Malware Analysis Report

2024-11-30 02:36

Sample ID 240407-wkjglaaf99
Target 3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f
SHA256 3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f

Threat Level: Shows suspicious behavior

The file 3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 17:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 17:58

Reported

2024-04-07 18:02

Platform

win7-20240221-en

Max time kernel

117s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe

"C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe"

Network

N/A

Files

memory/2600-0-0x0000000000400000-0x00000000005FB000-memory.dmp

memory/2600-1-0x0000000000600000-0x0000000000667000-memory.dmp

memory/2600-6-0x0000000000600000-0x0000000000667000-memory.dmp

memory/2600-11-0x0000000000400000-0x00000000005FB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 17:58

Reported

2024-04-07 18:01

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e19da36b822cf6b9.bin C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004358f36f1589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000794ee6f1589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fba420701589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aca46701589da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe

"C:\Users\Admin\AppData\Local\Temp\3170850409ba0bc469c96e7e94eb4514a0c56666dd021c9ab502b24798ed1f7f.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
US 107.178.223.183:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 183.223.178.107.in-addr.arpa udp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
US 104.155.138.21:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp

Files

memory/4168-0-0x0000000000400000-0x00000000005FB000-memory.dmp

memory/4168-1-0x0000000002380000-0x00000000023E7000-memory.dmp

memory/4168-7-0x0000000002380000-0x00000000023E7000-memory.dmp

memory/4168-6-0x0000000002380000-0x00000000023E7000-memory.dmp

memory/3280-14-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\alg.exe

MD5 19c28dd21c8ac50bba6cb87360b03bfc
SHA1 bb165dbf6f862f338b5f197f0016a54c8fef6b2b
SHA256 19ccb427f7a478cfe05ac9964c5e22d36327dd7867f3485a3927e3e40c874c5f
SHA512 8b71ca8478bee473a268552b2c4f964501a328c2bbcee16f66bb00c10cf670a66dd2c7a1206982194e4cb060a17995ef4648c5388da92bddef7e7fb5ab285d26

memory/3280-17-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/4168-15-0x0000000000400000-0x00000000005FB000-memory.dmp

memory/3280-23-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 10bb447e11262de6b4533d86ea823ddf
SHA1 4ab0092bd674bef4b7d8c3828745de11753f3336
SHA256 7364313c9793dd94633678c49a6abe4f3e349cab7b6ce5cd2e2a15f36f87fba0
SHA512 dbd3ad038e9091a158d410a92f3d19797cef6839af61aec58d746ecf01a91169594d36b4b5860212d21fa84f112b28495c2b73dfffaa9de4c6dfd54c151c7e7c

memory/3388-29-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3388-28-0x0000000000810000-0x0000000000870000-memory.dmp

memory/3388-35-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 502c47210cefd7dda1035d5569622a87
SHA1 293ed8ac2a119144710a0a0b32fce6a620a1eb75
SHA256 19d9b999a340e894948a09830b493af640a6a65a4d926fbaf79f4f29a56fd496
SHA512 1c5c578cb9e545caf06c14f1ca07b12242759f5895c625feeba80355e384ac41b9341d87c2003515887f19b708b9d91cb2e0140865f090dfc8372e1b8c1e06b2

memory/2356-39-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2356-41-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2356-46-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 ccf8582faa657eb99202ab2e00096b08
SHA1 a2da61d00cd1052b0b442efd14d8c441713ee854
SHA256 73d1805788b59f56b4cf588f8ad158144874b9e00049cd3abb993414880f9c17
SHA512 c398e5534f6dc287e549a930febff698940849efc8fa22ff41e24388a071ae4940a7f3fba9225792aa1d9ea758e3a5cc3962c3723cfe104c90032dc173785673

memory/820-50-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/820-52-0x0000000140000000-0x000000014020D000-memory.dmp

memory/820-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3688-63-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/820-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3688-66-0x0000000140000000-0x0000000140212000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 8fede574a776e4016b1171178080be89
SHA1 7ac6cf89e898cf4f4d015a96b308cb93a2935280
SHA256 17666bddf254ce5b741ff7964d7fed83f85a466d492b121503a08523a7dceef7
SHA512 421b1bdda64a72f8fc2e2d9bd24f984c0c7d18c103673a8db83534e33ce03ad03486d6fa992d8241fe13adbce3f29e3718bd76b752100f0fa0637e0b837d8a1a

memory/820-69-0x0000000140000000-0x000000014020D000-memory.dmp

memory/3688-73-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/3280-228-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3388-235-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2356-236-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3688-239-0x0000000140000000-0x0000000140212000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 4b15e75abc0e82a04e97b9699b219e81
SHA1 1e52fe3044a19c19e71b4bb1eb8dd0b1ffccd9ac
SHA256 17b0d7345fcc46877c0fda850b67c1b4d7cffd66e710ac07dbe2cffad12264c3
SHA512 5f3ecbcd281b466329b512f0a828155aaa9d29870ffaa8643b9fb0bd88c13fff94a2b6bf78dc44222707f3ba97b2edcf9cf35c26a5c1cca0909abfbb9df8ef93

memory/4640-245-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/4640-244-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4640-252-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 a108f8bf1215c641659496f7eea28e23
SHA1 5fd95b6c6671ffe1925e63c2769c636a8f449734
SHA256 a7bf76646097da5160c321a2f47083f78ad173646c6f1680c72c48ffbd3bdd3d
SHA512 204ca7257de82f672f395e79c652275caf243654970d3ff83b5491ebfd10c218c5047986559ed3e2b89a9208a12cb8449ec660ce0df37a5c2de8421520ff3ef8

memory/2044-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2044-257-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/2044-266-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/2044-270-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2420-273-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2044-272-0x0000000000D80000-0x0000000000DE0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 c31c6a80a2c2951298c535b58c9b2bda
SHA1 8640b582d2ee60683c2f0e13e34501ecb48ab263
SHA256 a54c472153f9e4f7646538f2d66d489726a293ed957fc403ea92483ac76b87b9
SHA512 657882ea1f21bf31e494f874947112630d7289410bce66992c161ecf11a674f21a7e1b94a48a5c84a8b1547d07241b8192bce337124b8d8dd39189dfb5a1a7d4

memory/2420-281-0x0000000000700000-0x0000000000760000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 2495c6e17be5f2d2711a0a1d304d6d07
SHA1 dfb234e0d5a833fa1b83fc05be9a4d3dd9d66654
SHA256 f231930f100f3523b6eb4597c400db8e6aaa1e7df8cf5bd36f3ae94134c0afc1
SHA512 02199154417b2dd4638f2bdf9564b5dedcd137b5f9e38faec8dca6a7fdd0b871afcb056b061d9dd5b19c9eca773c8f76d3fc776768ee74a3e6334f395a24fab8

memory/460-287-0x0000000140000000-0x00000001401EE000-memory.dmp

memory/460-296-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 aa250d60834eaacde8837a34e34b8586
SHA1 783b4c1afeb444c0674dbc189e168ada16c0febc
SHA256 7981aea20a4f3eea04c37f514ced2eaca2dc185d4441e6b4a5d534e7fce8bb1a
SHA512 f715070f2081a8f7296ea647d2fb142742cc6b3b2c08c0384d8b2cbe6ce30bce18ae02c928c565c451bbfe8bf61e437212b8e507aa94900701b211893ebd7001

memory/1396-301-0x0000000000400000-0x00000000005DA000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 3b5ce3308f2d8e4e7ce6c51a64063b88
SHA1 fc03f276b496c0bbb91b8c1b015e5ce6ab8ca157
SHA256 4bb3d0215d1b62973d90af53404c41caacf0aa8772c983a20280c54d6d643583
SHA512 bb0ae598ccabb33d5dd3b198f9a9e7e17c0467c159050c5cec5b913cc399e79d7453799ef98cb23d7ff2e7315ce30e30b423bf86c6652d25cb7f69b95d41874a

memory/4188-304-0x0000000140000000-0x00000001401D8000-memory.dmp

memory/4640-313-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4188-315-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 f2aa3e4daf8aa116619e183ed058ec6f
SHA1 80d6888a6529648354bfdfc9052c80cfe0a8694e
SHA256 61eb5ad55adf1217e056239b4e49223a5b3565abc33eed3346ad0c6cafffa01e
SHA512 a880556098f52ff4829b50cb0aa032f5fbceeb1400292e3763073bd8c5499263cb55b4d86c5dc29f64f702131e479a13f6b182380fb93ea7446eb70efb5d1dc8

memory/1408-317-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1408-325-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 7140cdc5425eb6772f5a681fca1d8c9a
SHA1 43560ce2a3b02f4c533902d0fee78f02528ebfa0
SHA256 0318d88a6043fceb4e60f42bce67a3549b096969fe0a85e4c8b5d714eabb8bc6
SHA512 a42e2a17fbb9306c3acbdbad99a62e9ca44a5efbcba70e3114052ad0a769b02990aa1e596d2749299555f65626c63c7360817f627019e44ef0d2cbc159516834

memory/1836-331-0x0000000140000000-0x00000001401D9000-memory.dmp

memory/2420-338-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1836-340-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 553c96199d2baaf49b3bca943f4b8a42
SHA1 57294af853f04eaafe903b9b7c50d74d9390444e
SHA256 4b792870796de3fda16666e2dfd42b6935eeab7ca9a7dddcdbfde8b7ded1a61f
SHA512 cb2986aa4bc954d9fb50ade8ccfecbf4f113348ae6261758eaf851f2d40e46c6b0425a7b40f5d9e810ef01de9848f3689a89375eede116e46433c92fa131a8fb

memory/1944-343-0x0000000140000000-0x0000000140169000-memory.dmp

memory/460-352-0x0000000140000000-0x00000001401EE000-memory.dmp

memory/1944-353-0x0000000000740000-0x00000000007A0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 39d216350d5471bf86980ec33c04fdf4
SHA1 c063d5027d8cc66835d14cd43e16fcfda5cbdb63
SHA256 23362a50d7c373327840a1ccbb7d745c60f0ab0525fcd870e0decd439be3421f
SHA512 c3df0d28866925064d7d891d091a551be32c660b86d4b8c1ba12091fd92ce939ea0e3bcdb976a40386dfa6dead62023d08d9ab875344b9497377848791770f6e

memory/460-357-0x0000000000500000-0x0000000000560000-memory.dmp

memory/2944-358-0x0000000140000000-0x0000000140245000-memory.dmp

memory/1396-366-0x0000000000400000-0x00000000005DA000-memory.dmp

memory/2944-367-0x00000000009A0000-0x0000000000A00000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 f9835a855caa896ef348909f2f99c3d9
SHA1 b2cd98640e095a42a62189f63ba6d950625e164a
SHA256 315605b882439eafdddc4a8641c5e1379fa2811eeae229ff6f58a9c4d29173cf
SHA512 7ed74fd21103c414ed2caa28e8828d1812145b36630d3a9287bee68c0d8afa9411631fcea0834975f61f4a261be0dad5673f152c04188d41e6d28553626ae76d

memory/4188-371-0x0000000140000000-0x00000001401D8000-memory.dmp

memory/4336-373-0x0000000140000000-0x0000000140225000-memory.dmp

memory/4336-381-0x0000000000880000-0x00000000008E0000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 e556bd2194ff2ba21ff7aaa69f409797
SHA1 a5a9687c1aab3176c1c198ee4b47cc766f9e82c0
SHA256 e5f40c2e785fc28a2cade314e1a25f23f4f4a4d939096682a41e2c980de6ab48
SHA512 5e19fc7001215009b38bd8385d337b52962ac0ef221d58aedbd207c105376c69bedab75d6547682286734b215ab7bd16ea6ba5c5b7af2db03ec8eef08109e31c

memory/1408-384-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/920-387-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/920-393-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/920-398-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/920-399-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\System32\vds.exe

MD5 dcc83710ba25c830022ae100c25d8226
SHA1 ede1a922001d46ac6aab5081dcd08e87767fe707
SHA256 69db20f485cb5f710774479531d3bf8b7820b21d70ef5db972f636752006a9a2
SHA512 619fd7fcff8bf18c231baea0fe07dba54afd5b534c53c5718b53b151fd6699496d1b3d8760970fbf02a4162dbca3b9563ee26f4105fbb67d7e71a477fce7653a

memory/1836-401-0x0000000140000000-0x00000001401D9000-memory.dmp

memory/2436-404-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2436-411-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 39e6f5d195ad8646e5c4e73810bd1093
SHA1 ed32944cdcc52be2f2d8a74974c71368a6725562
SHA256 1e33f0cbb54203428e2a314b66729c7b399ef39ac6b65df75cf5d792f3bbb5f5
SHA512 0c584d1690f47851e3f6bc5ab7a30af5096bf3dd6c7803a637740015f5cb9b7e14f0f82e2e48e8ac1252d6169c0064c8ed9843b74180b863bf17c128d1f4028c

memory/1944-414-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1840-415-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1840-423-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 edc48cf9c8648766b2729d89356da512
SHA1 0d5d04f1b3ff4b762cc37d56d7312527abedd069
SHA256 1b8e487e7f1bf516c9ed22e231ccff9605a10aef393bb5ca5c3a4805d4e99e6f
SHA512 66a396aa62a2e64843976921cfcb9b98eb3656bb9d30ba12ab62d51d368093c3873103c877583314038d79b93cdd1e1f0949130010a59403d3364d78bd680120

memory/2944-427-0x0000000140000000-0x0000000140245000-memory.dmp

memory/3640-429-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3640-436-0x0000000000C30000-0x0000000000C90000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 5482a802af9619d33c84cbb89c3975ba
SHA1 a2d27bcce3505ed8608c58c01f13d8d977c985b1
SHA256 15bca2e90e7a7b042e4e079932f3495147a35efbf6e5e241da0900c49ab21e3a
SHA512 62885ff8a9da750958e5e6c2510e3d5f031eeff63486fd153fdb8501a85a879ab1b95eff13200611fc1223e4d2425c6d3259b8e29f0efff2b4a3019ad238547d

memory/4336-440-0x0000000140000000-0x0000000140225000-memory.dmp

memory/4632-443-0x0000000140000000-0x0000000140209000-memory.dmp

memory/4632-449-0x00000000006F0000-0x0000000000750000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 d3cdc52607b6259696d24660c4a2fbdd
SHA1 f5adccd15c9f33f5338dc912d0bf3809861919ff
SHA256 4667a9606a853710e84afc2d2cab2a10a064845ebab8f94bc30be516aa8c2958
SHA512 ae2bd801f6790dd9129c7017421fca89ac20cde673a403f43cc824c3dae7147ce9fee1d2a933d08e90dde49983dd1f05617d241ac1639085bb0699f6488d467e

memory/324-454-0x0000000140000000-0x0000000140179000-memory.dmp

memory/324-463-0x0000000000840000-0x00000000008A0000-memory.dmp

C:\Program Files\7-Zip\Uninstall.exe

MD5 f3d9c1044df355c154e0dc566e8b71a6
SHA1 6e15ca8422b22c1ae6f61ccf9c8348b88c4740a5
SHA256 25ba17b23de352e5cf41d31a7951323b950132a8a4ba49589b5a1b96a97152e5
SHA512 1b98129f2ae2b9573fd08e6e396367abfb77e892c6f40f05b8bb1874025cc9187a82d81adf05e9c8fc35e443bbd4db988f9a349ed386eb61f5bfc0f103794443

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 e56bcf7f9771d702fefa391949d39e41
SHA1 c27d84f09b7b13a5ac829f83f2c9c8de8385a4aa
SHA256 07ae0968ffaa29e134253abe31e5d0bdc4f11dbd449daa952b366fcb50a6d82b
SHA512 eed0ac15a109f4fd968efcbe408e3eef601a837f73f0c9844e8c7a3a81776709985ae24cc43326285e003bfc91c47004ae607cb9bcd1ac081e93208bd0867190

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 5d572cbfd490a64181553265632b2a1c
SHA1 0e78bbd6d252f5c06579b32c28224133e959f943
SHA256 37bd6fe857263fc85e62fb1403728caecbcdf75d6c578c4da528b1f4a4b60214
SHA512 2498d831bfdb97372e3352ab6409bdb780036be69dce18912eefa3fe4244a2cd119f16dab45a3e52b922ca81223e1cb272211be8d2f5729fdb0e24fc5e5bab99

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 b8eb23fcdb86f5f103c649471a36d74b
SHA1 70fbe516d7a8c8f54ab4fe09daca6e4a27a7bac1
SHA256 735300ff96ba59220b3598e49ef8e182cb5f3a0df675b9875e2b922c88fcc202
SHA512 aa36aa8cb2c3481b50270498d2b3e22d286bbe3348b30532d2a060cb747e7534b5c7c126fad3a95361e1cf401c92a95a2c2ffc0588aff6c8c637964f53e067a1

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 a8624182397ce6a2a825257b1961defe
SHA1 0239c57ffedf6542e60c96cba4f1670e01a708d3
SHA256 75a24f3d7b0e165288055770f858dde3ff8dbd7e5cb3f19b1b2d16150bde43de
SHA512 15d3730c7e6dc4f7fd62525e9f21b152a6116726c2f474dfb42a53e01b8e481bb905ef9b65348899437f538eddf68a907aa5c09ae63806f21f2f5eef39de42ef

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 7d2f5b6cd9e51bc79398bff78c1de2c6
SHA1 e202746912d3c17b526e51f8248e2bcc103ffd5b
SHA256 2211165251179d1889e875de94247710e0a4b26d1e2fdb4ceaa3998d978a65f4
SHA512 11deebc7d7005eb52526ca33d40a96f36860d369d19de96676c46c6ba06a3a1e4ffd425ed261b79fb7b0f6e5796f50484b704394c667ea6071f0ccfe91c81bf1

C:\Program Files\7-Zip\7zG.exe

MD5 94237c23b0ebec014a63337812a4edc9
SHA1 8e4f10ac8fd691dfb27bce81fa7891e17cfac86b
SHA256 9b566a57764b02c8ff5b225a354d491e52c0784faf05d508fccf7d176efabc32
SHA512 10eaf24e543b044c715173649f823ba031e5ca01b89dfdece58d3a4ab7a62288450994a6fcca4e2ee959e45337dfd079d9d328c78b82b37205bb3b642ded624d

C:\Program Files\7-Zip\7zFM.exe

MD5 48c8c107addc39f33b420ab1ec4e537d
SHA1 75e71d250a128dad8e8eb19d6c69a3ad1dcc9cfc
SHA256 8c7c7f0e60f48d129cec0d8a17a70ed086621fee99b2e1563614f1276053e552
SHA512 3ad5b56e3b7e82adcec302513760abedab3f6ae4a62e7e02a6d3a7bea9751fac16ceee4f7de10dc0826dac78faed3b99d8055b2189db16b2c9c9c4319d5a0361

C:\Program Files\7-Zip\7z.exe

MD5 3446ebe94daf8fddf5b8fc93c03bade1
SHA1 66e42101b4aab203922377db41116133b7c356fe
SHA256 d4224f10a56e0226bc7e6915bb25d99feeb54a7e9ab851b0347337bddb5fc9ab
SHA512 d96bbb5affecfd29e85c9380480fdff8d53ea3fe4aa10de5cf86f3fda8eda8ac587e953a8be8bdf9376d01f240a57d2be22b3619d2913d32e06d9201de63f5e8

C:\odt\office2016setup.exe

MD5 90a10d9ba4bcdb13c8912354b2efc884
SHA1 b8855077a8e3845409c1d877f8de62957552422a
SHA256 a75b6407ec9d3a85cfdb31901ecce85f75c26c3c63888d2986b721f2a7cf44e2
SHA512 9c97df8b8e079f89939db2d5f2652d08ac3fc33a38c77603864a026f901725b72f5ead5cd12a4a74a8120dd5e685d698f960c7b3b8d0620231fd17c37374324c

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 25a14c94b29c8c1dc1ab09640dd5a27f
SHA1 b40849fe14cb700bd0a92c1878a8fffcbc26c440
SHA256 09c075f5576e2f9f64495d2011830151cfe18fa4a1a960b34ef8fe3a274b4ece
SHA512 98732cc2cdf874d749b3aa90216294794fd18bf7dc0b570c1cfd2cf4d1bd1172a457caaf4b4a7e409c41c88fa10854922203ebb9b8cffbc18cdf306a242cb564

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 9c5fa7a65b665ec6dd6bb6d36d64720c
SHA1 14cabc76e967ead9741d7717239508738a2acb5d
SHA256 fceaea335405dc874cec9461540b502ac4fc381424d459c49e29c63146332431
SHA512 bac8cce870d54600f3a023c45092d8fbc84451e1a0c08a9ad4bc3fe08ceee76e880a42be2566326df214ffea970ea6c15f8043ab8353cf36e87d75f530a9fee1

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 d9be174929f27a5e572da98327ad12a6
SHA1 4b71b2010b08369fe60ab9ce4ddd421c4a1b070a
SHA256 58cef92729328505c1654bff526103bb5fa0c60513eda90aba78bab45d974a79
SHA512 87e86b3abf9de39de91e14577716aff7da8ceae0c91a85d2003933d841ec08e11fba7648d126e33cf6da4a4210db408b62bb2a6c10f4b12086a34d603911878d

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 c2eed4c7fa2b361d37251405ff4d733f
SHA1 c47e1d4580b7a76b318ef062df60d244f30e96bc
SHA256 d887d3fbfd3f4ef802ebefd0d4b0d9cbdf104c04585232438fbee4df51674f3c
SHA512 718000263aaab79f1159c2d1bbcd346b33b8d3f5c15bd195ac426ffa8db1a5fd3c9a5f8d65e04951c11a8058d1a52eb465c97a2b4f5aec7d4c3d86d26a162c12

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 74170f1c7bb7ca52533eb4ab5b316569
SHA1 a4f766e3447f2cc8d39bd768ab4130d636bc032c
SHA256 dce612cbee99638a776827f5de1722b71827e68214fabebec2d3a0f2c9257029
SHA512 a5bae90506aee76246d31b9a90a393ede76aa8b0da4f4a9ddba18055c403f1bd4868faed3ae751f92252bbbb5c0308b22c328affe4137bfaca5affa94d7ddd7a

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 99fde1a626f7883a8cdf8d18e1cbbd35
SHA1 f0a74ec08dfb79610446daaedff5a8bfdf911247
SHA256 058adfd6f8c42c62eec8de085210862edc3d5b0f3702cf59189257c8e7310db4
SHA512 4e4af3e0676eefecf5e4669c71d74ed052c17efe10ceae1886814d821c6fd3b20044e31a5dbc3798e4db6fb1fdc1ed9294bb2b61f220bdb602dc88a1cbefa68d

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 a4abf18597eafc60e57e1619eab5718c
SHA1 5818a6aefa112900cd3a1a206f8b091caccd7c2b
SHA256 b7102114a6f306c5268e13fc1b96bad5f9cc8c3be812ca426c0e61ecaa8f7c5f
SHA512 eb10725d565bda2b270796e2389c77c9439f2f19f75ba8a6ac57027a68051b65b0f3fc3c1a93e2dfacdd2e1a971b586a2ded178bfe9c1b8e20e610a111e0f8c9

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 4bc8311baccdcb6417bb4940b6b0b86a
SHA1 aa51bc871139f02e2ca52ad77cdc37bcc9527688
SHA256 c1a0cfb67d8d6410c6438beb9723d3207272dea94e4d846b4f1b3cec4c82e4be
SHA512 de95444a217e812e4aefb93575065ca15acb1f95106b40f9f5e819056045a09b05e4ceaca9f3787e5e68fb50555661ceb82fbbe054d73fd5b679dbda393e24a2

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 c5f7481f4e7b1908afb5fc3822d5dea4
SHA1 5acd09889371ee7a054a49932098dec3325e98e4
SHA256 8ee493a8942896057e9a6b7e0b6360260e464a4207f2e8fe384e73234eae4896
SHA512 8652d443e68e79f2cd1644a8d3b17fded642863ab4521be317797c39551c4728216915a1c78250cd1b7a3dc0dd01d44343805d5a14d1620d2af3e37a041e6b07

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 1c9235b9617f8072e35067c4b583187b
SHA1 dd4bbd54207d2a88b6b131c9c0509fe9822f4a94
SHA256 71507c1800792b24e2317a29d48891dcf433255104c6c285f197486668f6723a
SHA512 f93e4ba97b816023c02f1ba4dd2ed94ce84761a9ad91ac3f650b18fd9b2a088d553ac20ee857a20d36a70f351138ac64d978e2ae7474107d4bbcce99de8d4253

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 72b36ea82db949f7ff1215cc10742cc1
SHA1 e501f7070bcf9de2a59add5be212ca091db88648
SHA256 068931f9e1a1429f9fc17153ce2e0028df7d87797e6068af2eae3e1da01302b0
SHA512 8b2b8826bd39803b4997e509c7e1034d2d8590b4931213f6713b7ab707c1cc691e631394cda4ecaef429bfa35093204ff50c9affdfd7cdac9ffcd030c6a0f1b4

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 a43a245be4707d032cdc92f6ae3245df
SHA1 31540b810427f130b3dfb60e7960a1c0416c0f00
SHA256 1fec6f2fdc81f51d5b38c500e1bf3287aac987f7a0f0621c1e54c9de89cea486
SHA512 1e75f53e434273c866e54ca134ed85511bbe9b4270273e723761956254a2de63279fd694ce21a4a6bf2da91b2881ac35f14ded02fbb097131577dd7881d1e608

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 ce85bf19a689bb9f4fea5ff8fd5fc476
SHA1 7707905dddca2018a87ad9c90e9d54bd0920a778
SHA256 781bba19d0022354cb018e496fa4d61a78f9fb41065606b54fc840f792284212
SHA512 fb9b814b3b1c2283bd9eed4ae2d5a180f04564640b14a4997072a5328538b87112fc947612fb3198cddf3dd1ed4efca22cc114483bb962b1796338ecdd3c5a8c

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 f363992c8a7054799ebeead8dc3a4818
SHA1 5abd61e2e3fdc43ddbc6c71ecfa448694cc5f0c9
SHA256 ee17c2ff810acae031f3a0e9163cca4f8be9fbcd18899254dac042240a31cb37
SHA512 f578621b246c0125cc90d9619027aedaf2a8d9c017378db4f89052c08f12396fbf3b6f5979079224613ac462b888a87ab388e94688bcbdf10c591a59b6dd28b0

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 5073f575070e7680f08200a6a336ef2a
SHA1 15cd85e51bd0d3d3abead9810feb17afbe9bccc1
SHA256 e922b6b4217376393dfb78dd81deacef75eab9e915126d59595037f30bf91264
SHA512 c1f3c5b895a3112369e175c068dcf20e1e863edcbc1815c053e49ec806e57bb63a82af2704f780d1ad9d83b11e0f7a01c363f0359c6e71d03a5a69f022ee7576

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 477235f4e11984499142157b06dbc068
SHA1 e08259d7fa4c131d20d7333b5593c46ec93fc0b9
SHA256 f801870e0ec8015a29bad9044ebe3aa5b6df1c506b6930772d39aa77ada85448
SHA512 9862f8ce5d6aac784c182f06f7c47d61d3fc82a25819f42641be34a35a8e3c5a306529b6b253326182cce68aacde6adb97067dd1c0a5040a4f1084c15d7d255b

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 c388774a8cc1c42f09f79b11266c12ac
SHA1 b2e93658f75855f540b903c673f3531f46f12c83
SHA256 86e61278b48a50b93b63ce9988bc71ddcef53129ff6643fa2bc2083a269f6877
SHA512 491984944532b8ae6c9846eb74b34c36286624280e74914eb91e1720608dd9a48583b3fd2aac25fd534fe4274ed2562afa852d839df985aec95518206cec9693

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 729ed08c2855c5f4e7dd94dc2c5df28c
SHA1 53b4111a2f000d5dff514b3f38c0ff0af8ef5553
SHA256 f398cd5b079f53e089ec735d825ebfcdb5c6c0a9d7af9c3e47e52a762dbbc30e
SHA512 ad0ff526f109b42821bf0a0d9cfbca41964d04c1f13c4dadfcec4c16856e8dac246cf3e7254f99e75f1b4b0aa780e260b64e9f4c693fc9a651edf9c7c8044431

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 53fd19d85a9deea63f0c6413a723d71c
SHA1 33f345892bf8f2231001c1fe7bb9c46a194cfe62
SHA256 e3f9495e0efdd568e8b009f8e5fef634bc3ebbbf55283c2690620fed275bc8df
SHA512 192acea4fbcc8cc2d3aee54eaef46262bb56d05e7839c72dadf94f3311234496938a89714d9b1651c8d3905e7c4314a80920d58bc4d4e825271eebeaf7b67f0d

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 50526d066154a2ca4bcab4196c0adadc
SHA1 961521ce0485de34ba85af53c1eaf9c41559dec1
SHA256 c3692eaf4f7801b6b10da12ecf2b4c157ab9fe75c73ae5d8f6505d05c46d5452
SHA512 79edca98ae2268eb1b40e63a48a445f7b102e4011a091db759828b572d3e5ba3cf4ec14f9157f8ef7262bfbb1f490b0cc1eec6034dbe1432b289667b24eb153c

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 17ba6cd3ca9413a9e9fee6b18f58b28c
SHA1 1166f38c46467ad0dbba52888b82ae15777f4b9b
SHA256 a2024654b6de29e2b03c5ebd4f3483002896541368bbcc0a1c139821d82627a6
SHA512 9e41ac0be301167aa6a01f1e146f06adefd7c5dfaf23ed65180d8d0490f2598b904a5cf5e1ca8a38e71f66f9fb9877d3e11baa2ab111c9b7972c30e1963fad4f

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 97df30031f23baaafa169573fdbccb56
SHA1 8ec6f221ec090a0a95dd40915b3aebb3abdd6519
SHA256 7c691d08234875abc711922937967f634c0fe990c0c4c23dd8eac9bb2cc0d70f
SHA512 5d7b2bebaabff16d9a09da36571b83e59b80410b74c42ee37cf0dec3cf84de1b6bada5407405c5471cbdc2930e48a05cfa403f1883ab825280233f37165f258e

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 171a422b0f5d4a66a03fd9c6d0bff941
SHA1 7b5340ecf875534be5c37c9de7a7251ea067e1b8
SHA256 fcc4a437ef475590916748124a5488f1a6a2a23f6cec076c62060db767811c46
SHA512 491d8cdef3b17ada3200e3dc37fa50559406de0c2ecc256290915704faf217a1e22d216c4e1b2e63b915405d443159c2628d68c3be505cde1922c6c011fcf383

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 70a220f331286a119d9b2d81a5ce64d8
SHA1 a70449c5721f193b52e0f3ad976c6a0d79602642
SHA256 5b53ab45257730f4e00a6e77f7bacaa4ed7c7b976e5df9a9c6d5aa2842377b9b
SHA512 073cbc35fb572c3b751de11de1be8094584f288f05dbb77b57c1a3b3753ec228bccd58c36968c5f4db7581d248ecdba178c3d80e3ec9c2fc82e5f602d4a6d971

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 ab415b69677571022fc9398b01ff4ae0
SHA1 86e4333e6819b5874670caddb934554dfb10f81f
SHA256 d17af3bb1d2278d3e171f188bb53fb2cc42052f6c3df7eddb2f96f9727015669
SHA512 c190ca19161b12b6a6fe2c3f44b0734926b1a20ea742a7aed8b47858c27fba8a97bd7cfd6fe9ee8970cfe4a6ab383deecf0994192a2c22851ef11acabbd4f40f

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 5d2f07c3bed78efdf5c8039e2b20f507
SHA1 35af332f6e878f5b6c3bbf64bad99d1e2635dd7b
SHA256 609dcfc5175c1979da72c1d4dcf97933666238dbc24662aed3604d418ae2ebba
SHA512 b712a9ad678d99dfaf65736e3cded957631e81f4ffffed5d4e4b98e96f8beea09622cb707c3e347bdd0cb4b99d2a5fd0bdbb24e266057c9b60d36a76f398b0bf

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 42607fb06958a40906182dd9686378cb
SHA1 d53f2ff12188a5e6dacd6c3479a9faf485c3f859
SHA256 ae88720d4b1251e2f5dd0dac725fa55599334b5126bd30f4f1fe0aa92809cad6
SHA512 31399dbd637aff6aca60f39b27da801b5d13dc8cfaf8a462f49ab13bf9db14cc98ce81fe2b6d5c15bb922b5f3db00522d20f4ca77f37d0e331b841586cbbbe7e

C:\Program Files\dotnet\dotnet.exe

MD5 163a9b565614aad27083675cc7d948fc
SHA1 02f06bd4e089de42eaefc4deae96e80d864b09d3
SHA256 54d5dccbb468d7173094ee3886b0b432252ac1ddfaa998db426529333ef1894f
SHA512 ebbe37392994707c64c9baea735b383b9228db4814c200caee2553332c734a25d7d456481e476e69e2a6c59065032f38eb3b6dc8d5cbc63381e6cc72d8c1f143

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 913317ebd16f2161272ae10317cdc47c
SHA1 617c15a5f7473c415cffb833fdee981310e0e6c7
SHA256 99df71d3f6262a86c153fb358c00524fde1b5bdb38856af76f9efbaa0c1df296
SHA512 1542994cac51674b9798098de525069cc361637b52afe7e0885e5f4e6bdada09f15d0224c418458bac0f0323b4d2c225eca0e00a6b2f871d55bb939ddf9e2693

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 2e88b53ec099e8d0bfd20d50ab3a3bb5
SHA1 64e8e9f36325ef2e8426911e9c76d9ef255879c3
SHA256 1f1574a8a9ce52818ec0ae6f96db5aaf623e028c05db6df877c4b9cc46dbf4eb
SHA512 31e6cd94b0a24042f3781f29495d28edc1140e3d3a2fc36e122fc59ceb342e6458a6888567cdd405d925a0029a5eb83e82a00c3cda007310360b25a1cee2507e

memory/2436-540-0x0000000140000000-0x0000000140147000-memory.dmp