Malware Analysis Report

2024-11-13 13:58

Sample ID 240407-ypwntsda2z
Target 33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97
SHA256 33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97

Threat Level: Shows suspicious behavior

The file 33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 19:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 19:58

Reported

2024-04-07 20:01

Platform

win7-20240221-en

Max time kernel

121s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe

"C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp

Files

memory/792-0-0x0000000010000000-0x000000001014E000-memory.dmp

memory/792-1-0x0000000001CF0000-0x0000000001D57000-memory.dmp

memory/792-6-0x0000000001CF0000-0x0000000001D57000-memory.dmp

memory/792-7-0x0000000001CF0000-0x0000000001D57000-memory.dmp

memory/792-13-0x0000000010000000-0x000000001014E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 19:58

Reported

2024-04-07 20:00

Platform

win10v2004-20231215-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9c3947318ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d873d8fb2589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b8248fc2589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4ac5af52589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006438ddfb2589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004912b7fb2589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f84958f52589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050f987f52589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a09cdffb2589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025963cfc2589da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe

"C:\Users\Admin\AppData\Local\Temp\33fd601b787e76ef2a7ba1b22638edd3b6a8ca26a1ccecd24a363701f00fdb97.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 107.178.223.183:80 npukfztj.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 183.223.178.107.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 104.155.138.21:80 gnqgo.biz tcp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp

Files

memory/2516-0-0x0000000010000000-0x000000001014E000-memory.dmp

memory/2516-1-0x0000000000A60000-0x0000000000AC7000-memory.dmp

memory/2516-6-0x0000000000A60000-0x0000000000AC7000-memory.dmp

memory/2516-7-0x0000000000A60000-0x0000000000AC7000-memory.dmp

C:\Windows\System32\alg.exe

MD5 bc2288d4c3bbe99a0873daae5a3921f3
SHA1 9534b8a3f59f327e245430a6c4988f209cace2e3
SHA256 a19fa28fa02982cc4ee1907ee64be978dbdbecf7691352f43811d291f373d3b5
SHA512 8ed9822d4657022269f5163cf78d2f625ab3d0621d9bcd335be80a61b36d1df9511599e1841eead9ec482f9481d01bc17951eecdde4721550ef9c3f654b35a54

memory/3532-12-0x0000000140000000-0x0000000140159000-memory.dmp

memory/3532-13-0x0000000000740000-0x00000000007A0000-memory.dmp

memory/3532-20-0x0000000000740000-0x00000000007A0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 f8f3e5c0559eda2ee0ee2d0e5f8d4a0e
SHA1 0fe66c9fcf3f32de52420deda1da72626c2b7eef
SHA256 6fd393b3ec5abee9166fd31bbd8dd130af08482c2f2e2640015a7bdc1f856162
SHA512 c0b6fed18e6a8d383efe72c32c411673bd1fb3ba739d7e6fc826d46716358022730f5ed6b2c58bf53462212c2314d758b387284c5508ef901f91a4160f8cc14d

memory/3516-26-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/3516-27-0x0000000140000000-0x0000000140158000-memory.dmp

memory/3516-33-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 1bcc28558e4bdc1b7ca6138ff8181533
SHA1 40a307442d1d4a13d5171e284c62af04bc3ac0fa
SHA256 afc3fb012cab28c52ee2f35ccc6f1c9e6615b2147de6155e492e0bc99bdbe99e
SHA512 1389aca3110691fea13a5d407bcccb69e7b4173aa2326b1c28c4556bbf527e8ccb6eef0832fdbdcaa60e77699a3404358300c55153c0c311a6fa1fd77ab3a17e

memory/4996-37-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4996-38-0x0000000000DB0000-0x0000000000E10000-memory.dmp

memory/4996-44-0x0000000000DB0000-0x0000000000E10000-memory.dmp

memory/4996-46-0x0000000000DB0000-0x0000000000E10000-memory.dmp

memory/3420-51-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3420-50-0x0000000000C70000-0x0000000000CD0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 cc36209b696624a4ef5b7692a0be0fab
SHA1 ed86e1e80abacfde6d05d9be22778e9a6e66c545
SHA256 5eb7dadb0e058c6c2081051f72a6408fe6ccd1766ff516a36e56e782f27f28eb
SHA512 0693ff9d074e23c628b014b572710fb2d5a78c637b158a357801b8e92ae28963104a9ffe302b89edaa55852ebfb1fd16d573438cb7212382ce5d0678cb77d768

memory/4996-53-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3420-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 bc0db18e88cc4051dc33f1415efc4910
SHA1 83a103d2fff85f47b75818287e759e062f116501
SHA256 334116ef2780fd6684cd62a2cda044c67dc3522ca8d88c97b3df935e28d0334d
SHA512 d63072eabeff23f622648c884530434e3434e108aa6082f0eda5bd948b107fe2025aa561c74cb44cd3cc44afb8d51b94c98642c5677efcd03dc79bda68945eaf

memory/2828-63-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2516-62-0x0000000010000000-0x000000001014E000-memory.dmp

memory/2828-65-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2828-71-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 8789436b1db551b225d2a62ad168182e
SHA1 ac60a70a5f18554da3a5f72aa9281c2f2ea84cb5
SHA256 5bb05bbcaa5b98e053f9fb00ece24cd26ed2a40de4f87ea2d6a29cd63e365dbd
SHA512 9d2b946373a0a31fbb59fbc4fc12444f452b74748bfa4c8857a3302a6bfe20c0ca7971b3255a0d1646a04c66da7336d89073448d49c6dcd71e2260c0682b0e17

memory/3532-75-0x0000000140000000-0x0000000140159000-memory.dmp

memory/3596-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

memory/3596-77-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3596-83-0x0000000000CE0000-0x0000000000D40000-memory.dmp

memory/3596-86-0x0000000000CE0000-0x0000000000D40000-memory.dmp

memory/3596-89-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 cd8a933acb775ac4c05ca63602ec33d5
SHA1 95488d812b8de725602a7e1b1b9055372239e813
SHA256 2f461f6d86d6c858d37957871cb57efd5ff2a4cfb86bc55d9e09d58a29dac2b2
SHA512 73f6754268172a0e0f416e4fa2b155182434ae6c53c70d97f5736e53a8772c1a05ca405f7447a93efb1917f11cf73549f02b6af8c82b28fa80455bd47519ad25

memory/3516-91-0x0000000140000000-0x0000000140158000-memory.dmp

memory/2900-92-0x0000000140000000-0x0000000140168000-memory.dmp

memory/2900-93-0x0000000000D00000-0x0000000000D60000-memory.dmp

memory/2900-101-0x0000000000D00000-0x0000000000D60000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 f9baeab1b98abe9aeece61cb302cc59b
SHA1 5ecd71b6b775a5794e7aaacf15301c0694c3c610
SHA256 de330997a89789c33c9359851f768431fc3aef166be5b29e027bc03147ea72bb
SHA512 889bf21c47f229455fc9699d2160f8b344cd9277889e08079676e445ad47fd0aaeea0155b14d4ed174223d637d698349cccdc58b0441cf2ca3bc884154a2b8d3

memory/1820-109-0x0000000140000000-0x000000014017E000-memory.dmp

memory/1820-117-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 928ab1b673d2181961245a6c00761b8d
SHA1 45bad4a0597b9b79d3150df6db37a112bde1ea73
SHA256 38c775356ac002b4728df1ff95eb1c1043f67b890f6d61a48a92ae9bf7fb42e2
SHA512 b2e2b261ffdbaaef5b69b0ffe77136ea755ce8581e60f70ba236cec88977afbe289f7624a2520d7b57f5364658337e124fb4beb01889141b3b80b238d9cb97c4

memory/3420-120-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4460-121-0x0000000140000000-0x000000014015A000-memory.dmp

memory/4460-129-0x0000000000B70000-0x0000000000BD0000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 6971e8dfe3b722f0d3d774c56e2c3b90
SHA1 61f33769e63999a34c03cfa96371ec7ee2d33961
SHA256 d4c72975851b47def9d00ff1acd2b4d7e6f1581365ad00dce505fa488147cd19
SHA512 17e3e721afc31fb9f8c48bced30ee4c9287e9361679679a4f1e3a166754cc5d6d8e3c1f23f4b1bba375a1ae6a9f62b3a35b72267be267ee1d7d44e066f7dc4ca

memory/2828-133-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2784-134-0x0000000000400000-0x0000000000546000-memory.dmp

memory/2784-141-0x0000000000810000-0x0000000000877000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 af13fb5e3f9f840d3abfc8fc197289cf
SHA1 810ff29b12540b6932da59d567894930aa37ce18
SHA256 dd30178e0927f6f70b12d0fa81e96fe116af471dda3c9901520a3ee2c1e781b1
SHA512 aea812636962894e670dc64584eac5f947f166d90a4dc583903eba6023809069cff4b5ba911c1a02f49f2a6a00e6461de0b0dc2d420369f637449e7c36aba7f3

memory/2188-145-0x0000000140000000-0x0000000140144000-memory.dmp

memory/2188-154-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 7bf587dad4b445ca81f34a0beaf94f28
SHA1 366ee562db5641f4cd305a5e771794aa498a3667
SHA256 53bdb0e83da0f61e54ff46d7300616e5411076bf0e05a17faf8ec34d55fee98b
SHA512 7d929282b6a5a5b6c7f112f222d50285025d50741fc3b41d1105ccb81c46ce0c1620bf8a2cee4d38b941a7369c85997a1d679ef9171275380f7a938b4f33f1c3

memory/2900-157-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1704-158-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1704-167-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 1e33263d5eea0c47eab37aea051bd41b
SHA1 30b90812d547a799ea3ab58d655338cea97ece51
SHA256 b67ada0f2bdafbe213d4819b87d07cf811c26dceabd6b7b15171240929f7c51a
SHA512 c3aa6e72b1122b036a0ea62107f7c3e2b5b26e170193d429b45212b8fedf4bef344f8026bcafe66ed9deabe93279ca8a14c2f9d6ca4e420c2874bcf3862f09f2

memory/1820-171-0x0000000140000000-0x000000014017E000-memory.dmp

memory/3524-172-0x0000000140000000-0x0000000140145000-memory.dmp

memory/3524-181-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 39cd758dbc0dd0f381aabd03e30610cc
SHA1 a50f86c837eccccfbe217430c5919f860f711e18
SHA256 f2d8914914e3a5edc5f98852e0bb2ed4f12fbc03eeb71e692733354666bf40f3
SHA512 80cbaf2ee65bb76eb334d9e77761c62f7d56f96cfa67eefb03ba2d879d6c049ace0d274da189b0c05cddf56b290b219d0b8afcbd5597b1323785da52a4bce6ad

memory/4460-184-0x0000000140000000-0x000000014015A000-memory.dmp

memory/3648-186-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3648-193-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 901b5b5b9372d15787c3dc90cd989d8f
SHA1 3d3e22dd4a988de8d0b5712477572f8e16260a74
SHA256 c0c6e8cb42919eb464b92a7e8a350ed1a5cf46c8f5ab92e65a1a44dc308d56f7
SHA512 3a7dd0dbc092e8e56e60bb66d459bfb4690eb2b15aad4c4d75aed58c830f1967fbf7b0574d982b3abfd985cdc5a566f65dc959fcd95d38dcc04b00a3f9021a93

memory/2784-198-0x0000000000400000-0x0000000000546000-memory.dmp

memory/3892-200-0x0000000140000000-0x00000001401B1000-memory.dmp

memory/3892-207-0x0000000000830000-0x0000000000890000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 d49992bc5ae840671d14fb006e2f4ceb
SHA1 612acc6f6c94b7344b6663f7f74a8bb5093947f2
SHA256 0c78246ea1b62558a57f219a74a9c7bd1051a7147d3782742f8b43e5aeadc3cd
SHA512 bb02bc08c5efd5e1cf18fa67f2f005a4a274066f3ca606f1f4f0cf21def13eaca6ae6f40b10957c8fce883a278b99c79ceb777f957ae5a55209965d471ce54bd

memory/2188-211-0x0000000140000000-0x0000000140144000-memory.dmp

memory/4852-212-0x0000000140000000-0x0000000140191000-memory.dmp

memory/4852-221-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 1d4326f2ce03d3a9face2b4cf8a186eb
SHA1 76d03aa0b5a14a66c1677f327290ebb0471c6e98
SHA256 5820be4100bea4709baa6e251821d69929a4de6414701ce1f2aa8fe133628acc
SHA512 2c2635b42087eb00ba4d4987634f2ddd2ed2fc987b447214bebc0c3a723d786db6d10376571df908e5a9677a8608a9b6489d339f98198b699ad1855bba60162c

memory/1704-224-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4244-227-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4244-233-0x0000000000BE0000-0x0000000000C40000-memory.dmp

memory/4244-238-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4244-239-0x0000000000BE0000-0x0000000000C40000-memory.dmp

C:\Windows\System32\vds.exe

MD5 be0adc19a3b52666b9d6611d32df64c1
SHA1 7a6a1c7fad95f19ca8d914c32e03cbef851fdb2e
SHA256 3142eabb71ef25d1855d24c4fdb258c4fee09a719590da9c32a9b9afd728b018
SHA512 793182558b0ee83a4920b819758f0db262338f90b7335d43eb66995cf3057a92e611802d7349aebc06e292b51ceabb6c54e757cc01473989a82134673a44c46f

memory/3524-241-0x0000000140000000-0x0000000140145000-memory.dmp

memory/4580-244-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4580-251-0x0000000000B50000-0x0000000000BB0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 e788406c3bc8e89f2385b3e3e0aad132
SHA1 e59768b28d7c755de0fc0020504cb37cb09b9f38
SHA256 b40beb736c55b758a5654d428b8a1b036a43f2d8baa039fa9c83f39bceb2a507
SHA512 0b8406dde6771953a87c736da3f3a196770aabb22a63073241231934eda4d71b9c3e9322c818867804d6306ccdfccbe48041cd4e35d90eedfe648859db38ec8f

memory/3648-254-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4848-255-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4848-263-0x0000000000760000-0x00000000007C0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 552c18fb555048e22debffa30e6a770c
SHA1 2b4de81525a1b4cfca265a94e8823a02e9fb32fa
SHA256 58cb3a1dbec38ab4e689d6a03dcc07c674659e27ad7e24298895694e1497728a
SHA512 0c62765a9df9951823665aa84756974060e662ffe633e76d334f21477157b69f8f01828a89f197e12ef83fab193c0b4fb54479c5948fc2f9ca45cb872c776167

memory/3892-267-0x0000000140000000-0x00000001401B1000-memory.dmp

memory/64-269-0x0000000140000000-0x0000000140216000-memory.dmp

memory/64-276-0x0000000000B10000-0x0000000000B70000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 691ebef8641ae1550b746ebc67edbaa6
SHA1 a257a4eb8d3e9a6a3e32c73f40760998c626cd16
SHA256 fcf4e44f79507d1d652a64321d40d74aaa31f72d5aed814dae3d238c0091854d
SHA512 32fac0c83c419c18587a9bc5a2313bf75816c1fcc122530232078de97fd7e30a88806fe653c851c4079024001cf6c2f30ff013c09b6ce4e57aa11f7a32c0c1c6

memory/1888-282-0x0000000140000000-0x0000000140175000-memory.dmp

memory/4852-280-0x0000000140000000-0x0000000140191000-memory.dmp

memory/1888-290-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 a79759706f14e56837c94dfd25a3e4b6
SHA1 ff859c075a21819cb4d6b9015022683e16983aa2
SHA256 62fd45d680167b5015814ca9a4dd13665cacd987e612c4023e86989172d7b4c5
SHA512 6ab5c388e1e4ac11795f00bdd2b78df84c79fd97b43840a8bb961284ebf267ad2cf3dbf9a15743cf54219f0527ca4d98549c1f2fb69d4f0be733e7f4f125b8c1

memory/2868-295-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2868-303-0x0000000000850000-0x00000000008B0000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 11f30076ca5da9e2743968a71bf3a66e
SHA1 bb496e935887172a3a7c741d805d5b6a0c8a3b6d
SHA256 8c7bfe1baad654c242382c25c8c09758719434b97311772dcbf3ceb1184c6674
SHA512 4d5dccf501f83168ca54cfb62da8e977a93cc82e55dd417cbd413d60fc11cd67abfb998a168a2c657f4d941104f579df8caa86d7c2138340dd96684ebfe899ac

C:\Windows\system32\SgrmBroker.exe

MD5 061cceeab79af55ca668fdd2d1928d6b
SHA1 550a18c0fdf71504b4825fdc53c1d2aef5851803
SHA256 be762435b777b529fa0bcd212fba592932945e90541a0a0a50d4a5749697345f
SHA512 54ecc895f019225b63780c80e4366af6e4384d9f91bebc0a73a31384ce8fbe69d92692324af7c05e385020d141e4b238ef182f99502152efa9306034058b318a

C:\Windows\system32\msiexec.exe

MD5 023d1c385d0173af6429214bf29ee121
SHA1 4c5eac360f885fbb4d3a98f2308e8fdfd3b6163d
SHA256 6f1160e8b8bbf891fc0a1e625abb27b377897e6bac789af71f58dca1d8ddc10a
SHA512 59b4e9b4d663d4bfd7e088ad5993cd7dde919c53012bfa10a9618796be890237c5614aff2dbbfe8e3f77a773186de89ee19e4382e310fdf53857d403fc4a1944

memory/2516-344-0x0000000010000000-0x000000001014E000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 fa6fc8bab21771a6749489247340b8e6
SHA1 d79de26ded330559b92f56800f4952fc5bb2c00d
SHA256 cc0548bf439e58d512fe8709a64c94c93149fddef3338fa075a1783413173d6c
SHA512 f5188de210a482adcab76be5263626b2709634987738e6f07d34293447dce3d8b959819d8b58cec0f189c4dda50eeac77b32115d39d596e3c52a12db6cb3dc58

C:\Program Files\7-Zip\Uninstall.exe

MD5 9751907e896f75d1c731fd6481dca468
SHA1 12248bc553b3a948f674e5d262fb1bb138ea9c87
SHA256 265c0823161a1abdf828eced1e24a12da76a9efda85db824b538f3e8d5288b4f
SHA512 26cb156dc4411f75e9aef4f417af95d7b317854fb0655cacdc44074c061cc2cf3e537b7e421ce7925448385c7dbccd034ba58e9a4f286e2b3e0c991be5302391

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 bb2d550fe3ae569c817c1f3d7e8b23e0
SHA1 bc3721b378c8c3ee749929805cec989e7deff045
SHA256 bed4e18f03cb86893da20de6ee8a181b357569e81f2d11a5c5ce465c2e61acc8
SHA512 e7bb06c781444ab600dc8b19b327ff8808fee6f0d265ca03527456e885bf9c768972a0122df83c7ffc93a4fcdfab2192903110881729c1eb1f0791ad0189164e

C:\Program Files\dotnet\dotnet.exe

MD5 cf2ff9b7da54f019ae514b1a4aea73cd
SHA1 5911953a6947a00b2320bfc80493c3e966bab8bc
SHA256 0411dad9943138e46d712464008e43ba03900b2a60b503681c703a5ffac022de
SHA512 ffe70def7f2c9311c31ba24b2df54f7682c17ca7600d3d5243d930626bf5a7f550dae20d514cdfd83dcd5063443718f3f5dd6587ba14ddcbe981f9964b9def75

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 d462e0fb06ba3c8a0f8a9e4e5037075c
SHA1 8ccf8d1a2e6e7a484ec89cd7699ec87288f8cca5
SHA256 d2785da3a373f40200351f2b7d3169e1c9e22a6f93c195fd8b57404228f57ada
SHA512 fadcdc68d60066052126226a7bcc671408bc35ef663e4010bfd79a25b8df9edb03b74d04000248c566b8070bacee313178d3e150e18772e5060d20502bde714c

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 0e794ba9e354c425f8a2e15b74f6a359
SHA1 54c18c55797b113de65e41388ff0e78abbc5b1db
SHA256 f43427bcf2f97efb2d2cde93cca289b62db3f061ae06112dee75e07331dfa443
SHA512 182568f7411cccf968691a6a4aa6f47ccb26bb5d5919f859cf13bb30f302636e4a87d48bf2588d9a83ebe993aa596062a6c48bfb805f0169d37f422b24a7241d

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 2c03378063bf21f865ac13ba814c270c
SHA1 35856c872fb46ed0034bb345c41d03ea07fa3890
SHA256 8d8b401ecf539141c88e7feb23085e00d1264dc8092a2573e1ee21bf9f40a7b2
SHA512 6495dbd9e025532d404693d8852f4ceb4867895ebf6d531affb16d467ed38546a62f5a57994e37f3fb649685950d5da79ffba1f3b7e6ed5b5caf512b4c5e7115

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 2fc044bc46c1843f87ec181b86f83bdf
SHA1 bb5044b113d467d20becea1f1cb68f03636d0fb0
SHA256 09a5dcfb732d73ec83e35afa62df31a7f4d990dbcc1f1b204218d88b56dd554d
SHA512 d7df97451f7976a05413abdf003d5403e241fbd6f89503a160e5c69911b0c0bae16377c493e83730bfad6d546c4cb66fabd339a32ce8b4355f881371f76f38d4

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 740b6df4028536ca2d60c2946c81904e
SHA1 0b76c2abedba83e3d1e9aeb9cc59921662430033
SHA256 cdd6e5ceb7d9f8f435c6e5fd0d88e8fc9b47746d499ebf3d30dbb6a6cb55100a
SHA512 df6c2ff5a28065f2225d27e923d4306669bf0b9681997c27c00608c446b551c3b0b30f062781306feff7362e1a0496c3a8367381e5481b2922beab459ae7e768

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 b9b0640c0443a8a938f8e4c814d9a523
SHA1 dcc5b598578b0c48c18a383e9100055f1456baed
SHA256 f8036dece19631ba292b01997e38bce7fe3d672bef3d307b909300123ac458ef
SHA512 9ca0a7440be00cf968c0b47bee0e2bffea6411d263aa664e0c28847e3c5882f5a8fa5153c93ccad7f2d6058554a661ff6c728c76a097576643ce25e031ee6617

C:\Program Files\7-Zip\7zG.exe

MD5 df7dc6ceae876b5447642b5df4ba00f6
SHA1 7c7c4d1178d467f6ab5ca020c3b41f1f33292705
SHA256 4ffbe1e4db19d13376d53a64cd1b9b52239b7febd35dca060e589ade3a134b16
SHA512 c393b2c957796bf4b23f08f795751213a3415e00a00bcae2bfdd305ee3198ed90cab825ec1296e3c9a76261febd06c3cd66c8cb128268e802b120581d6c83f31

C:\Program Files\7-Zip\7zFM.exe

MD5 257b7a36d2126e4fa3b78b68ef188b60
SHA1 16c5b19f2c68d3ac4ee9c7bfb78a9d23b8d14ec0
SHA256 9ab09406b9145ac0b5b50c45b2194600decf33125a660a3a36102378a1394dd8
SHA512 f428d1a3f2c2b441ba63e767af98ab6e21bdbfc87a44bfca3502b634eb9c510bd7a86bfe9d8fabe9373443449e43d5f4e1721d1d3be59317ac58c97dd0c4b4c6

C:\Program Files\7-Zip\7z.exe

MD5 80fbb2f109d96ee3c33975caf83b56ff
SHA1 7bbd32d5942bfcec036d73cea5a0589b2d82c45b
SHA256 0f65e23e1a99ccad7ee02e23c88aafd3d199d750cab78dbb43ac75898319dcc0
SHA512 8538d95befb3123755d6db25dfb159352693865b44f47aed883ef69e3c3d1ce293ccfbd6a1efa1acf42ca4e66c3db258e462f5aa07ed32366cebd7d067699c28

C:\odt\office2016setup.exe

MD5 95152ffc048340f47a8d242c9d277d26
SHA1 0d63a8f1dd55d0698253005c8c302dbeb1f2e5cb
SHA256 96ecfe05ae7b50ac9bff0a43694000548df83d5c61f882a94ffca99fc5527df9
SHA512 80dccd19dce652d35d98e8a16acd115bf2898131bbd40fde4f29711bc548e8b363180aa20c395b7abe1c0f8d4166bb9c0d0648bda966decae368bbe01fcb56a1

memory/4580-516-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1704-526-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 6bd64fdc362c2fdbe590aa263255c244
SHA1 6636f16286a2b6c3591a4b3361e40d614e45e984
SHA256 3374155e985e29d4242adc43e0e794a29f0f98a2e712aec42152bd1ebe9da668
SHA512 65ed6d5a682f98e7362bc2c927facb3db732f1d9b82737e31a96c53bfa3154f398599407a7aa5077a1c2795ea78f82d13a1ce3dd77c5c43021f7f33903408767

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 f7b7360de84a6522d8c52e9531eccc3c
SHA1 ac0a7d323c05977d70200a17643d7af763fc52ff
SHA256 ad0a556ce64da05e30cee93bd486fb9d1e4f6c7bfa93379575fe4aca193c1808
SHA512 d517919ad406879e6377c8247ca13398875ac6318952b1e8fa36535808d2d56e6363c7153d8ea51da96f2ccc8203f4fb23c13e159ad84596177384328594d144

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 eb241fd5bed7550011964220655ce321
SHA1 f1e6c6425b51671d9ce7cca53f8c0e2eaf80fcd8
SHA256 ca27bc6c719a741cc4fc5adcebfc39b84909b32c6d6385ff355a37c3d92c0d70
SHA512 20cefdd8bfe4d3649b57335ed23d540e659254af4216e48cb84d4ebc07c37eea191d5a73ba3e095973411a971dc8866b19c9b042201f895bf1c3aa6addde8fc4

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 142000d4f5fcb90a792dd66acc5f0430
SHA1 d5a1397fd60095bee012ada7ac701bdcddf07ee6
SHA256 35b937a73b4650db7c0f1114cb3b2215e1478a87248ded1b26ac2bfe87818385
SHA512 4728ffb70e22d70ff37bbbb76c675afa83320642d5ada7a16a16d3c6cbbeda04218486c19ecfc86f67aef205a079047f3444ea8361c06f75bf7348c59a96e8d9

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 bdd5527aaa97d96f6a867eb7a6253e87
SHA1 5d84def0953d604d6ad1e3c6596f5b35ffa29879
SHA256 99b2a1cc80c495b82b32ab54dffec12eec841caafbb84df8060f0e706c2e2eab
SHA512 390951b0b54c74eb2372d3779b29993b110b58b48a2e69eb63135e1f6eb5f1255e30a2c170c7ff60ec089d4165670d3159e07d7f3804f5fce6a32dc41c4bb6bb

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 60d5191907b6e6fd4b4e66169101a581
SHA1 c398decc26340d1f47faf788aeba1557f5c7bdc8
SHA256 be59489ba1dce92367afaaefc8b465dd225a7dd04094eb7cb808a1cae31e864d
SHA512 7b3078bc97eeede6e8f0e4694fb674d9da0a59417be50a2941ad5de535310881fecfb343b6f4996a9135fc62940b445c1bd35f428d716b655915b594f4d3e354

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 ee34dd00c2ed5d9b62df4ab62c062c5c
SHA1 72dceb4b12eb1b850b741d0d0bc0fbfb85d66141
SHA256 a0e47d6c1bad4b67e7b0a4691386293e74b3d5612bc897c246e1e6746069c536
SHA512 2b977658e79b7e90dd5e7c816a9031fa05baa80dc404c865df8ca763f5ca75dbffcfae219b5bc04475af564fc9d017bcc8023b084604695059e3884bb0957897

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 6e9be5849df28e6ada7f5235b73b357f
SHA1 562a5567cac473889918a09a47d2dc634872b009
SHA256 821c0b792521922084f762fda291099ac494050ba859f91b89e3e84d823ff048
SHA512 52012fdc606d0998e40418d90714a1d96845e707b544d22d3783d372031e5398936ddb391106dabf5d299261e2cbf1331c4f03f60d6814636f9ba38d7c131661

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 f7474eb47f16130d053428731e769532
SHA1 c1a3fd088be42acccfa56a900195ea1fe669f8b2
SHA256 6d9bd4d9aefa5f8e15e04de7b55ded31245c34de5ba3cd4b9591d821d82ca882
SHA512 a5025ef088d374e334d613436704a7a5ffd45c1912fe3142f24aa06b550389bab1a6cf5029190bee65d15e8624a3c4d0075b5eb8467783cc2cdfc6e5b1ddc26a

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 c3c56207af9f574e72f89e8c47936f82
SHA1 1afcc512bb7411d10cbd751655007f3fc14a583a
SHA256 8937ee489ede49470785f13d82478329002ec2af6fe11c6d63d534f7d042fd27
SHA512 74f0dd0a8232e71493f43709ea512f9100cbdb424e96827e0a14c4fc7b1250efe86c488cd72863ad964eadd4015f14ecdd42d297c802defd526c0d3102c050a2

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 04b013ef449b08346b12b805ab64830a
SHA1 4612618a979ec8d97323406e897127b1b2a29037
SHA256 660031606f20488eb57baa82b3fde385e0543cdc2e5e57b33a871613bdb3dd12
SHA512 80cc342a26af6a1d97338b4c9b8c8c1362d6afc933e7601697b8211b85881934e106690b01485fbc322279878aba6a703e8a92ef50aac240499372178819388b

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 cd301a2ab7ceb6fa1c6e896ba69bd1a1
SHA1 4c7237597d70a915ae753f86da9054223c36b604
SHA256 dcac961ed4d7ef8a61c461cc1573d019dba308370ed48f0979d61e1ad9735986
SHA512 be6db1d980affe751d4a28747074cbb28ccc44b260743dfbeb702928558704f22860ea0f339bfa5065137338bb2df3747cbdd5661ed622073d161023a3e817f4

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 580a2f7d8a8c459806fdb6829ae15f43
SHA1 37ae0d8cbe84fbe3205516573a326f4033dc8138
SHA256 84330560a65f29925e2917f7ae4763d63574992eea36ba19f21ee2d9044eeb63
SHA512 df6c9f0d892e95ec1de1fe4b341fab5e3ea3b6c66ab2e79abe1cb14d75e6aed26710c6cfa2d41f991d90c8cbd470b14581aaa21bb7136e282a679372584e1d13

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 9afc114d05dfe3ed17d54bf304a80c98
SHA1 ae4736a46958f283dbf4e898c33d7801e6df951b
SHA256 fdf4117529562c7f002bd3d95babca84b2970e208ea92b5c33fac9b4c6d48ef0
SHA512 662bf85833651adb88330e0fc2192c815042031e646ff27e109a4ad5aa8361b200b63467d3b1d3cd12ea322e0dc268045da2aa8e9c885cfcc59ff89e7ee963a4

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 120546ac0aa231e5f65f4494f74a80f0
SHA1 47ca6ead1c9239afc9101559111a3bc9b98550fd
SHA256 26b3eb201aee6e874f8e36a1a965288e0d7bac03bed67c23a6e0979f1b110a19
SHA512 0612163203f5cf2dbacef922675100be983dc3eef83f284beaa94fa150918d7d3adc3436e2c6b09ad92b00f609e5538155ba6261f895e696f5e90c21f4e05577

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 e831f2a9a1b37146bf92845e0476c3fe
SHA1 ac1af80524253ae9d1efd470cf9cbeae0749e81b
SHA256 87fdb9a310dc8990ae1509bfb63096126883775ede4896365957aede10ad440c
SHA512 85a38e136d03ba24aabde310840f8eaaf0c4dd209a8982d3c5ec1c8751969ea2671aa9c8fb5167be3df9ecd47f8ccd42306077cd609993c69b44161c3532027c

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 60c1d8f867b8c4c38d3914a67d99f0fb
SHA1 bb551e045280acbf929887209af63db2f5089412
SHA256 10bcb6d91f5e3029bf923edaccf093b1bcf7bd6364ce619858e324f7fa7d95b7
SHA512 8e2ec5a9a87efac70ed1c55eaa78b00bff1123d6f7fb6f79c1aa0bfa9c824b58065110762990a20b09af15fad42890dbdca8b164a10d0f3244c3dcc77facd981

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 1140a3373e2898510f2f16bc31498fe8
SHA1 162b610804e2c5fff1af78033a9175294d13d825
SHA256 42be8ffd2ccd29fab6882e8130fc5a914bb6c41eed65438ffbd528bfa80df0e4
SHA512 e27b459879ada4a1195c34ba7558b761bfb86b6db99d7f274b9356c7d88cd4650d79bf26b638d7ec0fbd546528596b0c3ed06c9e3d078daa255b725ff0913f89

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 82423fed4f612f1f4abecd6c69bfebbe
SHA1 73754966d22733df309d53519b02db18662bd431
SHA256 8a8198ad8ea06fcd4ce57df37a16a17a385c89ea37597ba55875c11b52a92b0a
SHA512 03cbc377a9308fd6223437e30eb936414881d45b1d41f4745bc53453b35d2fe8b3e0ac059cdae9b224052c3c0f46f4649e9fefeb2b7009b23809e6afaa567fa8