Malware Analysis Report

2024-11-30 04:13

Sample ID 240408-be925scb52
Target c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414
SHA256 c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414

Threat Level: Shows suspicious behavior

The file c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 01:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 01:04

Reported

2024-04-08 01:07

Platform

win7-20240221-en

Max time kernel

4s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3f53ae11ae4ef42b.bin C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe

"C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 254 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 240 -NGENProcess 25c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 254 -NGENProcess 24c -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1b4 -NGENProcess 184 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 278 -NGENProcess 24c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 280 -NGENProcess 1dc -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 284 -NGENProcess 280 -Pipe 1e0 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 72.52.178.23:80 przvgke.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
US 8.8.8.8:53 warkcdu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 whjovd.biz udp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp

Files

memory/1928-0-0x0000000000360000-0x00000000003C7000-memory.dmp

memory/1928-1-0x0000000000400000-0x000000000049E000-memory.dmp

memory/1928-7-0x0000000000360000-0x00000000003C7000-memory.dmp

\Windows\System32\alg.exe

MD5 860fa3be8da5de63e7c805b54f528e75
SHA1 047c5bb45357e09a67f860565a33ce95f365f858
SHA256 8b0969ce5d0f8fc1d574c076597b9adbae76e63a822316f93329bf04acd2897d
SHA512 88416502840ab9c1b9dca4f30ba21e2c27dc50e5f733e719ed09dc1b323dd53511284ebf847b57f6ef6f5baf8a27555f2f9d56644aee7f8010db4910b18b99ce

memory/2228-13-0x0000000100000000-0x00000001000A4000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 6506818014791dc46712df6163a647fe
SHA1 72ebd84ccb8cbc9f12eb2ca0b6d89c1405d6187e
SHA256 d47e18dbaab2df002001994b4d0cb11751c1dfdd60aef14dbc0334055cf2a725
SHA512 90cd52f6f2cf290fcb64b72fe99cdc7e9d633aacdb0cb1c82089f0f76f657629e792e42444febdd3357153db466cb9f7ff29100362d8d46ffcb1310c7b7f4ad2

memory/2548-17-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2548-18-0x0000000000A80000-0x0000000000AE0000-memory.dmp

memory/2548-24-0x0000000000A80000-0x0000000000AE0000-memory.dmp

memory/2548-25-0x0000000000A80000-0x0000000000AE0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 04286d1ecb2d0f5a219ae2f69cdf7257
SHA1 a39a3131ade126157b0a1bbf4c1f03ed79386852
SHA256 6b427186692671e2da1802739031c3a2a00688ab37ccaa1c357f2e057fb340a1
SHA512 9f7603ddcf0198c2f69c17ff42687d2b4a4da98ea191537261cb90e2087922310cfd5abc12f29cc9e43b04047ebec05e3f8fa969443c281b1cc8f0a7e64aea6e

memory/2560-30-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2560-31-0x00000000009D0000-0x0000000000A37000-memory.dmp

memory/2560-37-0x00000000009D0000-0x0000000000A37000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7ce20017c6cfa1db8df2c6b7e5380548
SHA1 99cead89b04d862532cd2c62e52b985fff330081
SHA256 534cdd142de8338d833e15aeda815881850dc4d0348b09b67dc06d2a6492457d
SHA512 79c1d2d50223abf479e52a41fddfe1e76171930cd0e7da5764d5fcf58cff626cb040892eb319c41fbd4c23e178e64e1c422ddf000d6054caf00ac0bc77ad5682

memory/2624-47-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/2624-48-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/2624-55-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 0a3492625f9e89916de2a9bb605c109a
SHA1 cf8c3a90d469706fd8ca3de332a3088d301423ab
SHA256 c8bba7d335d7abb9f42c2a8b6ad046b9244ca035f52ef44cd937319bbcff408d
SHA512 647029f8437e516c183bc2165103b405a7835b0b7472dc188aec5c07e8860a2f81afe3edb3b828162e051b802f9614adcfd058a64e05df4a1bb6e4991b74e8d5

memory/2560-66-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2848-68-0x0000000000400000-0x00000000004A8000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4a2cb9cef7648541c40387e62deb9e11
SHA1 2b2a8ab92c33406623f9f85827156561becf5bb3
SHA256 4b6375577f80acb3e6e7c38b8944d82290a0a6981c839364e7c25be12d3993d8
SHA512 97b6c461aeb006456adb9b91f7c2c03f556119e137d8e30dd74f99bdb6755bfae0cce5a0b184fde2b167a00a6b52d2c386dadd84214a935e7d799139bfaf9fd2

memory/2848-69-0x0000000000230000-0x0000000000297000-memory.dmp

memory/1928-75-0x0000000000400000-0x000000000049E000-memory.dmp

memory/2848-74-0x0000000000230000-0x0000000000297000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 d57669e53234ed11c07b5d8093bc40cd
SHA1 558e4c100338dccb955ff51093f045d66136cb69
SHA256 f66569d401439bf951e8dc93ef1330b63bb52200473db5866a6cab74d6fbef36
SHA512 44d32b04a1a09037911c1b2ac8e8a387d83a4ee11e6be849e586e7edd08bf7df9c6309c209c8c657b47321cb7546fd2e2c85401275afd575dff1cf405c08780b

memory/1164-91-0x0000000000400000-0x0000000000460000-memory.dmp

memory/2228-92-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/1164-85-0x0000000000400000-0x0000000000460000-memory.dmp

memory/2624-96-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/1164-84-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Windows\ehome\ehrecvr.exe

MD5 8a1bbeea2f2e0844b428c1f304e7b59c
SHA1 1c609ba5847b9c461966cbdef23289a660a59bf7
SHA256 679855470ce0ca379646911ea74165ae0357398d5fb9b3cac51a42cec27078b7
SHA512 ecb82b3a301e9aacc279baba562193144da1863a9d7e0c67f1831847a0d389829d56bd463207fb2eb35ed290551d4c3b9c5b262ae054e4bec72d5cfd8ec38d01

memory/1556-104-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/2548-103-0x0000000140000000-0x000000014009D000-memory.dmp

memory/1556-106-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1556-112-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 0814db147f39b8c58511f180fb84020a
SHA1 70314516dcbc34b7c6f7e9c6a19113c3fe536faf
SHA256 6e71e3f4e88b05380130e9f63535d328c8d3b55747c46c9871d319263e7a48a0
SHA512 de5e56aa07da65cab5aa34bd1beb21f9cd9beeedfb7d92b1b85391ca26a467438ba050352cac751ac8939745a9291167995c9d94b00aac4c7ba44ff485b9a056

\Windows\ehome\ehsched.exe

MD5 b1a759da0e585094160c4b883b8b364c
SHA1 b06d618ae6f9aa54820f360506fa0971f0f1d5b6
SHA256 4aacc5e68a72b5e312ba191e200da6aab76a97fac8bb74d10181a862ebf194f9
SHA512 b3677d3bfca55be06bef8ff2bb7d271f6506414006e03beedda4cd7116a612feafd78e2a9e5eb0ef20ad429b094084e54557cba904716422fcaf0ba65ab2239f

memory/2620-119-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2620-125-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2620-126-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2620-118-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/1556-131-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 9817d5086dbb3eff95ced693bc88fde2
SHA1 b32a002b2ece5b8de7f299939ef47d60cc44afb2
SHA256 e70fec3d7e89730b49d0f235bab8265460ff7e9782ffdf36b76e0f06507bf06b
SHA512 a85443b984ab9444df5bc837a50ad0454f7f9e6d7f535155fb0d004192dba360049ca10f5efd900cff4473cdcedd18b2a36dddd92959737447787c38b456cdc3

memory/2716-141-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2716-143-0x0000000000320000-0x0000000000380000-memory.dmp

memory/2848-147-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2088-149-0x0000000000370000-0x00000000003F0000-memory.dmp

memory/528-148-0x0000000140000000-0x00000001400AE000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 bc931d4efa195eee43d75b6e55f6428e
SHA1 f9aafa6a0d9a14557c932b1dffb0fdee177ad2ea
SHA256 aa7606be890932f04e8dbbca59cab1ccf9c81f14ddb4996c12e55339ea02201c
SHA512 ae4dd3676fe3e8efcfb760e0663395f819db082545840c8cfdcde65670f68d750d94a8b4ba5a6e116b041e7780be2958d7e893510bb017d7a710f72b0e46101a

memory/2088-150-0x000007FEF40C0000-0x000007FEF4A5D000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 7c373fdd93fab4d2af6ac59e1e58b54d
SHA1 ae7e87d40a1ff25e920685975da1b776bc989b6c
SHA256 d07b5ee13b59687e65201b48ee6e24c668dffa0342d034c8a2c1e6ceecb5363e
SHA512 983d3ef608ab669c49725a48b30206773c5d0f550d2b1c530ad6d29f593c4da631febb10c1b8dc4727722e9bbd012c8364e30ac64427b97b24e8606aab3e500a

memory/1164-154-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2540-163-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 95246fe0582bac671346c6eb3f69fa5a
SHA1 65cf510068b66f0a1fe194194f73b457b8348a80
SHA256 9327af4ffc6b406ce4e00ca89bde72bfaa3f95ec35748db33b885aaf3d7fb511
SHA512 7a1eb839669a2bdcbf7cc68457fd401e7330a09d0967593cc3d0bdad30a8b6201cbb6308519c3c3aef049bf96cff1c95c46e9fe18e39e3d7fe413994d0f0675e

memory/1260-169-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2540-171-0x0000000000280000-0x00000000002E7000-memory.dmp

memory/2088-167-0x0000000000370000-0x00000000003F0000-memory.dmp

memory/1556-176-0x0000000140000000-0x000000014013C000-memory.dmp

\Windows\System32\msdtc.exe

MD5 1d905d7d54b99626ba1a060a426203aa
SHA1 8f1f3848429bce1aaece84387c8d9d2e0157c4f3
SHA256 fcce8e0a3d43214266c3af65dbac51a928ff41520613a86b5766fed1e1426403
SHA512 80771116c29ec4744b78a5527e42471997002185b3ca2f89938b04ef8f22356b65e4f221079398af1e95a98b5db557a25e3688bc0d591e1319bb37360e0cb18b

memory/1812-182-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/1260-178-0x0000000000FB0000-0x0000000001010000-memory.dmp

memory/1260-186-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1260-187-0x0000000000FB0000-0x0000000001010000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 8f130fdcc031cf0f7591f02541ef118e
SHA1 657bcacad5ef6fa5501c9f2e42c617a62d700243
SHA256 de6ee6c3b208fa21665807751cf19a45a38a27588cb2e27c93a05e6b7e6f0b2d
SHA512 f8fd8b67b1e583412dbb39e333861de7e8ea329df58e02c519d513d1ceebf65c6ee40b2e364c63151236263b1ca0a0a34e5f376b06efe3ce7cc60e37d456ea0c

memory/2620-191-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2900-192-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/2900-195-0x00000000005C0000-0x0000000000672000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 c083a8709c3d2bab6c484337ac6ff113
SHA1 e572d3d3c342a4dcdc288add90451c342b54a909
SHA256 4476facbb2105994cbad6c59fb02d401fa12822eaf5dbe52da9fa0e5c4220579
SHA512 a11898392947ebc31b5d4e496eec4225880d3bb7559ae8c5d221c75d56f09936e018c97c720d99abfeb1063c8e73047b1e422fb2d9f354fdae1dc9c4a1e41473

memory/1556-198-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1964-201-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/2716-205-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1964-207-0x0000000000230000-0x0000000000297000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 ccc8053b141b14ca68b3f8766c5b4d7b
SHA1 52a30d28cf3cda6b20a08b6957feb5390d2e7917
SHA256 c5dab74b83dc45f695e8111f8c9bee5ebca05e657348ec91b50cf57c78ebb671
SHA512 e7db1663fba594d40bb4fb52032e0c276f91b06b042953d1f4380d69a39eb562c92f599e742f3c8aa15a7ef7e2b7c22152d3dd62c23e95204773749adbadec94

memory/2088-216-0x0000000000370000-0x00000000003F0000-memory.dmp

memory/2088-219-0x000007FEF40C0000-0x000007FEF4A5D000-memory.dmp

memory/2456-222-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2088-227-0x000007FEF40C0000-0x000007FEF4A5D000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 14843e8f3eae2dcca467e607768c25b6
SHA1 73a75e6d32860ad13f5c69d9a4fb1935d17ab86e
SHA256 6c021b6d074fd9be3d9a45aa11d21dd99251f5173d552bd79a22d6bc6b9b8435
SHA512 a45f0c74b181b98f815ab9a69b27cf08da0d080645edae7e48e4cd9e1d164ceae26494bf4e66478e878d6ac5515dd5d6d393d5f721d2f49331ff69291499950e

memory/2540-235-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2456-237-0x0000000000270000-0x00000000002D0000-memory.dmp

memory/1768-238-0x0000000001000000-0x0000000001096000-memory.dmp

memory/2088-239-0x0000000000370000-0x00000000003F0000-memory.dmp

memory/2456-242-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1768-244-0x0000000000170000-0x00000000001D7000-memory.dmp

\Windows\System32\Locator.exe

MD5 946dc1e4de8c63677b2a7ac8e95bf25e
SHA1 aeec8d0915a65291e7bca3cfd92abc00a093c1a2
SHA256 27101142884e58f4a42f42652276bc0a3aae96fdddbe589aa99e20310cb16e29
SHA512 65404e8471ed6fb9a350edda845a34f7567b3b7b2dea742cff006b43e98473e77b6585c73b0dd0fe8a043ac2310922535f4c7e3bb82ed7377fb3d397f0bcd48d

memory/2604-247-0x0000000100000000-0x0000000100095000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 3c86e85495df98b675116990927cfb94
SHA1 407619ff7b31b4a6906e8862eb048cca300eaeec
SHA256 95245983f629b36e8443e92fa986b5284b08b28d41410c720f289349e10c83ad
SHA512 da90a86345449951c5d0f0faa1451ec9941025e5d92f0f4774fc833b7439c2532392925e449756cfb0849fb202e055b70d8674970c3892179d21860e3ced9515

memory/2840-251-0x0000000100000000-0x0000000100096000-memory.dmp

memory/1812-252-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/2456-253-0x0000000073A28000-0x0000000073A3D000-memory.dmp

memory/2900-257-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/2900-261-0x00000000005C0000-0x0000000000672000-memory.dmp

memory/1380-265-0x0000000100000000-0x0000000100114000-memory.dmp

C:\Windows\System32\vds.exe

MD5 05df53e58f5c9a560d515b682ff8cda7
SHA1 856e253edb1af81b99a475adf59345f697987222
SHA256 cc8799ef5ce06b7e2603acdafb9aaf02a91b87a54c5a233c52d6a13c6a711551
SHA512 567a465f3faf44857f2cbb5cd18722aa3fe3128403b6074943a4ebc114b32bfe3e1ca7ca95c940f41a92796505783b5492ed846b481db7f20a03458ce69ea1f7

memory/2368-259-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1964-266-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/2368-269-0x0000000000A80000-0x0000000000AE7000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 2377fd32cc4126ab2ffb88072f8713f5
SHA1 71030d41acf29018b64fc9add5a16fbd8d268226
SHA256 95d47ab5050b7eb507707772cb89d7855bbd7a75cb63757e81cdab5f316c84c5
SHA512 5585fc0dead9b0729083a91d29c71d50cd5d34610b63d234507f36d09f395245ad2a2b29306db6cf694be213eb215ec408a9a709d2e8a243320f918a9a01db6d

C:\Windows\System32\wbengine.exe

MD5 6e8fea1c9d60ec357e08e1467bd4b4d2
SHA1 a482b03fe9441648efb0a62a5a0e5e9c7e1e923f
SHA256 381e81927e96b079b2d998b0a6b00ab0c745a340a178e8f81ddae236f8e7db89
SHA512 cd018db48167fef1843a057a1bfc6030acbc66ddd6f8bc3491ae48695fb4dbfc17ab8b2925c7f5eb37384d0403041717c69577c1275da75ede69d0141599f55e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

\Windows\System32\wbem\WmiApSrv.exe

MD5 1d5e5cb95ccde0800ffb0e1cd367f578
SHA1 f97203a341e569de17051b8400f1e11831e09b64
SHA256 eb8623664023265ad2825bb0d1b75eccf05b8072428e6682feebb6fe4ba18a35
SHA512 63436aa75f272b2209c8d6e7b777bf0858e7d76675b8adb92d76f55dae26d324d4cf510f1c3c8c33863bbfcfeb977c3b12b3efbb585ab9e0b845ee636236dcbb

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 d2fed3081a151c7e737e5e5d4c67e1d9
SHA1 806ab76fc9bb76084dafff7586fbca3d3e1e89e3
SHA256 307c4c2a5fce00193a43777411b65289f49c9e2410c999128d514b6b08f6ac54
SHA512 452505012ba9ff7186a19db8f0100a00b0556b00d810d92973e5e5bc0311d4541071f816ab033d4b79421df5775c8243589c242bbaad617db16fd3e360fa147e

C:\Windows\System32\SearchIndexer.exe

MD5 f25255fda02f5fd0dadacb8bc477ac22
SHA1 bb4ab1063130291aa08a98edf36262f94de339fb
SHA256 ddb05e8ce498345a49729e45383d2df62fc26f57ef5e73b6f7ee8e9d064001a9
SHA512 86998127a704b455d2f35562585fa3cf230048d5dca72f66ec25e8e573e6c7c63d6e93abe7a5471583d33ec247d53e6d0472384ce7a64b683d305932a7a6334d

\Windows\System32\dllhost.exe

MD5 9c36856a30367145e91452ef5ca833bb
SHA1 47d726e80f0f17c8afd5cd49a7c652d46ec17fa0
SHA256 c815f360f65480c7be79706131150a0385215976bee24fa23bf34886a5b4c84f
SHA512 33f84fab8c1041085421ff9c0ebe86cec4f47d11a1123c1c4bf8b6b0eeab03704605e19d8c3ce1ff07c33a38721157399341dc9744e07ae19153331a28ee069d

C:\Program Files\7-Zip\7z.exe

MD5 d49d372a61f3af14388d5bb0d157704e
SHA1 8a2ac57909682a1ce65c1629d4269b4cfb3dd64f
SHA256 a2f07a5678e4af91584c2de93bedc8285cbbd2fdbb5ee00c7ab2cbf911705fd9
SHA512 c05639f2715b5da682602edd623da8013aae50cf1308978f9ce4345fecf6a352b25b40d49225a33b0d929914134578e92129f52ec03b87b34d82e610d82d12e3

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

MD5 e1110a42996ed87f48a2bbf05d039084
SHA1 88016cf65f99df0026e22c71051bf66fe7686fef
SHA256 349c9c2499b7876973cbebbb140e0e8affa3882a067dc7bf4621d16da602767c
SHA512 2aa2158fbdbdaff6f5d74f5b829a04ce69239219c5977e7fa8ca08df655fa82727127e827073f84d476c4b1cc8226da9ef8ec754e4c58d2b358c737938647c7c

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 402e63583d178f0e6a503294b0a315b3
SHA1 da78a4bbb7e0474a54ff44bae55b00230ef9942e
SHA256 88cfca9658240869a86b993b2fe3c98b739ad82595071142839e8abb934b61ba
SHA512 5f06bf38ca82c77aae4d90dbba83bffe8ce7f4ec143a1aab652c8a9d12b8b46de6e2b8eccbcadbcc430f7e58c401a59eebf15adb0c1a25becf6de34b90a01a95

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 615547176cf9eea6a859880d0cda95c8
SHA1 11d48aa0d00e6c4856f2f88f934c0da4f264a598
SHA256 f1c49c58558ce59bce48eccf8c96f60c8793f935f1a935ef981f9bb06fff92f3
SHA512 9d002535de28802a793e595e388a65bf34bbc8f80bc94ba16d7cb73900402564641119417d3c6f3e8cf43cbba3e1edb79a7fbecb7373a1d1078eba47c3bb40a8

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 ee0f0f676c3881f182ea63a553486840
SHA1 86a5f8df825c4f5e8f275460bd55deb4826fbcb4
SHA256 0588f407b3c8f0b6bed1a299322fe46edcb579d851c578b6242e4accddaee80d
SHA512 a7b4967813f8c0813e7e899a69ca9aea5a8376a6c2185f3814c2b0cdcf84ccf459fc88d4316193c9d5e26fda9372f8465980fd8de42875ada7cd364e867ba6d2

C:\Windows\system32\fxssvc.exe

MD5 7df1872e18c8b22039b8b5c4eaff1c04
SHA1 bd6d51b3ce796e4558e6d37d69604923959718f2
SHA256 7616be0bad072e76f085f775e46c5f06154cab3d1bbd94bae48cd2bf5e86cb20
SHA512 8f5a3e5762d7a33398789152f554505b9971fa3a5ac097bd4629e8cd5967a0415f32440b715ae1c5b786b638e8b321104876152a4a4969f6185466dc8dd9ec24

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 01:04

Reported

2024-04-08 01:07

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dd3993bc8642d83.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120515\java.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c4b44d15089da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000979aaccf5089da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd580ed05089da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e066dbd05089da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe

"C:\Users\Admin\AppData\Local\Temp\c0d8f0c9037381dd4d5041dd06bb32230901cbe1eecccea130d3664abc0f9414.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
DE 142.250.181.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.181.250.142.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 8.8.8.8:53 rynmcq.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp

Files

memory/5112-0-0x0000000000400000-0x000000000049E000-memory.dmp

memory/5112-1-0x0000000000640000-0x00000000006A7000-memory.dmp

memory/5112-6-0x0000000000640000-0x00000000006A7000-memory.dmp

memory/5112-7-0x0000000000640000-0x00000000006A7000-memory.dmp

C:\Windows\System32\alg.exe

MD5 fc41888d842cb0e9653fac0c70f66cf4
SHA1 bd79663267f240d5a765905ee92b400bd684d482
SHA256 109b902aa3368a6f00b1265dea92ba9b754f7d0039c6f88a6f24f5d7f58bae41
SHA512 d52c5819c83f24c6d9476fa851cea00630320cbafc3c31ec838a37eb774ef33ee6bc03f1cdc8200dbe2a66eed70bbfe1caf95d61df6945bc6e7bf8a01be8b926

memory/4368-12-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 4987e9a86cf4abc1e19cadcc9cd2d915
SHA1 a57eb3ed10543c815f9bcdef87f4bbaf35693b2b
SHA256 5f0f0ce6ddc46cd35dc6d0a5e86b1058c0f6ff20e575db9144e874c31e1a60b8
SHA512 c0636bddb84cf6203cbf9adb56695e9f61c43d3e63f5ef62d7335fbcb06d643aa2500216a7aba5bfa8bcc1379e7d347c6614fb695bef8a9fbe7929645e90cb11

memory/3344-17-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/3344-16-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3344-23-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 8cfe3348823ec07a48eda2c644d9ea5c
SHA1 a28cb23d7a5234afee24e565e7409e55b6d70117
SHA256 d18943b1fcb8491e46e30d7d1c26ce81edc3439d02e69ad99209d662dae2e368
SHA512 b540919a5d9029942bc79571fd7961ec5cdb6aff13bbef0455541ca31ba03ae4035b168a91012fb14d493596866e7620e5ea559cac900b2771ce589bba44ebdf

memory/2492-28-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2492-30-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 80733d677f32b61e2bce52b69b693363
SHA1 7cf37f4c0c4ab94e1515159c616f9b9becb0933f
SHA256 3094c4dac6ec36729d28f1ebb7802c0d3190cb68e1b4219dd11ab73b475d001b
SHA512 d821f8cff3f63a39db633687ec8903c8dd98830664b180e751d03d628e6a73f3bbda5c8a75097efb88960287f200c2dd620afe661483a98132aee436c799b4ce

memory/1132-32-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1132-33-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1132-40-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

MD5 50c60eb9c6ffd42fef5fa6897af2b967
SHA1 2f040d78c5e66d86409be2eabf5f5831c7047e8b
SHA256 508ec3af856ae5c8388257cee5e2caf87a4f94be855e82693cb0cf2ac489fe90
SHA512 eee3db418dc845d41cc9ca81c8387fc53d2aaea5e52a0d06ad5c51d2d59e51ef80be7ada1720e2f8003d186c48356f7534e627ff2812c81b9aee3c5bc9cde6db

memory/344-44-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/344-45-0x0000000140000000-0x0000000140245000-memory.dmp

memory/344-51-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/344-52-0x0000000000890000-0x00000000008F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 31413c54db5550a9149ae286e07c7b77
SHA1 3110e758fcebe77cd0f9b4eb61cc773aca2e7761
SHA256 78e9e51566a5994817dd5df5bf52608e88a0b7798e63d87e4ea27d0be2b5ef95
SHA512 3cc6c10f651ff0954fb092ed45ce2ceef5505aab80dc5f89e24d06333bb68a63da14b21d53b6f5d155987016dca42894ac5d4a6e56d1fcf0b69aa880afcb457e

memory/4684-57-0x0000000001510000-0x0000000001570000-memory.dmp

memory/5112-56-0x0000000000400000-0x000000000049E000-memory.dmp

memory/4684-58-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/4684-65-0x0000000001510000-0x0000000001570000-memory.dmp

memory/4684-69-0x0000000001510000-0x0000000001570000-memory.dmp

memory/4684-71-0x0000000140000000-0x00000001400CA000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 60f304239c9d9c2c0c235d02c5a87a89
SHA1 7221b49c2940e29171c1b90530a8689c0d9dc5c9
SHA256 53123d8c433babdd3cde5e0c35a73c325068ae291a26cfb51413d6e9195d4b55
SHA512 6727c9930a1d2f447365fa221fa83ad90c622e35aca0a6c69ae7287ce4214dc06348ef50e2686d9c55f0b1bcde50f18deab53c641334c35f38d92ce2a211ce4a

memory/4368-73-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/4576-74-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 f588ae0907565f334e56113919a1dd87
SHA1 9e453f1bb75a02104fe7897df19a88b1e49b6e8b
SHA256 ac72280dc0e4526e3da29802b48353982b363c9df7d49ffbd596bfcbaf43b73e
SHA512 24f8ce72d7ee0c21809e1691ca614b75d6ac04303ac4fc4488c5d61671eaf00af9a6858922eae293c0c91678faa54c0e2838c995297b1026e3fdd851ac992814

memory/3040-79-0x0000000000800000-0x0000000000860000-memory.dmp

memory/3344-78-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3040-84-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3040-89-0x0000000000800000-0x0000000000860000-memory.dmp

memory/3040-90-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 748789f3a039155866409025d0fc7c40
SHA1 85349f81c53077e18f53fee92562fb967d81cab2
SHA256 5a1ee08a2b71085aa448bdec0a8c029cd0524d0d6cd6b5c05ea04f58d3c8bf42
SHA512 ee04cf0532ee51a4168ec8781ccbe9521f136daa6e60c6b7eceb45633124e8b823903a61ea36b78c04ad7a48272bb311c32ad880288c9c7c597f4e8bef3a80b4

memory/4504-94-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4504-95-0x0000000000BC0000-0x0000000000C20000-memory.dmp

memory/4504-101-0x0000000000BC0000-0x0000000000C20000-memory.dmp

memory/1132-102-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 6b5223793953b2a24f1cb22d45af47c8
SHA1 08956e83ef3c2916826f36a8e5cb77839222accf
SHA256 22f5211e63c5cbae161b71a30d66fed1aa38d760fded6b9ad29b134fb022f2ae
SHA512 4a3cb83aae4a5a2c753dc3402f9ff58fc40d728547e6042f66c55cfee02bb6f8f70ad1ff154d8668b94cc6a3dc3c35c12ef001028638f9dc52d487a8fd1fc0f6

memory/1352-106-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1352-107-0x0000000000520000-0x0000000000587000-memory.dmp

memory/1352-112-0x0000000000520000-0x0000000000587000-memory.dmp

memory/344-114-0x0000000140000000-0x0000000140245000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 3779ea30aab28a7cca09875cd70e44c3
SHA1 ad8cd3d7f68bac282df9d2d5cd415311f5cc017c
SHA256 36d326c5382d9c4dcbfd8d6aa87d5e0972e695cb82ee3d3bc6d4f0a0142588f8
SHA512 bc8e360cf2d564ceadbb057459be1ccf95bad1e756205f789fb94312606e916dfa434a00c8fe3ed6bb1ebaf4df5b1cc415c2b04bfd0b8c88f83d6e9a3a85555b

memory/3124-117-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 972a044f4cbd5a2899a8ab0b527f5522
SHA1 5c9a71cbfecab77c3d8b36aaba3c65f98c688f00
SHA256 98dd726c2a2966a6614bb506ad806ac002aa0e787c6eec58b04e0985191c5cb5
SHA512 2281ab0e31398b81e586be66841f8b07d9b36c30b37d8a8982cb38dc6a4479e4dfc230ddc6beb2b2e606d675342fb52173680aeea4b7da947e66a25d65c0fd5b

memory/4728-120-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 261dae0c58e769eac9bb8a59fdf7d833
SHA1 62ec682e5a8402ba737f5ed207b5c1b6724bf6f2
SHA256 ed01189cb0525384def22291f6b01f4ce5a7e4245eb4a878dc44b59a5d0ccfc2
SHA512 7463e1e58066268f4ee0b791fc68c6d515d5d8a72a343eed836909116fa1badb2b1c99354a214faca04679988428476dfb8415ee2baab8b44b6cf9c3e0ea143e

memory/3728-124-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 f8a20140084927982700ca054c358779
SHA1 989b3e28ef7647fe5e65cbea2f78e34a61df1057
SHA256 32e69d4dc6d7928a205b44cd558d3e3efec1b2bac407d294e60f400839a3d385
SHA512 cb6f0b5789a3b6f2d7ea0cefb6796c4d80f78699375d9a15340832819728a23b4988a0a7534aa216eadfa9411d8b9de5291509010eeb4ab0f6a528f18c3e0c76

memory/4576-127-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4440-130-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3040-135-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4440-138-0x0000000000710000-0x0000000000770000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 b7baedf128e5e2ea4f686cbf5115cb4a
SHA1 b866b99486339fa8fd4252b5edf9662f5d227293
SHA256 f900667f9244bcd8d3924709d71b3213ae841c485b02b7598eb53fbe2fedc5ea
SHA512 939bc9484db0cdbce4a8b90888c03940cb216afc1a5ee1939129f55a5b7230b6bfd1ba4f39c04af1644469df6c990c9998995d9a736807feb5077db3108dd026

memory/2400-143-0x0000000140000000-0x0000000140102000-memory.dmp

memory/2400-152-0x0000000000D70000-0x0000000000DD0000-memory.dmp

memory/4504-149-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 173f2650015a813029d08723aca0ace0
SHA1 d7ab10e34f8dc16f559cde9b4a97fc62dc3cee8e
SHA256 c3311148094495fab7a542b2212b73b85031c1a5ff049f500928cedc09f68bd2
SHA512 16d0923b7fb16ef614222189bd268abb7840c0eee2c4c8b4a86089b6b59225a096534aa2c6356f59789d3bf5ecf27d772c89d94dabe872539fd3f78d6f770a5a

memory/2140-155-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 10dbc5dc5f6e22d3db68ebe21c992185
SHA1 f7cd9fd75cf28993b6701fbf0921a110aee35d6f
SHA256 52caff23fe49ebcaca97c49ecd9b99975c1d9d9025fa512515e2db2ddeff1b99
SHA512 87a44d1e4e5b4ef0b087a1dcb4a863671878e4f89ac02dd37c22e78f5cf41e8caa3a0042a1754279df84d1d7374d54bfb745c8b47bedbc5420ffb370852d3b48

memory/1352-158-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1152-159-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1152-160-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 21ee91c1a4fc1c70ab310850365ad7a1
SHA1 ee49231ee8aeb35f30a46a77b39884d380d18a1c
SHA256 3e2a103060198562bc207c120cc80e3dbbd6c9cbbd8dbb6b0ea190539d54f938
SHA512 f2f799c2f08abc3dc987a9f2cbeaf078fd0f0b0563e8042f925162409c05f56ea60ccb47f978a4e96ee6654cd2ee50105c3410a5da228beae7db5f877dd53682

memory/2336-163-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 cb5c9bea50a0144a6a7c7eff51625189
SHA1 2e7f3297af5764030c7c358bf796455c387b470a
SHA256 6a84971fcc5dffe386ef589210afad4ef3f0f3409b90ec54f11fcb9c46db28e9
SHA512 c4110a6ace7a79ad474196c12ea67f79264e07011aa0589ff9b15909838ee2ee7df3584ca63bf73645f75f22499257cc0657e853d848a366f51591e0670f7dce

memory/2712-166-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 04deb747bd948f684f7de46a94a1452a
SHA1 8f73a33af1fdf40958b6d14a2e1b783af6e9d27e
SHA256 c9101f8895707c183f3934f5844279c9fdc24fed1c73f7fcc57df0c1b663dc81
SHA512 6631e5356c28495b357ce117ab760e5d83ec5a6a2f06951888cf5a3337005a3be5aa13282c98076a558cd4154b4467099e7b84ffca438720b8528a81abf2b3da

memory/4728-169-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3296-170-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 dfe1b64b6963275b4f591e6e9c77f31a
SHA1 ea446c853ad739313bf760b9700479de6b9cb055
SHA256 95764e8c06f7cb85b7d1da61113b584b0ea839296afa4048f5f3ea13123dc088
SHA512 016b8cd3f6514eeed98a325315422a4ecfb8859623c54deeac2134217cd03f3e72b146bbeb43535b9896c3e69f150c8fca89dae4c64835aee44f9f04b302bff4

memory/3728-173-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2480-174-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 5f87734a01595ca663f635c6ddc10689
SHA1 8cce658d0f8e43b4d3130094af195eca2f30cc27
SHA256 656e23977be008d921f61984711c45f3c035682b8c0916a980ada04c0373c28e
SHA512 6dace167bf7d29971242a99f1a7cffebc1b161d2e44ebfa9e4ef5df84f5f562d2ab5d4b7c49c9aa02301c7db1d166821e4f20cef1c69cbbb108ea45abd6384c6

memory/4440-178-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5164-179-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2400-330-0x0000000140000000-0x0000000140102000-memory.dmp

memory/4728-342-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2140-371-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/2336-380-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2712-383-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5656-384-0x0000026D40810000-0x0000026D40820000-memory.dmp

memory/5656-385-0x0000026D40820000-0x0000026D40830000-memory.dmp

memory/3296-390-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5656-391-0x0000026D40810000-0x0000026D40820000-memory.dmp

memory/5656-392-0x0000026D40830000-0x0000026D40831000-memory.dmp

memory/2480-403-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/5656-404-0x0000026D40810000-0x0000026D40820000-memory.dmp

memory/5164-407-0x0000000140000000-0x0000000140179000-memory.dmp

memory/5656-409-0x0000026D41720000-0x0000026D41730000-memory.dmp

memory/5656-408-0x0000026D40810000-0x0000026D40820000-memory.dmp

memory/5656-414-0x0000026D40810000-0x0000026D40820000-memory.dmp

memory/5656-415-0x0000026D41720000-0x0000026D41730000-memory.dmp

memory/5656-418-0x0000026D40810000-0x0000026D40820000-memory.dmp

memory/5656-419-0x0000026D41720000-0x0000026D41730000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 a933305336c3f496591b0cbde34da9fb
SHA1 565a3fe017ec935b1827917f7e3ad5916997ba57
SHA256 c41a9b406b08b3c857175f84d1a7f232fb82db0262af6bd91fb30c70931cffba
SHA512 60d93f3293aa91d7a849db2b2371433493c337beb9722d8db450cc5ec0ed4cc889a779e75a04897adc50504bf390b23f47bddc5814558865ed188ff7fc1eadf1

C:\Windows\system32\msiexec.exe

MD5 b0683c70fa08a5207a7f3e3d4811fb2b
SHA1 3ce0adfbf35f217f469ce95712a3b14a0c00669d
SHA256 42d734a4a3ba53ada1f4d03f9447c94fc1bf4e9e116631bdbcb60a29438171fa
SHA512 a4c040b3bd54c001d3b3fcfc0f5997793a62125ccd180e55408b4ce16cbc24b657c715e38203cb7feda9f05d37c4b65747b9b5d0d93a3143dfdcdb7200ca61da

C:\Program Files\7-Zip\Uninstall.exe

MD5 7ceb3b2e4283c899e2a093fb9be51c06
SHA1 df564f9409c8c58416128c19437e271477c39f06
SHA256 104ded9de6f7921efc026d325a0ac1da0ef5921ac186a75057e1d3264150096b
SHA512 7a70fa63344a2a5649eceee2b0295e661a78900fbce86b90ebeffa26ad2e16a2c0956cbc45cbeceadda6def4b09293a1b4f17ce84d2a56da29bb15a71bfa4f66

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 49ad465d494748bf1cd4fb834944a2c7
SHA1 ba77db896ecd72147bfab83ee3a8f0ac505eb76c
SHA256 e0c5713a99f56de282921305071d4bd07c58e15e3821f1ced67eaae1ceacf125
SHA512 af2277dfd61442e06270f264caed4d6b7f33234c9fcb1abc20cd2f1193b0ec1038a82276cd6fabe38e0076185031cec8fd5ff7c1ddf94da2baaf7a642a50bac9

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 6fc62bd56d7b8f90a952235cd72b3b67
SHA1 cf5c104031ae188017bd81bb4244eaa94177fa38
SHA256 a11dcbd796e78990dd0af3f82851ec1280393f429f76e7bc5f3ede3f34ece46d
SHA512 d3c924d7928ab94ae4e0a47cfd6655261cc87389b09444a303ac39741914d6c6c8977735a32987d94dc62c750820a1955756cf6a2e5cda1ec8e7cdb7e21a5008

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 691603a945e1f5b336cc4f3de21ad8f1
SHA1 0292c8e9f83306aa4d822b2b514def93e40badd2
SHA256 8ac8c3f8e3e612fecc6db717df4728efbadca5ab2348ad41ba330874d1f12718
SHA512 e53e3657e8334ffe3c80fc232f8b3ef5c16e2d319294d6ce3328bc7d2f6ca80eec61d4695ab24a549586cf9dd900e86e178c7bfacef7e08663c3d66c8eae654b

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 b667dacf0c895a40b1be614c21e7628a
SHA1 9c37fc10cc27fdbf34ff7baaf780ff14f04a54a8
SHA256 fc1f28c61034236e4288ef9a50bc8724a4d4d0e8dc5ad5024c8b7a956872e3dc
SHA512 ee6832bdeb4ca318f6f4902caf39d6c08c218800237bce8ea1ddee93d106adf42f1636b6061a511e381703d57e065f324213809aa5f527908752ed644e185233

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 7a40d3b5a2dc2a65addc440b32d9db4e
SHA1 c2e16c47fa2790bb50effef8ca4e7c5b9663d74b
SHA256 710bc6c499cef101517843865a294975b75d329ad805bfb91404d9a488ae7b25
SHA512 11bce306c600bde54a61c3a0dae8a09d44a6575ea4a57b9c49ba050745ded6b03c2af8c54964ba1e96256c28d1eb5e5849ff5f026da5f11b0293b828fbb7768c

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 054f1a995617627d7fe6ce7190e87848
SHA1 99afd3aecbf575c4a0e41dc3639ba52c10498c27
SHA256 20ea4dad46d1837f5daea054e38e217e12ea5f98cc44dfa0710c14d8f68a952d
SHA512 113c274398f7382e462495357e5a02cb3d0ffb5e664a39fdfb4e1a3f5ef4846af1230aada18b7fe11bcf2dc60e463e13bc3371f7ba37a8b8f4b65a38c1079a95

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 15f255ab2865f0fb273edd9b3ba0b94e
SHA1 e480ce27e535a860bacf7e3b87615d763768aead
SHA256 71a9d4c6cb063b00fd1615d6e4f6dcf4a0183c5fd7bcea5bc3d780302969a8d3
SHA512 a1c94b2b0234739e8fb664a801b47abebc797e78833c405ae4b9d158403d0843f306dce42280fa47224d28540d63ca24de11a7c14cc1a515881c3e40cfb4f5ac

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 cb2a41e0d38c3cdc8ec4309d82ebf226
SHA1 eb2f81ec85782d60ae0f8625a52d8096554095ec
SHA256 e6e583c55e75f968ad11c8af29a1e62f66b62d274b737da12a75c359791bdf44
SHA512 9a8fb62b4c1e39f52c41e0df7e22c3ede03d74964454e2da0b00c491f01e376d169f4520f541624eb9fee1e335e46c8e0ed0d22a1cc9706457d3006b970de9b5

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 e89431aa31cf81cc85aed508217b721e
SHA1 e4df2a789980a98580d31fc50df2173b6e90789d
SHA256 e298352036aa847e78bc1d8922d28ab9c34a8f7cb3eb582e55519e4630c48c17
SHA512 7934a89bee61ee36833b4a588a9ae0d913957b96e1f13d71793fda5bb3067efbc51dcc899fa5c1f3d8c0cb4457c753b523ebedca12ec483cdbff29ff700862a6

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 c03a35285123cf0e1757485371fec2f7
SHA1 5677962187cc3ca4a621dfc825c1acf41946ed40
SHA256 962667c28b3d9445ae9d74c4835502daf2f3d178b3416951aa92b25afe656d19
SHA512 4a271a65f1de5a0bafef0e222eb34d9322dc40cfcab73b6c955c9a838f21c56e2d2e757e7d0dc6a0640197f83fd2fa0246b1a58fe506e638438b6f41d49bb333

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 cfa9c7ea266105d7248eab33f04a68b8
SHA1 57f82c67df765b1dd4efe8f320508b1f9b1d421f
SHA256 348abde087225d52b8cbc8940999515810964591f7d9b24e8f12b10e249a22e3
SHA512 1a5e2c78102829c097185412aa5c46ddd5fbb71810d39b62e4561e421c0f7470e708ea70f668a777a312ae5e8048461cade130e8194492a5e37601749b6850bc

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 532ca92ddf6673d9e3c15842dd2d1c3c
SHA1 8873712991723e94962d7762aca66b4958a07fec
SHA256 9d553d48bf773683fbed9ebc0442aeacad01d5a96cfae99c68b47ca61115a218
SHA512 c643bc97f9f25c3bd4682aee1e25f57dac6f03d04a41798c87dc89554a60e56c36bc651bebbf1ff2c1ee443671181812a287daf28c3720d4e845f24b3a05b834

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 4d342fea229af989eb5bfecef44fdeea
SHA1 33b482747dc9516ca8435dd672763bf97203af28
SHA256 9fbbfe539b626b97a947240909253deef99ed1bd7d87604cfd93f144550b8817
SHA512 276472746719e4708a480e149982edcc63accd7b2b206da28bf33cbbbea35bf47d7fdd35db5a11a765a8f5c0339930b7ce30638127f7cecd13dd990be6fef584

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 841d89473943c8cb8c6e1ac986113199
SHA1 3912c7e23218656997bf20614cfd4caddffb83ce
SHA256 53a59710cd1ff7a01ee7813fa64a89cd1aae7c39e00fc11622eda1884d615578
SHA512 c4c037fa5bfbbd44da3dec597983bcb4a9bf36642bda0aa466c0d3985c368b8d6740f75f6f8ce2a1f1c9c21fdc6c7f5b70e8d2d2bc012fad35c451bac8fb2df5

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 8fe9421959ecf24a9764f75e9926e7fa
SHA1 26f112c19b25163337b6f0d387bb8888c69646d3
SHA256 6ac54312fa5baeec2d36fe1680e5947c49f73675a5501280f378510145cc998a
SHA512 cfba7976453a2bbf39edf0ea91b8307d568eabe36d906ef0df0dc80ba6ab55cad014b17fa1747d213bfd6570157f2286b2e896a05a4eff7933ad975be63dfbbc

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 98785a6c7ebd2d83befa1aefd0558b1a
SHA1 905df6ce51397298a6654c89d20b1ae8dc8de762
SHA256 fe81ee35eb9333bb1da9931a74674fc87147beace7a8f09e4655e8a5ca391206
SHA512 b58549d1e0b7585f568de345faf59e06c46945da39c4837b98bfdb2437eb7e7ce5579f7e21ddf54360a2426db4598104c887798b6f71debb344e48a05393f336

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 bf4922d0aafd8af4df0971c33f7867c8
SHA1 ea880ad25b4a16a0aa608a88e69a76a9a79a22d1
SHA256 865865d552df22c574fcac0866b9328b7d24ce864489fa682fd6f45e8641f8ae
SHA512 be0eb8be19f4203ad1949aad2a13ccfbf96841372a27456ad0dac142706721a4640a813e0a935dd39149120e3631a428bb6391e4cb80470fcee79fd4df961dc0

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 ab99d2d9939f27c46e17195dd98c803f
SHA1 df457c7f1fbbeb58f9fd397add222d2b849e3230
SHA256 07bf9f20e47b841aca1a1b03beedb97883fb879739e023356947403942cf868c
SHA512 f48505446d005b8f26a3445df2ce1042a6b729f4a2405627dc1dbc6e44329ac6dbd0d4892a08d485ced6883c8b449fde39aa2cafdd47df8fe091494e8365c820

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 611207a18564e5838087137431063c0f
SHA1 fa969585614fb9f2771fb77df4c7958f6e8223e8
SHA256 6ddfde75bfc9c2d18458e90cd5d0345f0bdc6b7cc9c96b1870175602f728bb78
SHA512 ee6076d53ed0ad5329a48ea6b3b27909f1f4911a023ba8909ca89aecff55c9a588d9d78a2c884d61b9d72526dec0214dfb176ffe3778467f25f36a1d41b7694a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 4d739403ac23d9922de9e9947698a478
SHA1 d2d01dc850f8e1142fb380d53405e60c19f5d22b
SHA256 4d09d364f8582424c91d634a6e2fc566442bc9c7a58d46cdbcc0b9cde1047fb4
SHA512 17233cf46103d9c3b88f4423f570286d05cce7f57f2bce19c6d84f3ad0db602ce83157290a9efe60bcb7273558a3dbd5b2c2023b72c5bd7fb98e316a1a919361

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 d09e5325103513cca2ffa1c16e126f51
SHA1 b325cf36a9e4eefe2d144b69b4aaed5ba670c786
SHA256 0e171ba65a77a520702b39f210d94c5a551197eab0529a8c749e5329100e4052
SHA512 7792dc40b3eb0f099935fa96808328d117b3e7200a75b99e31c9931c71cc1212dde2aef5ce42c21d1473a1fec9d99b00f77a9a93b309f2e54a8764ddc054c2c3

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 375a881508295a7a80a63a1896e9a8cb
SHA1 28b596f18b65b9f83292845912797f93fd6f896f
SHA256 dfa8e9f0c855df3d9761e7149545413525d125559deb1d6b88c76f5c61a60b2e
SHA512 234a7a979cac09cd616e9de8b15bd0c071cfd0dd8079b3e7c821dd0f3cfa16009bd9169391022cebd6c94758a572d86e5eaf2841d159b6248da86b576faea88d

C:\Program Files\dotnet\dotnet.exe

MD5 fdfa698d1b0c7fb286a1d3c746b95b4d
SHA1 f9f0fd1752a2e68af0435e7a3ffe398a6ae91e28
SHA256 e4816dadc11410698d20b73df8ae0f5bfa932ae200b0528856fb4bbc98853ffa
SHA512 8873b391ecd4903507d42fe4bb45fdcc05e41a6733860191452c20be96fd3d1372e59d1d81d80cb17ed70eb1d4689e4241933aac17509a47dd70beaac2757cb6

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 4edd465c4aae3fd43e3a3d4b8b890ff7
SHA1 ca837fcc31348aec22fa3de715263eda6ab8c88e
SHA256 4a4a89a64698044dc48709fd34d607c0573e4d389ee22997349705698916d41f
SHA512 f450c759e8866e02be9630ac4a91c15229b7eeb4354b273d1cc2686ab9b7a7bd4d6f7e5b6ab4e90c4d6d11d5d0bd5e564d40560cf490ea85dd2a96a2e9a2ab6d

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 63ba2f50bd08900f116bc719e5d5f64c
SHA1 ed3b91c7ef1962b058147102763a89895d4933e5
SHA256 e715dae824133314c415ad27439c34efa612a8cf44936e512d8b0e21df9bca50
SHA512 ec0b4d80d260af24d41bbca026c799776d217025c5a1ecf1fd797a8e74581036c008589a7165734b2f0df1848f92970356754fbfd5d713593a34648272a24b36

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 183f675798dc68dd57c55fa520ee4560
SHA1 0a05d4ce90ac7b661cbe51b502dc75349b056105
SHA256 7450faaca64323f9b97112561f88692b77756c465351700b29091a674e9a853b
SHA512 23dca48adcae065b80a1e075191a954ed92803f02c78cb948d3c8181eb6e4cd943c15f7ccbf84da0698dcaff28c5dc4eaa93a5e2cbd470fad21f8339b64b9e3f

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 93d09f168eaf20dcb5dd3e085799182a
SHA1 d4a8ea6d184c2cd08dda10532bc03878cb5ef17f
SHA256 dc63e6a76d37e43c06dbfee9af4fb064850562f46ea5771756439d5daf964dda
SHA512 495b81b64ec070e56257283c7e9506900dea440ce40660eabdfbbaca4829b6ef6eb4008e9e873274836009dc6c6bfe07b7c3921ad22080261f0280466c6cb374

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 b8f9d15812a1183e6e9df1c584e60e53
SHA1 713990ec1239de3b3d18ca37cd4e4a982a1c7c1c
SHA256 d95ddea8da698d737d5e3d22c7e5db8968f95a512967ab8e65a55bb75cc65e64
SHA512 d0214cfb39f2eb0bd3471426aa8ccd67992141992b3f169f12865b5b9be8737049ebd0050a8fdc6ae892bc129de88c3d276d57bbe212e3e3dacfdd63cff43e21

C:\Program Files\7-Zip\7zG.exe

MD5 767c0215abb8b83ca9ae8ccaa54f1d77
SHA1 80e352a6f40e0a73ef1c2e1dc39381d571fbd9c4
SHA256 9df98d05cd6a8fbbe071ed7aecaa1be1ff9276b48e1c0eaf9b23f777bd0ad228
SHA512 42c0a78e1ffe59e3220393555c76342578e933d3b3fba32ffd780d2077c421c3336bce3635586410b1fd27b0de20719b53b9d415ed02477681a3a9e83abfde70

C:\Program Files\7-Zip\7zFM.exe

MD5 f03412b8389c350e286193a5dc1cf9db
SHA1 315e60db9c4f4c7014143a941f4651df5011b1e6
SHA256 793080943901ef17ff32a4f78501ef0ec720bc6ed711f319d6ca36b4b79f078a
SHA512 c8c81ad7702b15e69ef3ff363f1bdb78630ab72e58647c052f463ffa6a37107cb2a8b0a8ce8de84203cecc194c514f8b8ded9a474f284b49b99a98ece55b146e

C:\Program Files\7-Zip\7z.exe

MD5 f64fd02acaeebf283e65142952dcc689
SHA1 02cc1ef87c94a8a21e043da4723208678c131f61
SHA256 a2a76cbcc51b7815485c623d5af18a37e8a1e114ba51e496864fdaa28e8e48ad
SHA512 db0b96ecba30b13e2ed183c6496a434cf4c0f120439dcb57b6cc7414ac56186f715747fdd9587b8dc151c733831df33a12d9840218a3f9a90433da4c5a42d875

C:\odt\office2016setup.exe

MD5 3eeb1ced5cc5e91d29c274b256466b6b
SHA1 90bd9d2849174cea805a991258c8e598efeb40ee
SHA256 58c2386e3c8426ed6b47bfecdd3f728e7c263813321adb3f2f2ffe66adda72f1
SHA512 53ced1ddb3ea6c047db7416f7308ea6948aee49a57f8e4547848a4a5e551627d96e67c2862543ad2f97be0aa067a14478f3c0fabc348a4b5f8510c00c0c0d886

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 998a1aa825246f2b14ad63778fbe62ba
SHA1 a9367a09992045fafb9fb4a5f03a7c68829fde12
SHA256 77c9d8f9fab8845d72c1d0f0081e13a50595bd235e53ae48daa728a7318893b8
SHA512 29d0339265f03dafaa960bba33518366827012474e298c4fa381d8893221ffe32c585944d2830719a4f84882ecee6e6748dca0fc7dd671ba405b26902c0cae69

C:\Windows\system32\SgrmBroker.exe

MD5 f3e9103679de470dd8fe031a372e7c79
SHA1 90ace5017e8deafc170b72ee759fc8601bf97c98
SHA256 bf1a229827a1ec2df7f6092ce3884ea8045ff0d0a8fba383e3a1ffbaab8433d8
SHA512 e8cb37348439c4d84a086434133d47e5c1346f92d02bba70a045fbaab0515f79f20bf28632cd2060f05e00095d4d2dce20a96597cd09197e60a9714dee104c1b