Malware Analysis Report

2024-11-13 13:57

Sample ID 240407-yp6h2add73
Target edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352
SHA256 edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352

Threat Level: Shows suspicious behavior

The file edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Uses Volume Shadow Copy WMI provider

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 19:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 19:58

Reported

2024-04-07 20:01

Platform

win7-20240221-en

Max time kernel

154s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1d4ef91d4501ed38.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{A460FDBD-01C6-4800-8EDB-C87720E1D9B6}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A27DEAA5-6B85-40EB-B2BE-7500CFA9C502}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A27DEAA5-6B85-40EB-B2BE-7500CFA9C502}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{CBD3AE77-E161-4484-BB6D-5979BF0D3C83} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{CBD3AE77-E161-4484-BB6D-5979BF0D3C83} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 752 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2172 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 3040 wrote to memory of 2644 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3040 wrote to memory of 2644 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3040 wrote to memory of 2644 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 752 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1748 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 3040 wrote to memory of 2036 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3040 wrote to memory of 2036 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3040 wrote to memory of 2036 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 752 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1200 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 3040 wrote to memory of 548 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3040 wrote to memory of 548 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3040 wrote to memory of 548 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 752 wrote to memory of 1664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 752 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe

"C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1ac -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 254 -NGENProcess 240 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 240 -NGENProcess 184 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 23c -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 184 -NGENProcess 268 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 184 -NGENProcess 258 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 184 -NGENProcess 1ac -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 254 -Pipe 184 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 260 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 274 -NGENProcess 284 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 288 -NGENProcess 260 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 288 -NGENProcess 274 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 27c -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 290 -NGENProcess 1ac -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 298 -NGENProcess 260 -Pipe 284 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp

Files

memory/3000-0-0x0000000000250000-0x00000000002B6000-memory.dmp

memory/3000-1-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/3000-7-0x0000000000250000-0x00000000002B6000-memory.dmp

\Windows\System32\alg.exe

MD5 480cbdfd8033d7d4bdcd2802fa927eaa
SHA1 819f9867f5743319f1bc296030972cc8af4661f0
SHA256 04076f5495232b92409086867547bd2d7d4d6976487cb354d5c8cacfd31d912c
SHA512 efa3b8bae9a7796a0abffc2bc38e0ade50cdca7c72dc174b0639aa98113b7b1649c7ad95e5d43f9e584b18875ee0f3f52fa1ed56f62923114e07871fb58158de

memory/2572-12-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/2572-14-0x0000000100000000-0x000000010013B000-memory.dmp

memory/2572-19-0x0000000000170000-0x00000000001D0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 82735edde3d656ca4a9546b7003ced1f
SHA1 a58fae44fb1f9b5217b54c9a9ae84a4183687726
SHA256 36d08116b07c26713602a1d8a3ff925559eab0ee1804957b9072fb3f74532b27
SHA512 7635ef94f0bb6606423ec02e260d0626f33d4e6ecd5fdd2f6801c01ed5d3e0c8733aad5d7855358615357ee646b8259fa2b94320311d3fbdeb47a28801306ca2

memory/2124-25-0x0000000000420000-0x0000000000480000-memory.dmp

memory/2124-26-0x0000000140000000-0x0000000140134000-memory.dmp

memory/2124-33-0x0000000000420000-0x0000000000480000-memory.dmp

memory/2124-32-0x0000000000420000-0x0000000000480000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 f4e8e7fe0963a25c6e691e194c1ed0c8
SHA1 0af3c06b8c7cd255a2d07844f339e00ae0faf6e0
SHA256 46144eaef219bb3c65f16295f019de483b73db8a18ee7a0fa5994a4392d899c6
SHA512 9114797bcb9fa1abbe733872d099fa136ed5c5427c15ad980905bb6a77142986d548a13335e308eae76de3e847d34f05fe03281fe5f6064e438d31dba5f5fb46

memory/2552-37-0x0000000010000000-0x0000000010136000-memory.dmp

memory/2552-38-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/2552-44-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/3000-50-0x0000000000400000-0x00000000005D4000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 fb3a320c885ce17bb7a92fe8d1e55196
SHA1 f687081dec4fda9f7605db1a4f79baee2ab1ab75
SHA256 98fd7f16eef60455d6f0a3e73559d7e2bc7e428aad1b800279759f2330effc72
SHA512 b70950943054833a05bb3f120c5fa0aaa1e2de189d8329539f1359114f82bad4182e06d12d9da4bcdeec21606edf40aee25a346c86a7e36209ee746e0bf98475

memory/2800-53-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/2800-54-0x0000000010000000-0x000000001013E000-memory.dmp

memory/2572-61-0x0000000100000000-0x000000010013B000-memory.dmp

memory/2800-60-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/2124-68-0x0000000140000000-0x0000000140134000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 94c59e5780b619309d40d87600306bf8
SHA1 922e2b17cea5fdc4c5e02a3a827115478a282aed
SHA256 7090f8c5ab30505069ff8dc63d59213593f9cf29cb680d89d73642514828fc9e
SHA512 c906c903b23f03f6dd785cfe6cf0f802f11f5659d5be0fe5c2997426bcd8292f05123480e1206e88340cdf3885c5f9fc0b310b8aec0af272f97fa3b26439cfbc

memory/752-73-0x0000000000540000-0x00000000005A6000-memory.dmp

memory/752-75-0x0000000000400000-0x000000000053F000-memory.dmp

memory/752-79-0x0000000000540000-0x00000000005A6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 ffde9a76b8186999cedf7f1654d29627
SHA1 33e0d30bcc336e804342b039640d2b7682de41cf
SHA256 e6abdc6fd68d82ecd9fde9cd4a6b69462327fbb082c3ec2d0ca7a06199b48633
SHA512 7bf157230abbb0c6cf1376aae5e7888057c4d037ed293a5e1f6854b54a0b6df612800a81842d772266bc3221e9dd3d1cb0db4fe82a1bbc400ae862ea4572d5c0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 62707c97b2066724b92647ec37d37e04
SHA1 c2def4837d6e79ff0e2166f62d5a71c214ee54a7
SHA256 e766f9b707566c1d2aa4052272d96f83cef98e91bd53f5c81e405fd41be1618c
SHA512 3ab162d8308bf7da4d0d068748a78bc865909c71909e6b72cdbfa48596f6019e7696b312adfc39e85c3898721eaac375c40ba99e407ceb781a05c8277067cda0

memory/592-89-0x00000000005F0000-0x0000000000650000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 8abc07986e08e7ee8d9ccd8a1cbce687
SHA1 63430dc3dacd5261164d173babf1de8c8f6de55a
SHA256 864c680f0e6a7aef9529c0d08be3b015fb7fa51a8c5ed708ce219df9eb592d58
SHA512 c46b83ed6ab6665751ef3dc87cef0bb263c3d8471c05e8290cbc1ef11e5ee69cef0928a880e8d531768791cb96226654e2efa45927c78d9cfb3ed8dcd595ef6c

memory/592-92-0x0000000140000000-0x0000000140145000-memory.dmp

memory/592-97-0x00000000005F0000-0x0000000000650000-memory.dmp

memory/2552-96-0x0000000010000000-0x0000000010136000-memory.dmp

memory/2800-104-0x0000000010000000-0x000000001013E000-memory.dmp

\Windows\System32\dllhost.exe

MD5 2146ce2c072b3367744b4a9c5f65bc90
SHA1 f59b0e3b053b0e43415c622f5e192c3b3eaee853
SHA256 ed008ed194f1eca8848d27927bb3778328a806ae011df76e6c138d0bd3c70f30
SHA512 c82de4eaf25d81d88058d94348a91ea6700aa1630f7d856949a3bf88ae225e314758ff1babee7d5e146148795da095006b8a4cee65c2ed268c5b6fd2edcaf473

memory/1556-110-0x0000000000880000-0x00000000008E0000-memory.dmp

memory/1556-112-0x0000000100000000-0x000000010012C000-memory.dmp

memory/1556-118-0x0000000000880000-0x00000000008E0000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 987a14ee124cf2966584fece30e1f368
SHA1 92299c684e321157628952a405a748c546f393e0
SHA256 4e96432d71eea7e1ce8a098168f468c6e8dbb5e47122cbfd43a1c9de7435d2f5
SHA512 e01964ac00689644c690b0a059866a8926645cbb11a5d4e6eb1557f9241bb6a285398ea5824d6c6d7baea6416280ebd40bf5417a783a38b1d0fd42601c404f5c

memory/2204-126-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2204-132-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 20308669e51dd64331987cdda42e7a41
SHA1 5b9946fbba3d18d2dbdcd98c9c59385a4f49e0e3
SHA256 565e97d1f73dde0aad55b18056155ddd5927c1352c0c51ace364c3b75df6d7df
SHA512 b4724de764844e52e903807e074f2f141fb566c1a3a54ed24dc559c3c9316337552098327bf0384369f51a8ff41f184957ba2739dee5415f31767156f4d296ac

memory/1940-149-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1940-150-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/752-153-0x0000000000400000-0x000000000053F000-memory.dmp

memory/2204-154-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 8137734991728bce5dbd87ba7fd8a36e
SHA1 6a63c08750b0ff61ce74a9b780c32f47d2d4b6af
SHA256 f88a3f3cb4c697dc918e4df108d96137df184d8ea6fb42fef11f3c0ab44eac8f
SHA512 2a54a88301ed43b80f116c4dbb865771e1e06594bc66697e89db04fa599665e674b97921c72124f13d0bdf8b570bcf1852cc68d4c089f9b39a7291ccb8e011bd

memory/1804-157-0x0000000140000000-0x0000000140237000-memory.dmp

memory/592-164-0x0000000140000000-0x0000000140145000-memory.dmp

memory/1804-166-0x00000000008D0000-0x0000000000930000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 64b732e1a4c29286293a69cb73944e41
SHA1 313718b3700540d6bbc2f3532e517e9e7d8373bb
SHA256 c6725841735548a6b3bb2515acb9afde388f538248c6914431ee36c9ee6a5848
SHA512 5760f6514689825b7b1c905c1e44892241a48deb6f15236864e23a89f36aee3e503b1af69d2273421f262b0a607fb8951791fb36bd09f79f44f1d91f352a8452

memory/844-171-0x0000000140000000-0x0000000140145000-memory.dmp

memory/1556-179-0x0000000100000000-0x000000010012C000-memory.dmp

memory/844-180-0x0000000000880000-0x00000000008E0000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 b81c49cd70f35cc1a9e17346221f795c
SHA1 dbcf7f05cec1b09e2b97f75999ab97e85738d454
SHA256 43db89bde37bc80368cd5257e61c58bb6b7f2471cb3f52ba37f7db7e5396f347
SHA512 f0829bc1184aa8f6bc92492d36ad6b38996fd052a15911a985969222f0ce388738d041cdf9f26b978a83a376e4cdd11d1cfc8e8f26668945df740b488ddc5e5d

memory/1880-187-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d27704ffe919e1b297f7baab8b2ac709
SHA1 21a900394f683ad3498fb0840706492909047f75
SHA256 7a872db81052244bb64b73c7b3ca2b5f78ede210eea0881d9b86e3591c45a397
SHA512 8dc8cde64c0a75fbb5a85c88c5e088966b3e11f1ad534f7ff640d5bf3761eecd3f960341cf181724c9f05b0f689c18e0ae27cb225029875c44c60a95bcd5cd40

memory/856-210-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

memory/856-211-0x0000000000DD0000-0x0000000000E50000-memory.dmp

memory/856-212-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

memory/2172-213-0x0000000000400000-0x000000000053F000-memory.dmp

memory/2172-215-0x0000000000290000-0x00000000002F6000-memory.dmp

memory/2440-216-0x0000000140000000-0x0000000140161000-memory.dmp

memory/2440-217-0x0000000000FC0000-0x0000000001020000-memory.dmp

\Windows\System32\msdtc.exe

MD5 1a339c437104c2bdbb1f90881902e998
SHA1 48f7c723a07229cc45d0e3d49486b5580db1407e
SHA256 88eb5102aa03bc3ff02782c55d839efecc76da04a3fe4c310f727e1e0fd91bff
SHA512 09999e33a6d587ea4e3903dde35cb209c0e8968f15544e0038915b22ff8f32270e3145ac180f5e4e5578a27a55c15d789710284407fe2375e18f37d027aea299

memory/2440-231-0x0000000140000000-0x0000000140161000-memory.dmp

memory/2440-232-0x0000000000FC0000-0x0000000001020000-memory.dmp

\Windows\System32\msiexec.exe

MD5 e8200e1b8e455b93b419f702fea1a202
SHA1 5e5a918a29ef6ced0b1f35d97d69eb9861812f21
SHA256 041f19a94a2b43b6a249444035b86d0663d7e409b770b35fe96cfd6048cb7961
SHA512 f1869a7a78f28b0a7ebf64d736e096b620c2c15819470ac3b499c2f7a401c7864cec7bfa00ebe3b81f949256dc2849c6fd01c754ec70f90db90f05c891e123a9

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 a3777855b8a44fa8f697040cd7f2cd98
SHA1 6eb53d6a6e97d31b4b187a3d8941c73aed544ef6
SHA256 f8f75fc1b6c227d7ab3772e4ffc60dda353808a181ba63a522d98309a506801b
SHA512 62f5485bb56c9af11b6640b274c44be7223deed1e0420327a10ab894b60298b04c96e017453c6f5f86cd03c69c3c86233271537a684e69771e261db2c642653b

memory/2172-257-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2780-259-0x0000000000780000-0x00000000007E0000-memory.dmp

memory/2152-260-0x00000000003E0000-0x0000000000440000-memory.dmp

memory/688-261-0x000000002E000000-0x000000002E14C000-memory.dmp

memory/688-262-0x0000000000230000-0x0000000000296000-memory.dmp

memory/2204-263-0x0000000140000000-0x000000014013C000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 1b2c6a92813857318f988a0e26c9258d
SHA1 a8dbf22a9eeadf62dd180711de85b8b30c3aaf2f
SHA256 9f0bfba54a332fef6ab68eca4a5655543e1707d1c117813c4e4ff47658461d3c
SHA512 2afd5a05b9f17c96e308be2b985ff8d4591eaae2dc57c4f35799156bb32437bc01b1324f3a2dbc703639ae9bcc71217a2d14fae6775ef6c82104afe1b5f50920

memory/1880-266-0x0000000000520000-0x0000000000586000-memory.dmp

memory/2152-268-0x0000000100000000-0x0000000100149000-memory.dmp

memory/2152-271-0x00000000005A0000-0x00000000006E9000-memory.dmp

memory/2780-273-0x0000000140000000-0x000000014014D000-memory.dmp

memory/564-276-0x0000000100000000-0x0000000100542000-memory.dmp

memory/564-278-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1940-280-0x0000000140000000-0x0000000140149000-memory.dmp

memory/564-279-0x0000000000860000-0x00000000008C0000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 56d2623b535f34c7f984621a441f769e
SHA1 e11a1c3eb8cd9112f9a04b40f4943cd50f6fc274
SHA256 7fbbda31ba4f1dbd3e9d6569413aabf8c77ee4a4319bd2e57a15458b0ec8af90
SHA512 db1b3a26ea909d9098f3e636f508a008e8f9bc7dab40d186889118b8035cf36266fab3a21de8c6fd59ee82763d4921817d12ad1fcdb004cf3559357132a62af7

memory/2836-286-0x0000000001000000-0x000000000112D000-memory.dmp

memory/2204-290-0x0000000001430000-0x0000000001431000-memory.dmp

memory/2836-292-0x0000000000430000-0x0000000000496000-memory.dmp

memory/1804-294-0x0000000140000000-0x0000000140237000-memory.dmp

memory/844-295-0x0000000140000000-0x0000000140145000-memory.dmp

\Windows\System32\Locator.exe

MD5 cc11be9893f7d0609d0b15d8aad328d8
SHA1 c0079b2e38d45dc48a58a02b8091c7ac4b6f25ce
SHA256 3d737caeebaf34d62def21b07d5e859d8f968827b0a105d27b664ba29e2d4dc3
SHA512 9d5ee85dc3a378e4db4f74807b59194e103640d64a2f73414dd30ce368d24db10d916ecdbaa477b9e826a4b80df1d698e89e642282ec69ed8eda8ae079ed6072

memory/856-301-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

memory/2172-303-0x0000000073AD0000-0x00000000741BE000-memory.dmp

memory/2116-308-0x0000000100000000-0x000000010012C000-memory.dmp

memory/1880-311-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/856-312-0x0000000000DD0000-0x0000000000E50000-memory.dmp

memory/856-313-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 f9a870b7445d70e885303e5712d88b98
SHA1 78772b5e8dcb9a5f2edc5ae7a689a65b9ef68bd4
SHA256 dfd90d739904ab03f5c96ceac20615c580882466904bf9de5cb1de8d5a179f3a
SHA512 0edf9137eff42f12bd6e840e78140c61778ccb4053b52e458722b3cf59b556cb46d751da2936dd86074a195b7f012ec1918086aafef98ef86859c7f6698bd919

C:\Windows\System32\vds.exe

MD5 5c62d9d946265a8690f761f33e6eb94b
SHA1 e823bb7a095f3ae7137d51ae0f1c76edfe536634
SHA256 dd36c71dcce4b759884ad513b8fa381a1e6b80bd7dbb232cdb31f586cf3c0716
SHA512 ba088a82be2386fb0e824c5efbd024c69113a24d5c23c411d0183227faf7cd4405ec665028b1d746a6ca51093ab62e7e3bc66c464aa74ebf5eb6cc183d95dbb0

C:\Windows\System32\VSSVC.exe

MD5 ab72ad15e45a687c245b74dacf23883e
SHA1 16630d5bb455633fcb208552db0239dbfcc17ad9
SHA256 5c9a1f41a4e0fad5bf7a74d76cd489294ed23bbdbd866f0c2fdff2624870ac23
SHA512 bc3899a29b5b63d2bdda28991736f282913b5f3d3c66be916e808c8503adddf75a116caff0a7881d887e12b2284bf471431f5917fa1d5b50239c250b082e5b31

\Windows\System32\wbengine.exe

MD5 4274cb2dcbfd300d78c85d711f148b66
SHA1 a21c47263a299930e763201b381545a47eb36c60
SHA256 5e8795a7cbe8458a97d54fdd7a1a2bd3aca64dcb32c14942b9a4d642a9a5295e
SHA512 8177835cb5b28d6653b152f96dbb15d1916599f44067134846dcb0b5377d30b46efab132c530945855ea0a0cd6a7b3871f3c8c5e6abf86c5f0ef3281b2837213

\Windows\System32\wbem\WmiApSrv.exe

MD5 fe3fd38ec79310fae4f00a845f22ea97
SHA1 1256c43a715eeaf0d3468729ee9bb7f6955aff7f
SHA256 3ee8251d881b162142a795267720efec1ba2bac1f02580f4dfb3eb524ccd1047
SHA512 10d1d51f6ab13f9d59a3808dc3fbd9636ed6c1aa88f190c898ece9f4fdc0d0fa8f31203c3db1c2bae0a9827c0956c7ff6cd3d107cd0b50f8506a90b661ad5d80

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 b0f65f5cd1fec91322d0dd63e01decdc
SHA1 00a2d5151febf60857b205edde6fdce28e8f0340
SHA256 455078854fdd1e02f9dc6a1e9b082af9271c73dbe3b76b8349f9120830d7f7b4
SHA512 ea78ce3a61ff1da4e186fa874a2132faf4876f92f381f18c729bb9cb401d3ad97d5a31dcf9a45996f3d90e2e77dc76ab7356f82f207203a03b8b21fdb7c7398a

C:\Windows\System32\SearchIndexer.exe

MD5 9ff0226415f51b4ab5fd29be8adb574a
SHA1 c9f186734377c05c653a33870f5c4e352213b1a4
SHA256 b39a186c6d6b23ce3131d24f9c78147bbe7088935cce002b00163a0530900514
SHA512 5308e97494ab12813ecf73466f28ea4a5bb2e3d229c14dca966aa5cf7e8dcd9e615c01ae10e56752cc87acf7628bc38bed5b15d4b4a7365fc9fd90b56e05d92f

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 40077e58c61fad92519e140e0dc34022
SHA1 2cce66177530344f88e37eb84f0043be701bf444
SHA256 6e3868949a3dc1443296f14a96c93c58e3b50bfc4b177f37ac0b233ed8baa1f0
SHA512 20e5128d8533a27568aacd900a58a947cbbce92dbd1bac8dce44871d1f7edb57b8d303c21c1b9945e386bb42265c48ed32347b3f4b275e0dd835c30eab2f662f

\??\c:\programdata\microsoft\ehome\mcepg2-0.db

MD5 efd89bfe276f5e4ebc563659abacf6b8
SHA1 6f9158810b851eb817d2b32eb04fc72c4a95817a
SHA256 425c5a2f53d1bb29faf532dd6c68101b6e04e87562e26deae6c32f1f3eea3b1b
SHA512 871e8c96ca3daaf8bd0a123d0c396af31a8374572dd75dd75fc729d4e3ec6eb35a8674b4d23eb62c17e34363372316899a74f49bc1f2b90f9e76d9e4b7b49ee8

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\8f96978fc46d9f00d8780351026924d7_bf9bdae1-6812-4169-92a0-a7c2b4bbb305

MD5 db733e033c397fec5917611957620271
SHA1 6f94d1daa0fc4ec1b2d4cbcb93730d8edb77a2b7
SHA256 1f3ffadd3b80c7f95be06e245410768e8302a24e573868da3c6fd91230025bdc
SHA512 9a9bb4cf6380bb0a73ea414ca2226a344c7da003e49610dc38bd10892dc17244e4c88bf8a466131027e3c064c693ad99014e6853fff51edb21cb690b926b962f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 19:58

Reported

2024-04-07 20:01

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7686060a990ca9c2.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118578\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118578\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\goopdateres_th.dll C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM5B3F.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{A57FE46C-6BD7-4436-B4ED-1F7F22B87421}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{A57FE46C-6BD7-4436-B4ED-1F7F22B87421}\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe

"C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp

Files

memory/4480-0-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/4480-1-0x0000000002480000-0x00000000024E6000-memory.dmp

memory/4480-6-0x0000000002480000-0x00000000024E6000-memory.dmp

memory/4480-7-0x0000000002480000-0x00000000024E6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 486d6dd059a3d8aceac6927c942fddc4
SHA1 ab6bed5b3cd007bb6d3f059f37b592dc49869356
SHA256 4b68b7ce0d39ec9fd7a721671e403e7805d0e931d9798afead2e9438f77a2fcb
SHA512 1aa1140a02250bdc01bdd8b0b486f1bf5a65d166b246c03033cd005ffc754d2ab94ade93ee95203a3873bad91c8c7b0f6ee3c0f88b27b49027e2c2dd6716710b

memory/2856-12-0x0000000140000000-0x0000000140141000-memory.dmp

memory/2856-13-0x0000000000780000-0x00000000007E0000-memory.dmp

memory/2856-88-0x0000000000780000-0x00000000007E0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 a05696d6fed9b3574b2e52f1d8991fda
SHA1 e4d926a9c6f6426059affc2d63c96fc3526bd129
SHA256 3fb7df09712494f7f1b9812d85b18959bc13b4d8fd7946f5483473711e359d93
SHA512 00d0fb5ab0ad3adacd109cfef04711845f76f5ce70ba8b38ab7e39e11c7bb9c7ef09e6039086be37bf1f6c5ec9e38ae7ee90ec7fa2bf6423dd33359bb60817da

memory/3864-95-0x0000000000740000-0x00000000007A0000-memory.dmp

memory/3864-94-0x0000000140000000-0x0000000140140000-memory.dmp

memory/3864-102-0x0000000000740000-0x00000000007A0000-memory.dmp

memory/3864-101-0x0000000000740000-0x00000000007A0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 078198e62ee3dcea66522c1a8152de50
SHA1 0f6a828cf208ede3f5ac428788d442c06ff9d56d
SHA256 12e06cf69a115b52c327f891509bb1f003797e29d0a6dbb9145d4a3afe4f6671
SHA512 9deb01598af094a111cacd578399191b8e9e4c4fc2dea1db71d1a94ed7cd3dcbdd9f22f9a1c6818a85cdf2e443a2a0890b09407392d4d410794a75444ff2844b

memory/1472-106-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1472-107-0x0000000000A00000-0x0000000000A60000-memory.dmp

memory/1472-113-0x0000000000A00000-0x0000000000A60000-memory.dmp

memory/1472-116-0x0000000000A00000-0x0000000000A60000-memory.dmp

memory/1472-118-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 84cbd33c0900e39eecef238152780f39
SHA1 e549329fe7b977f999195c039075cfbdb56f3a50
SHA256 ca8ce8b24174e1c8ace326cb0513174f6e542286f69cdfa4be33eb23c9e4d04a
SHA512 f5382178b2c44babd9f4c1010033cd2e51329fee7d2438de761c0ed3b2c7109a39d4f55eaa07aee39b62b251a10de3ed2a73d54b61218ee081b2d684d385c66b

memory/3668-121-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3668-120-0x0000000000C50000-0x0000000000CB0000-memory.dmp

memory/3668-128-0x0000000000C50000-0x0000000000CB0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 dee46910a4bae697866875f63f7cf077
SHA1 16aae51033eab5b337f5b78f3184922c6dd33fed
SHA256 7a9e18bfa3b11bf8d9bc1a2b061f2f3ce830d62747fa42c194dbc8db8b351f24
SHA512 5ea7131fc13c32b33945ed926563a1a13b58ae8df484204f1b76612e620c4a36605b1bed30f15043bb12fd66f81c1f024be3f687527df677846b5bdc07ecc77f

memory/4480-133-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/4612-135-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4612-132-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4612-140-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 4cb4a19864c41389cf2e1aa37a42eb73
SHA1 9c99afb7a8f68997f39f95aa0a4d7ea20c79198c
SHA256 1dd312e57026ed039f28770f97c31c66c755c4ee0aea881a789fd16558721af4
SHA512 13ad04b70d64f7576e1149e9f44be102ceb062a95a1634066396afd0bdb7aa0a6c78a6b6fa3539bbc00fe3c3b8cdd9a3f82955d0b36c3ae1a2f982ba77756024

memory/2856-144-0x0000000140000000-0x0000000140141000-memory.dmp

memory/1668-146-0x0000000140000000-0x0000000140161000-memory.dmp

memory/1668-145-0x0000000001A70000-0x0000000001AD0000-memory.dmp

memory/1668-152-0x0000000001A70000-0x0000000001AD0000-memory.dmp

memory/1668-156-0x0000000001A70000-0x0000000001AD0000-memory.dmp

memory/1668-158-0x0000000140000000-0x0000000140161000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 0858b6fabeb6586940ab5280b1792bea
SHA1 4f878309d4789b76dc51b4421a6eca6981851bdb
SHA256 693884a31ebc9d570fdd05f84d1dd23d622ca52d0ae248f4103ff0fbabdcbe93
SHA512 a87403e4efc94c8732d869e4ff4492aed6caebe6945c00cfb71fd1d1cf6f0763abcef62a70c73237492984ac30d92f561ce15fcdd2ee03864fc2fc1461c90c4a

memory/760-160-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/3864-161-0x0000000140000000-0x0000000140140000-memory.dmp

memory/760-163-0x0000000140000000-0x0000000140150000-memory.dmp

memory/760-168-0x0000000000D40000-0x0000000000DA0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 36f773e6f8561bc7aec521859130dab2
SHA1 4207dac0ac0edd0d887655b59574212476b5953a
SHA256 cf1bcbc6c4c3a0bae2b0f1e3d8c8f721cbfd5ee4ca7737c1ca5b8ef67f6328bb
SHA512 887e907fa9a5c4c0895bf5fe9e93f2bbf0a1a4584e114d2ebbda9112ba8095a42b363a02190a01ff113b3e6aa60cad52411c6ad154e4077372e7e69a6811ed7a

memory/3552-174-0x0000000140000000-0x0000000140166000-memory.dmp

memory/3552-185-0x0000000000420000-0x0000000000480000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 6883e331c4fc3d23178ac4136fc32123
SHA1 bfe6eeaf796ef0d0279f7b2abe6acc70fe7fbf21
SHA256 8661b8f9496ca7618528debbb095587de158ea2680f76eb4b68139d8e5fd0b74
SHA512 b4fdfc0334b2576a63872d56cacd403161f4d9498b52a454106f3d80fbbc789a5d275261c6de527f1033e037cf576ceced8c44f3e47701cf6e2c391d3b31ef28

memory/3668-189-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1280-190-0x0000000140000000-0x0000000140142000-memory.dmp

memory/1280-199-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 676a71e5cb7ec3e17e4569af899f65f3
SHA1 441e00a035c570efb0d594fdd650e91e85ab5a24
SHA256 2950b70b455fd4d185439471173b40af187e7514fb2ce1cadac13f1659b13fa5
SHA512 f363a77f86a675df3cb0be74363c0c20de6b3fa555c325e1737e4d73aca11a0bef5de3121cede4dd90576aba8d84920e13e9ebbee25fad482543e50b824e47a6

memory/4612-202-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1660-203-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1660-279-0x00000000008C0000-0x0000000000926000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 d61d38f6aabe7e1b96b366f851c6a4b5
SHA1 5bb22abc7621416a6941c754bd67d0eb33f746d3
SHA256 eba1e67740f74a0f785ba24bf7d233e66a53f5bef02239b94c9e82f4dadeefbd
SHA512 433a9dcd0236f8ccc01465b310a7b8235928942c8b2e71b172f29f0447a6ce54dd0b96ab3e7e11d6f16952f51bca57188cdb295d62f1d07764229488c176a1a8

memory/4480-286-0x0000000000400000-0x00000000005D4000-memory.dmp

C:\Windows\system32\msiexec.exe

MD5 12162a04ec58738f0978a89d2003b738
SHA1 7b465e5fcd7375ca612fd417c61261335ef66a92
SHA256 e3f86907266d380ee021eb5e2b27a21e3e9dade936f4da95750e547a229eb967
SHA512 917b6a49cc7d1920caf7420846f8db4c98b6384bfa76817ee7b0a21c97cb505bfc23648047412d3b202d3b96ce20c404532e4e9cebd223fe86820c08318a114d

memory/760-442-0x0000000140000000-0x0000000140150000-memory.dmp

memory/760-448-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/3552-449-0x0000000140000000-0x0000000140166000-memory.dmp

memory/1280-450-0x0000000140000000-0x0000000140142000-memory.dmp

memory/1660-451-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1660-454-0x00000000008C0000-0x0000000000926000-memory.dmp

C:\odt\office2016setup.exe

MD5 fd2fe93e293be136da5c6beb4fedd1d8
SHA1 818922fe8010b050eb08e00b2ee37cb499f27cd9
SHA256 f5767182edef754ff9d65f2e34f9001f7fd5f410d23d12dfe86b1f7d8f8825c2
SHA512 14dc79711c094be07a0c587a8114ca8a5deeaf00995a324aaa80d9ca1cbbfc38c395cdba9ff1629c50f26049bae4f410e47c61bd1190401a356df515156b11b3

C:\Program Files\7-Zip\7zFM.exe

MD5 c4403fcc328b0428cfdc458e02a58b22
SHA1 eb2ab5404a7d5a3321ee990eb7749dc83ad6be14
SHA256 a37f8e37487bfe242091fb15507336aa4e062a2fe4cd82aed222678526a84338
SHA512 7dad17fbeec0a486d819a9041257c678573a89f2b3c91e6a0f2bc55fa4d2ff7a6988e5ca9f580a1281267dd5f9a130e162308dd3ad95b3a10982a2ecdbe229e4

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 16f45c26545304590b7d1407072e5c88
SHA1 e29f83834243c0154e7a507469653836076f237e
SHA256 f07d36df4c63af1f63a39b534ec5fbe201d82cc284115582fe33517493f93d29
SHA512 8eb3337d4f6581fbc9adfee5a747aa8f44898cc667a3e26e4ebceae2e2b9f5df8c3a5ec6229c86738c22855a98cb28177f508532c2862401efc4eb59fcf8055e

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 4047d6d653d8e8274b8c007d52086f9e
SHA1 7ff32b6b51a388d8e963be0f28c34753d1dde52b
SHA256 ff2d1c71543fda6fc71dc235d69398e721bfd6ccfd2b17108c3e856bd4085e0d
SHA512 05bfaf10b62ea0fc04d93a66a8f8d1f8f20a30f98643b55416bd1134bcfe01af86eec184b53505671aa81495f38842e89a71b2fd2e3213712f984f0b81082043

C:\Program Files\Java\jdk-1.8\bin\kinit.exe

MD5 edd53303342bb846da2ee30deda2745c
SHA1 21c303ac5b924ac96267ed3ecac41c4f2badfd88
SHA256 e6c15bd0f0919221d624311ee2c329d6f660d53c47176d5d508f73a9116139fe
SHA512 082db7bad04d23e50630c8a856dcbf89d3d9b32817d39644dc5a5f9afeb417a49c82f25cbcde96bb647356269da2dd0c50efe0d9c9c9082838c06ca7a5480e5d

C:\Program Files\Java\jdk-1.8\bin\keytool.exe

MD5 236bd7bdb83517d9de7179bfe9ddbbbc
SHA1 7e25b56a2eae86b4b0183bc39be180ad2759e61e
SHA256 1fc324c33bd7bc8fb17367f701fd5c487ffe25333654a1865af8549a9aa5d5fc
SHA512 4c8923855eaf3ce278b41973937daebb3fb454f5d85f0dc1ae3d9fd35b4d56dc98008f69aa318ff248a5bd55af3110cdaefb2c3ad5b85b075c8e6119c4fbd630

C:\Program Files\Java\jdk-1.8\bin\jstatd.exe

MD5 71407b3441ac854a2b51fa33054a23dd
SHA1 f6b2c0c199ccee8d574edc3b9d72b0bc673b8f27
SHA256 e09a91bdd76b363e07bcc753a8f00b57ead80599609029fc9fc0bd6ed19dd16d
SHA512 9bf91de3983b17373dbaa86ba6afa456136b0fcec2b8b75225892adf9c3a43118396f5d07a1a306c2699f76245fb6115a0ed84579f7e8f040038fe19b6d889d6

C:\Program Files\Java\jdk-1.8\bin\jstat.exe

MD5 8f0803e255c52acb5f5bb4f081ac13a1
SHA1 0aef408da2bcd71a68229638c7d349aeb9ccc3d4
SHA256 7ce47fafbece3cc8c278adaf4bc9d173b64727ec3f1fe23bc68c926b5e7d63b6
SHA512 fa37e26a475a3099e08bad69e455a86d329c806a1b4cb8bd9046ff1f9f7bdec50483832c8715dbb7ec62ccd4440ad692851cb11f786bd5546be2611476838c05

C:\Program Files\Java\jdk-1.8\bin\jstack.exe

MD5 348b040747fe35096e6f6249e1739597
SHA1 5eea3d3f0783bfff49d01fd41515702387348df8
SHA256 02c30db24f73534d0eff1f152fa283982543d9d036dcc5a78fe868627407effa
SHA512 84c0ee862227102e79af371725bcbbeea205127a7e39ba9116e9df885b678066fb026403a314b1c6553acdc1e8cdb5d180a501f3bfe59910251e10d4e4f1937a

C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

MD5 bcc2cb110aeeda092701e9f39494ab8a
SHA1 f8202f5954f634bfb0163bb1f04cf0ea1ea0cb80
SHA256 8931e26d060c5876cf98a87b74e3464db70e069289c36333d122d194a7dec96c
SHA512 81273220993c1819fdd968ad8cacc4f07c63a3a1851ee5b97055b51c7df450fdf8cb6832ac18dd28765ea2565d2d491c1c583fec84bcc8c2bb3c629d552e9d2c

C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

MD5 ee1044e1b45f63581b566316e1b12ad9
SHA1 af92a17298b6761ec8b30473049f0efd19129742
SHA256 9718d5a96b144f2908f7c1c2f0d88edd6a2cec2e80238ec14abb92cd6ab18e9e
SHA512 23a226149c143cfba4ec87cd613f9ae0399bc884108fc705f36c56d7b598ffd6e24a7080e0c243a96669b1b165e9db3f1eb8385ea6e1b5e80b7eef34ba45aaf4

C:\Program Files\Java\jdk-1.8\bin\jps.exe

MD5 3737063cc816917f8a9799b26be48e21
SHA1 9c36e706cb685d4477bde3bda61f5bd11a2439a8
SHA256 c897e712e3cb3dda04cd52ded5f5ac8314d61dd23949a402eae9162b3efa9ab6
SHA512 70baff0f6088f84f38e067a37f204c49c85f45bc8f6cd308c5bbe51d076abcc7528ab2411c7d6c21b92cafa53d6291a9ab276fab1cca5a5c6b4fcd34444fc078

C:\Program Files\Java\jdk-1.8\bin\jmap.exe

MD5 52a90f67d14f312fc69156f799662fd5
SHA1 c8a842b4569bf33ef67cdc5485ee267d9bfaa5af
SHA256 11c782172a133eaa888a15e54bf938fd617ddcd59b6ce740706033fde7c09af2
SHA512 e5e89fae9a7142ea6e03d14833523dfb8d741a0b04d87debb986d964cb48d7bb6545bf93bc7547263b9d7a7e05ec3e7f1f97b2356bf4374fee0217ac20bae8d3

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 52900ce02c16778dc5671c671f27c8a1
SHA1 f49faa683885fbf1171626e808feee0a96581131
SHA256 fef8cc0fc637ebf99d7425936c2e929a5bd06d476879f1d742a42cf4e21448a9
SHA512 69a6afc076c51c712b138f9ca8f390d8473aec22aeb7fc82117f09c84aab802aa31b0b4c07c38e24596c996c764b8968c9a720f8307bd7f703d044a778f8e18e

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 5e02e5f135af4e14580e19c8a8d80e60
SHA1 0fdaf54338c3639cd0228236c759f1a23432d9af
SHA256 5fe2e3680919417e88e8a32fd8facdb21e6aadff222c09b51ae3dadc3fe4bd3f
SHA512 b9a2c93da4c61fd6e09f4b52f3bcdb9d20612af4246d380710e9fc749ecf4d749fc847aeab26366c1df6ac8b3e93ab257582eb17d399a711a00c4d1d9c2f7232

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 5be2ed3d152e19b7a8dd15963c489491
SHA1 343ce28a559b9a3793d04792a162b5168612d018
SHA256 4f000dd9f45fd9a37ee4bf91af1b27327addfc6e583eeb72bc3d4ed3a7f3163a
SHA512 7f0013f7e99b193db285462d32da552c5793384c0bf63bfc05f9d35823ea2c548cb2a5702e57a7b57ec065dded2934b9ec298a0363d638ecd756b538958b9480

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 8d24fbe3ac6c7f97e6640802e8ae69f7
SHA1 851c7b768a146826d1a1468d08b3b56b208cfd6f
SHA256 43cdcb0ec887eb85764081c7d9a8a82cc32cea1481e93d838b802d6ce2db02a3
SHA512 da8964cadade28aec541927e5a5efb1ad33f1d21b5a860834fe1099843eb6ef02c283050026f62d077d6641fa632e0bf724aa22c6e59d10008e0dca59538ac2a

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 ea2af830d6d059f0a6a5ddb08999827d
SHA1 7944f84426cc48c6f5827df4df17ec4f7223f361
SHA256 8012c572e488f1596151a0c0cb6e80c201c0afadd5a6958a2cdf315baffb6465
SHA512 263185d59e1cf7bb2b9e65d171ca22c98a75d195b0854aa150ed284593bd62a4d9d686878ea3b339adba6af41f4cd640f4e17afa3c48f6f117b4adf814a5600f

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 d8d2c3604928214f8523d6055b211c6b
SHA1 cac50df6caabe654cef504dd490b4bddd186a373
SHA256 0bb15319233bb5144f906337411b823401a95870f66f23153b1791130e920fbd
SHA512 e811d5d37e432c0050dd23457eb6945ebbb1be457f2a739a633112110295e51ba389a2b1ca900b38c13d8e62693dd59adfb6fcae151b52c52df9e2c9c976ed38

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 2f5b3b0fe23b92d5cc1a3f291ed0303f
SHA1 edd237b495c89d372271ffe1c3eaa05f9359c3ca
SHA256 56415387d2904f7bda230f23152a9f1b2b8113e6691b2cd98eddb79bf07e434c
SHA512 ffa46ce82cde973a77ab3329133090cbee0d1e2cc1916c35692fb8f54f037dcd92d6795ab3a796945f21909c7956b965c89e4b30cabcd9089e9e1e677ba963a4

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 43febdb3823c0944ccd557fa1647b1f7
SHA1 a2070ce8a7d202ef6e1a4374a036c346f490be95
SHA256 4e8113cfda8e2978184e8328bbb9fdd4c42d82f3a1fcfc69e27217d8359617fa
SHA512 a5494d5364ada4ae77a0bb18060593ba5b2947665dc1bd682572cc8ba2d1dfc700562f1a363ec9ac0dc91e9a26e97c987f8278ec942820de328ed5714b780521

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 d7ab0de1faf57c76b820fed4b8d1503d
SHA1 d44db42faf0a98776370f1170fe348a92bf7bc77
SHA256 4a7a48e0dbff2f8a5b4c1afad77e7adabd8905b812c0d19afb02f126a8564e43
SHA512 e1d41a7edd8746f70125bcd032169d1e4f3d5806c25abc826ea35352309d4d1893b8e1e8f2895b6127bdf431d20ff9ae44882326481b23888e689d872d34f62a

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 3dcfbf2e18ddd1941d2035ed12a6c7c9
SHA1 799d8ce8e3e0c977f31156219116700bd35482d5
SHA256 b2a0ad78cb7fd183a05a04e2cb13e8ac8a9461d91fbfea08077834d1e1816b4e
SHA512 1a026a0fcb1651f975b0074cb07c628d2972516aa5489a24f2fe9b2af52df790ef2b8c7071107996c54153fae10c745de64456cd36ed9076fdacc4f5d5b72dfd

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 2df514dc9f99946d40a179f25695c061
SHA1 f03609d83964f8d4b57fcf3717691fe4b7c2bf84
SHA256 d8bb778ed3c7301ef5132861b391469e5ce5c31471380f66d03b0f7f2cd84b89
SHA512 af817690391c36c36fd740d5e6336f3ea5c57313a452c67928a5f56514a4f633269949d4d37ed78234bbd101b536bc9e8d408cfaf9c80e204ed0c1ba6c06ed9c

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 eec0d61fd5ac1edf1ad90808353811b2
SHA1 c3a0d90d17d9ea1c2cae3c018dbec1c416e5a61f
SHA256 072154209b458fa9907c9c0a7c0fdbd8488da323d1e041216648489bf6478d5c
SHA512 74aba9873fb6c02814071315ee65431148b1427b8858d8ee827258a6438fb10d33c8c317b43cf5e49d45bbfe053468c94723038699d8f48db18663698d7ecb5d

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 a5d1c6b0f2d1ab6ac3a0e609606a43ff
SHA1 9016399272777fffd66dbe6606288f00bbb6a4f9
SHA256 e39605246606c3f09716265a177643b699a56780696a143e9439aa3d8bffaefc
SHA512 b17c18be72101387a2c108f796f57eaeba9d21da3fe5cb3a58f9a56c22c4f5bdf0db97a2fece6ad1e39e853de34b3a90b46b1a98aaeabe813c322c545a0f8ba0

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 583e3d7b2ec64ac80cd7a68781627704
SHA1 70afa7bf68edca10fc558505924d552e9aa40316
SHA256 3b0e8be8ecb97109e5c1eedbd26edb0db4986f5ae272c7cdf47e3c166961273b
SHA512 f7c8dc16cc3bf73ec3e753c2751f70616c8302eb0cbc0e252bdc21e8ad6433bfb9ef00e75cd4d5600899b8ecb7919991681995033f3c7d27bc8a6e3763058995

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 1192f548d70d58a6d507619953311934
SHA1 32cf3cb978333e2735a4e87f0b068bcbd3fe6656
SHA256 59f5aab7351481bc47b27e4e1b2283ff624abcd6f13a679b3a65da9f709b7cf5
SHA512 73ca2bb2e47853dc42472956b97d6db029b09c86a9b8004cab5c79263b373877aebaf17ebb91e57727079bf4e73425632003b8bb6eb63380ccd62e6ec1e4018c

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 6df94688edab3daf60739c7b99724058
SHA1 1c9737324494fc1525acd0a61e339896c482d369
SHA256 31b5f92e34d84e4b4c728bd52d1e453cbb03673daf0717806aada9626f99eed3
SHA512 6e6759236407e49a20c8bf0353f6b4af1f0884e048c1a0a3f76e361d5b76455302b0e69b1f29efb670810662f02b8dbefc12c26840c0e75e62fb03f659f93b1b

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 6353cb85e48ac936dbda1d025b780af6
SHA1 0e17264bcc0ebb0e878f55d1ef4252ffa1fa4d16
SHA256 6bc506734db5b9c991390defebe3468c3e5dab9409d526c844559f68ce2c2876
SHA512 d2c7273920143f64ef0def0ad214e374ae4698b0a74538bd170e4e6cadb26a6261fcf035a540166c5f6069ef60228e816a634e391af68162a4c69261a01cfd87

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 3fb690b2df1a0f581a7df4fb719160cc
SHA1 dc09b2ccba8e52ccdb01234424a097f53ef0473c
SHA256 c62ca7e7da6031726e23f14528803981d401c872286312a1b217125a3cf5a837
SHA512 adfc66cc136d129eee07bc6c7ff8ab81be3a01d26b1f0e0f9c7cd7cbd70c3bbc1f02178ddc35b0edc6e8896046414f573981d05f8256646a0d0e49d41fe5c397

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 09cb075e738b4c214eb1ba2aae24bf2a
SHA1 cafc581cdd3ac231d1e61239c2823b11a5812c2a
SHA256 9c284be189cb8ab3f6f11234c18094508622be9456bcd33853984a01a7fa1c57
SHA512 3c9319740c8a3bed6862dcad4e34a5ffb014c832f53c9071075ab065eda69f9044ae98bd4ec65569ac6decbaad8b6a1b7a0618717eba2251266db9e6145e5edb

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 fb7a1cd9b983398ed2ec44f351ea89b3
SHA1 981451c7007e8be3aae46f6c597f21f1647d54e2
SHA256 ae988adfc288af515092b53707439cc16e98ac93980a6563044e2938d98826e1
SHA512 a1bc7891489817f69a60adc86cbb74663a7e2d57fb593b04d5a7ed35c553b2e922edfab49f07399942e1e66718e9df50a674eb5b70bc070f8932834df688001e

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 1237a613be85b25dc969720930984b89
SHA1 8412265c0695c9535e0906ce45c5012b1ce51e36
SHA256 cba550ad8f77c04f4e1cd0cd8d330a4164f40bef8652b1a0c70852240d84b8ee
SHA512 61fff09035dec193298a3b3d7836799c9e22dd39e33f1eb31813868dd63056dd87dc78bdb18e5b7b6de293e3f883640849ddbd445950481a7b6f344ccaa727fe

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 b86ed1836198996f7e4baff099cbb69d
SHA1 c4b95124002b2175202fa4671d7d02acb2fd9430
SHA256 afa3bb7b71130c35964fea4bdf062d539b72f479d395df2d29742075f21b4fbd
SHA512 4ce9b1efcbcdfebb5489e24b2b0fbd5317830e28e425fe5142978906c4a79ea62e6ddfaeade4da5ebf5e45477adf6375ff4679e23e822530ebf1cdb2ddd7ab62

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 ca1db00b7237f5089d72697f9df07997
SHA1 0b239e66066e169e2f44ebf930b8ae662475faca
SHA256 041e5b56eddf5e545ca285f83314f045b1a95ed419ef22ccad204a078f036d33
SHA512 3815342c08f549494bf39e64594f3c25fa54ff7b0724ca7d888b8dd9f940cdbb9b00774017221487fd6abef272f1d793c389a499af7d449be8e9ef789f4a8b30

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 1b7aae2edab88338e99c1a45c8d2a21c
SHA1 647580b094c320e1d6c0c397489d203abd7bb3dc
SHA256 69ec66f2eccc96dc699a351b94a1ddb13eebf70826f3a33d8f85165804d6b47f
SHA512 99fc1782b4e834f4136f62e2c8e5a96d69f40941b85ecee25761c2f8499e1ed5092323af471b231fa6a0d1a270bb900ca6cad3d938f00f957e16d04658270e1b

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 b3b619404b88217503e9ddcae46ddbe5
SHA1 76b0aa83c6d6214ee1556555369e9511d29b6f5c
SHA256 dfc1c8cd087a3734c67d4df8db89c142c0dade9204a2feaa4d5dbe117b7681bf
SHA512 5ddc1fd5150ee713e44bc51d20f8aa99a480b4896753f0055350caa34df9bd68c790d2fdaa461bf4de122810be84acda10b7df0ed653ca502069a8d04c5330d1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 9c62a76e4789c8401404d8bfad557aab
SHA1 8c1516b54d15f4a306db67034837ed3c28c338fa
SHA256 fcf48b49497832d3c132575e757c5465531c71d34282f47dc99027148422df16
SHA512 51eead3ad436b3c90cc48d7247313145a513f61ce907d1173e1130c1f7b73c1d8d04835d5c2f33401b775796a3984221b5ec5911c8e10e073ea52ac1051ad910

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 35f2667205f2cc4485815b65298f1297
SHA1 684c52f25bd07575a5913fd3d44b7abb3ce223d7
SHA256 5bcd77789fd03aff174d81841dd7e455fe1c71a0c705e9bd92c2e8e80e6fdb5b
SHA512 055724bb61a95f6df3a676d0c4b5c1e19855881c99b9210739daaf392caa5141ef6ac18c6f4d7c33928bd038b23efc83db196134b73df002d7eb446f62eb3a79

C:\Program Files\dotnet\dotnet.exe

MD5 c50fba6f03cc0a329f8ae7a7e3110c5f
SHA1 25900a68329a7b4442d40806f811582413dee128
SHA256 48d186e0863c281c40a6c4b04bad52c78d65ddd17d6632c97fe6ec78cae1e1f6
SHA512 4247e5ac8ee15fc59a6c6b92d17bd1ac7b14e4a06b53d49b0e17befabac22e10f2aded468cbc1989c5716ba192bcce54637e3ba8869e53abc4629e5dda4d3023

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 c402bc88613d97cd5cf3cebc628a11b3
SHA1 e71d42640ddee30be7c5463a85d75279c7db95b5
SHA256 dd3392514a04bc641d2a22f11945f5b381d52c783f9035d60eb62a50fca501f5
SHA512 d82477f47477c1d3810a1be3f6da68576e94e11fd54dca234e47c0f12f71085bb656798bebb19a93faf735462382257d8a6d5d8890cada95e905cf82ea7e5374

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 70a32bcbe33a108d410c13b2fe5a3dac
SHA1 2256010b0da5683921b4b8722e095662aa84599b
SHA256 f57dac0b01ca42a7cd78dd93837c7ff47c6385052edd3d63e92a95b91f15e1e7
SHA512 3aca0af4966ef8dc7422321eb0e7a04831c02e144b4275204da92d6f0fc53fd6189186c6b3ab0698a94e1893c7b543eb82494cf59edc8c55bdc6f434c268a539

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 722a55dff26510fcf861b86622e26436
SHA1 1742b142c47bce9c142e7edb5a63a8be1d0a6478
SHA256 c009061711c71859c762c50f9cf27d5d231d2fa76fab1042e502687872e9c9a2
SHA512 0c4e4f5a313f59b418998bb14d55f87e409748f2fb5bfe2ac9af7150a993490c75749d5a54dbb7cc7b2eb679a54a61f8110de6c8446a3be04f45826bcc831444

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 8bd8f891b3985c122853a96f8ee6999d
SHA1 4ce7f6b332a67cf7c639775e62321f8c9a7faa87
SHA256 b683f8d38afc5b73d8a86ca5f40aa7708c7eeb1369e5b83f0605c5687c6d3581
SHA512 c0d61d212fed2208ec8ce6585fa720dc6624143566f4a2fc4031878604650aff2cbdec1a502f0fbd52d54cb58712c6b781cef6ca7ae494c4da67d9575e2068f0

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 55167f7b0029659f9edc7865c9415779
SHA1 c54a87f8d5a0887ae26672c53cc09aa4e9af8d71
SHA256 94006579e8ce28ea2f3318781312f17b27165f1444d3f2a0902332f4e772ff2f
SHA512 290fc1e795aeaf8ae45fdad4c56e2f8a58e06a4e43a29088f50ce36db6024636f17c0a17dd2ef50543aa9ad7bec323d60b0f36fb16df04c3d12f08f3f2e44cf1

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 1bb0ba6eb76256225a1cec1582d8ec94
SHA1 4d2b2700c6eb1253640d91b7ea2ad3a71446394c
SHA256 ba7c3eb12918425e7cafb69de42660d174d1e1bf51c021b02ab84f20ac208982
SHA512 25a0e9787cbcca8ece0d7b56d1a8924691966bd930f027431583e43587fdc34e893520a4367bb657fa02a3d0019487b1e8d45a5cb542b426ef70656d958fae5e

C:\Program Files\7-Zip\Uninstall.exe

MD5 4772000f7b22bc544c2155d4dc6e1a83
SHA1 64556619ed577d77f8c65475e69f75b253522033
SHA256 91cf4e3b6769f80b76af9865f1271077be5b73a4a7ced74381f7942f68d4f29c
SHA512 9f073d7678158fe737777048a1e30490f62332f5d694b726f50ac24ffbda237b3ac8cc8d6f3a4edd9d7de09daca2edf94c53bff137fae754956664e358b81e4a

C:\Program Files\7-Zip\7zG.exe

MD5 51b736a2d32b7f8192b4f43f4bed6177
SHA1 9df8e102fa96a52cec99b5e3e4f8aeb844a3d9df
SHA256 75e44490fd681b9a85eef086fd08828974d81b30cae03168ba6144a941a84318
SHA512 33aca2bc54f49e6e0ac10c44693b4ba7f6923c9fb114bca3753b05a3d89e778418d11e070c5a705cd888b57b459f29b67e59c7da8e9e7f578c79c1c52cc3d5b8

C:\Program Files\7-Zip\7z.exe

MD5 67d23f6302b84aa6787e96e3b3c29f2f
SHA1 a41aa2f416151d98a4d3ef8d54767cad717f9da6
SHA256 84be79e24126732abead2a3665dd6a97b2c4ea927e13dbd17796c66f46a20431
SHA512 411236a01a621c6f09d97231866d70c473fb0b3fbd07671ca5bbe6ed8ed5d35fa41fe855ae5a8dc4da0778c195cdc00fd0e794efed83e0d3ef86fe7fdb27dcc3