505

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 90ada1a3b2a6e6694f25e4b1e64fcf02
SHA1 f5e2f009df6442a4ce0aa317b9a8020e519b44dd
SHA256 b972204132a2f78eaadf8f5d42c882fc339a612fc5f005b2b86b9a46c439bbeb
SHA512 f2b680f35c9d9e0d4288a4b5f6e77091cbacfe79bca818ff0baa1823997df82c8139a150cec071ca735fa8eb21e53aeef7d8c0935a17d5ba83fdd44dfbed0b15

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 293c2d00454c01eb9477924ca75957ed
SHA1 5b5e75b88fbdea3714697235c19489c4730c19fe
SHA256 33941f2a0779f83c54803758e87ecff33075d366b2116c3694dbc747862ed0d1
SHA512 7d86b9f219917be00586d7dfd14a374b6ab78993d65dee39f97528a2ad55b43da2ad58f5f7ac7d38f8507d7a4ab068a3e4786dd9d2b44c88d5870bc9dbb601e4

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 d56083c9e9f76c57034664c75f07373f
SHA1 b3a80363636f780cf8199f49379747208208c588
SHA256 55c8aef74f2f32899e08d6ce6ea01352feb0107aff3bc9bdb0516df444d63db5
SHA512 853b59c4604f3a19fde8e0623376c2fb7b540eddb725af9b1889924e8afb83b355b1804e90bb180d69b73aea2d1e6596656f245a3995d1b0fb79ae30fe4c89a4

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 eaf4a4b142d21e9624d7456ea3908bb0
SHA1 fbb3feaed2393877bc874ae2e652da950745be4e
SHA256 a347c981576feff5d892df4f1b37d6d033713eab59e365ba3d73cf0a8374e6fb
SHA512 1a199042d3c8eceab6842f7f50d9ff4f03b52e0c09958e02cf1c40b1baec67e32ca36b4eec365228ca196e3b706304a5f9536e9ccab4cd478dca5ed540d9fb44

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 158f7115c7b1ac16b9bf0c8a874241f0
SHA1 e10b46cdb6658ef1bfe8d07ba5003e20416f760e
SHA256 153a8c77a2027020f2378209e5c18894e04863c9f51ed708d6068adfa1277b2c
SHA512 562b7726b6982a2baa59b19a7d66703cf614601cf664c55ed043c39882ad7f86a641b677b5a8ff7f73a09a3b3a0c7cb96799cec43b6501c0bc6006a6f2555ae6

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 0af2ec7f4086657ef0a2cada3701e9a1
SHA1 6e06fb19ca97245a3aef1894f55334583e4469de
SHA256 471a02bb2984f8cc950c662a93a422c00268d4ae5dede1f8d520ae4b487ee0e2
SHA512 ce9a6acc13f7649b3533732588f566acba70d2de665cdf927f4bcd7d38e2c4adca49f557ef284cdbbcd72f96a8d5f2a689109cf6b5c1dcee8166c8477eb9ad5a

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 7c7d03bb03e48eab271b5f6ecdac7c1f
SHA1 bbeebfde1961884667262051e9447bd10720abaf
SHA256 385c3167f1d35d9f231259e6f310a1dfac138f91fcff1301a66c8781c11bbaee
SHA512 535176fc007bb5ceb968e1c538ca97c7246d30325ba69974dea9ea82dd04f92c263d342a344f1d9f6b5825bfb6704e68f77b89be91efa245fdb93b264e346d42

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 c19edc6cc9cfacff5f2dcb5a9e2627e6
SHA1 15faaa0e3ae5dfd9ed82d65d22797a853d4a9d7a
SHA256 c4cf525becbadf39a91ec626c744d210c91f6a747edf5c0df5bcf9c79382c0c7
SHA512 25a6e2567293532cc787bb1b30361d77961a1cfd2bf997ae8845b1ce444798b76f1e3f11731c4ccf1180f59f472a346a2d34f19594c1a64f70da2fd3b4bb7cd7

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 1e1b2d0589f9e9fb5b1184e2eb519b81
SHA1 ab6fb5f41511134221e1a14a282e6bbfc2870b98
SHA256 beb50dd17c774d4b8a19476ff32c8754f4fafb078dacdb750d5cf41876c762ce
SHA512 c9ae51868f9949f226198a4201d9c6025e16016f0c333a7c00c339478ac24a26156bb6f9096a3cf53a0ea8a666114484feec5d79cdff63e0dde0f2f87585d6e8

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 1fc004cae4fe48d402b6e7b483bc73dd
SHA1 7c5162627688eeb77a1751a0572ab18699d12beb
SHA256 8c96080afad9177a856d359878f32286c4dea36128a23f7bc59a2319d3b4ff78
SHA512 0b4c1c4e79d53fa18d63c47b18a33792c96fd30438ac86537b71eb788bcf6a8b89a547c0fa8e8abb83a137a511a835ee9081c769d3a9fd95739ce329bc3d5aa9

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 9c1dac24eee7b0367131a9d6f7b61332
SHA1 65ce4932c4fe644aeec166323679d6880e16b549
SHA256 7695d7150d95092f075208622924fdda47ad223bdffe7a23ea663cf7cf2fe60d
SHA512 e4c8df9631f03f42da321335333e071f7710e46b21f02b808453d73f6902fff3de08b4099581ae1cd1bc96bd603fe565fbc10c375963ea5ddbd18d5b382e07ae

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 c4bac1ee258d57feed3b190c208f34ac
SHA1 283aa3bac71879921632e01e8eaeab3965a2feaa
SHA256 155c2dd60e3176c6c479b3e46d4d000626b6251f9f5c062571770bcb4d586d80
SHA512 390a4afac998a71ce52f5b8af6301ca68c3eb7bc107a61c1d6cb19c45cbfbe25896ea44a0521a4f1f038fbc4068da777ba7d3ee8882fc362ef75b9664efa92c5

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 827f14108970930b7bbd3f00b5486eba
SHA1 63e0b219b0d40c424af1a0dbec25b3f0812e8e7c
SHA256 0572f21394f5b9923943c80e2d4f0f790cb11e006dc2b7570068429734212365
SHA512 e2598a347c1d265e87d4be529d0520a260ed0013a55559637ac41ab00b62f18ddfad754c077c0de2d8d16edb0eeade37b512c4ee5aed06e6909c0ed781f65be5

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 3b8fbd5a9a840db58b427910558917d4
SHA1 b879607f925a580723311dbaa65ac1fd8a07260c
SHA256 a6d3cb426a263244d6c330a1f489732d5b4df6de6ddf44ae9f1d0b9890fddabd
SHA512 5745a4fc1809198989b652daddf8801245011ceb7e2a043429ef244c12c46af1e8dc540d0812b588c7d2cd765040216fb76c13f30721c4d7b0cdcd7ddbc6dd2f

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 3d63827d25a16dfbb1037bba853eb2c4
SHA1 fa71972192696a1fdba76de1616f873054447982
SHA256 d58e9eb705bac055deeca3f1a631451a9f6898bbe29642895fba24e311add2bc
SHA512 4ecc93edb10391c74218ebe9de011681a7f03e7aa00b6d853bb0e9cd96170f3ab46486064271cf470d5388833de6a918884e6a8b0ba93c43e5284a3ef900df91

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 a7a602282189071f8ebc9ca78a127fcd
SHA1 47e6ed5720748cddcdad000f2119bd695ffba0dc
SHA256 992c8248ed1f10f65c2c64e79b160de0a5fb4a82c92ae335924273c0ab5615cf
SHA512 b0141b2d08f960a60c2ff3ced2c4654c52d6b128ab53127ce727ecb811b320429ff8ed86f739749b6a3018ed21f6b3696b93070f6f2fac9ffa87a21d961316c7

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 746cd12867e067f0766ebae3c07707bd
SHA1 b9e806615b1b7b37fd57eef108ffad969f851688
SHA256 c43002b014ea659b41fb25b1de77898482057380eebe8251dd8c38069a384ede
SHA512 ef5110e11babc003ac174c19f9d8adcecbd835e267e87043fb8a910eea5eba6a86f68cc93dcc8c610c4cf3ddf8dac451d947581e5deb08f6a8b9a632fa5f6313

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 517089b95c291bf6f33fc83709a4554a
SHA1 7248b4b5a03786005f264c4ef77c387964817e7f
SHA256 beba5cc59ea968364caf597d3475ad967f2b8a716a5c167ded2edb15d409535e
SHA512 ccbc4eed331f0acb758c762d163b5aacbf2f68948ccf2c7f99ab211fe5ff793a6adaf965f4560a7ef33359036dcad8f9f1bed79d7fe995d88c4357a37542ccca

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 26b235177775b07b6ce59343f6965799
SHA1 f91e0a45d6c5907666df590ff8e87d00458abefe
SHA256 81b8bcd3df320a833999aff226e79f0aafa1f020e20d00b4daeb68ab982e3ed3
SHA512 345de9a77326fabc44283de8709be05a73a9a073c944301a6f9d3930da7f2f9a62f31eac4994790d6c99363001d9df9878c7503bc0edbed1412f4c00b2eeca09

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 c73791f554e46f7a657b764a3146dae0
SHA1 a6085e1fdec3b011bb97574db76bda69cd32b05c
SHA256 c2c61f1030c663ed3437f33a0aba235d302a6c5973dc8d31f734aa8b96edf53a
SHA512 298abbc7e85aff4735a363da4349abe0bf4da37de2dacfd53c86abe03b348fad9a391b17070ab5324148d4da820f0f6df9b1176533443a335c4980315d41c6e9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 6a6086758d72888a8cefcee51ee472f5
SHA1 cdfb4b38cca359ec85b2b6571a43e25718d804ca
SHA256 f5ae179dd30abab0d13b27c45d6e7ed40f506ac2f93af1e31312ac951f26bd59
SHA512 f5130d4d24c60c46ce4bea5e86f0b9345659119d232aac976b405694170132960efb246a584ceab4e4c84c75af27f6dec9ba0fbc84c55e8ac380ffc7f91731a5

C:\Program Files\dotnet\dotnet.exe

MD5 c9943446f23e3e55ced2d9c2e81e52aa
SHA1 42cba4e051919eee74a3d6bdfc1ad67498efcd55
SHA256 713bd6047c5445e7f6e8a3af983bdf226b7ddc288ce13b7bbfa7ceb9ee545fdb
SHA512 5afff76f12c3ddf38faedc5802d8805b990cfe887f3b666da37b676cdf9ea7b293e71901d24e40568b7f87e032a3e5016c29f541a7780eae4bb94470e724eebd

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 c1a58a862bc2431ec0762b1183b88a30
SHA1 398b01d355869bf46ce3c2a59cfec6b3804e0da7
SHA256 a41ce266790e4b698b2b79e49b3f9866d5a70ff8c17339d8fe3487552c4a8e73
SHA512 a095d29be069c67390314202d56b65a381b14189b094f260f6da8f08b580cff23f30126cb7773e9eee0a825213ecb49e81e83b764cd58d7289fc775accef1f28

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 be049b46b8a18ac15f5a15c92fdef91a
SHA1 108a9496ca3f0c4e75faba353397b27c03a1d930
SHA256 c12dbc0c157cfc4b50ab6546e4f23c07cd9bbeeaed660c31f50d73593e4aefae
SHA512 1438eb29f972390b015659164ba5fea88e5435434cb4828ca071ebd217568063effdb0a088ba5c9c1ce5832a1823a0c987dfd4cb5d28960896631a3c6607b9fd

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 0829d40ac3ea71cc7f183acb3d721054
SHA1 dd2bf48ba99d1a04a4137a5cca01f5444a751e0b
SHA256 86ab167598994bfc309264d12b194555d2492b14db3995e6c595261eabb130c7
SHA512 6d05ba7bb16c2990e8c6ff8e160dcb7d123b218ca1bb8838b536bf7fe2aed2717ce6a3b7421aa4ed508453f6019b258db5c014b816eb7fc3c0c4de000f7074ae

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 cc23624c6e2e2e977c41e7919c9a91a9
SHA1 a71b55d62f56b10ab2cc3970d7143539c87c07c2
SHA256 22da4fa6f48941defcdf4410ba5b2b4dee594b4ec2d6ba4f1f9110b7b0bae785
SHA512 71df77ebb9c01d1e5c1afdb32510796e0803210131b3392f9013607ebad16dfd190ca8a8a52e1210a686fc05c530609269fdd344e1a38928831798120cd074e1

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 77a5c479b1aee4c5ff50151819da44ba
SHA1 bfffccdac64ee24eeda98f7a3b89ccf3629b4b27
SHA256 43457f0badbe505c479b1f56aa33f3f596e7d1bc054873a5d17641e4cfa1e9e0
SHA512 d0e89a38688d33b7ca626a90aa7e00a8a0045e31cb9d9d9a9d0870a344a7ae83e8a517e444b1a356755102384f7c89f491e43ccddb037b0c560d125218b324ac

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 c16b93516881af208e89bdd35e6027b2
SHA1 c61331504c78f663e746d3ca5f8f1f17cc86e409
SHA256 117fd483f49259e847c1b7f0f0ca3961ba6d8d09ff7662849fbae76d322ded05
SHA512 879f57bac96d45102ce222bd3026a5e1bced4521e676073d7fc3aa0eab2256c84ea350507876230fa3aa3a941a45bfe4272c2a663a10b525898b7d3aa7092513

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 644d50052e7b6d4a1da4b33d538cf875
SHA1 560f12bb6c781c3a53e971bf6cc58f66ef65b43f
SHA256 ba0dd577a6f184c7f73bdd5c1c8aa14e02181caafbf66489689c88b345b2a84b
SHA512 06543710034ffbec4b60b1f5c76538feb85801145a76d97f9b4d1753117024c76bc7401b9afb3455076c685fb1188ebe7f25d09bdf84a369ab163841b0bae856

C:\Program Files\7-Zip\Uninstall.exe

MD5 2058b68c5e68768f9db7c30ce060fa01
SHA1 af93995252b7ea8cd0908792ff47bf185c9f56c2
SHA256 c4fdea7db0a2f673f088a84deef87f5813caa21023ebc5c5755406c57b93e669
SHA512 ecf29abc64168ef59d2c980055fed6fc68862d5e40cf3a02ab6e443ce8c62599afe2b7e209ceaadcc9a32d81b9b1f3bbcef0ee044d37da824f9aa071997efe86

C:\Program Files\7-Zip\7zG.exe

MD5 823792aef60ce5efbd64375faca2eb65
SHA1 be42caff0553ab8ead81213b3b9dc2d9d57f464a
SHA256 1ddf528b702ae60f5785814c05afc817a6812c5407ca54a4778431d246bc0fde
SHA512 b53ec3a63edb49b207cd285b7bba68de5e482091d12c04b694f96dd043ce1a0710c98d2932a410673f838470135e5751c59de02a43a8ee54e1167bee4eb41de8

C:\Program Files\7-Zip\7zFM.exe

MD5 fd6ef37f4058a4bde4524a72523bc74d
SHA1 8cc38ba1471771609284879fcb55fd16cef5309f
SHA256 3c08df8c6c1cc0fb87b3bf371b98db2ffdbf28feb810241fc5e4eb3ea22f220c
SHA512 67b6c855ba320cbecb480dc5ef5516843c2f3a73f330a94176aa962c41d20ea0507b056e6ef491329ad6f83d1a6891d7fd38af6f19f951397b53127d13427822

C:\Program Files\7-Zip\7z.exe

MD5 95ad6622e5a39d829d5f9dcebadccc0c
SHA1 323f7f157f9bd1b33415e71e817ff3c36970885b
SHA256 3b60cc4c491f7c7fc68a42f34c968dd018497e18b7956ca0475cb3e1fab0f143
SHA512 fe535d781724553eb8247506cdcd014e4ea51f70f6c9cd207a56e5d13f9033a00077fb83ebdb2f7c133ac24572c386985b2c25eef07df8b6c8ecc2d8c181c88a

C:\odt\office2016setup.exe

MD5 7005a40b156952710041bc7d0f7e29c3
SHA1 1cf1972f7ef3e7b2d5a7b15ae018d4b77a2409b5
SHA256 7896ff2d47587cd2ecf24ae33901cc8a0d6d56f9134d8ffa55170adad160dc3c
SHA512 747f3990c88405c482aadd07d1279e3eea29446a2ec0fcfbafad0711ccb2732a1aa0c26077971a0435b9b130d08bac3a053df12b791ac33ccef5844a12158d94