Malware Analysis Report

2025-06-15 20:09

Sample ID 240602-sjbhtafc6x
Target 2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany
SHA256 28ad2370504b82fb26de82032133e80d789a21002d02f01887943276251ad670
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

28ad2370504b82fb26de82032133e80d789a21002d02f01887943276251ad670

Threat Level: Shows suspicious behavior

The file 2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious behavior: LoadsDriver

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 15:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 15:08

Reported

2024-06-02 15:11

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

Network

N/A

Files

memory/2132-0-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2132-1-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2132-8-0x0000000000230000-0x0000000000297000-memory.dmp

\Windows\System32\alg.exe

MD5 df9bc184ef21ba0344097e1cc5476c98
SHA1 5315deb3674f51cee0887df1ff56c4f3b71d2c46
SHA256 9dfa3f02bdc05c969ffecc6e0f426efcce37a220e108c89386bc45cc81a51a5f
SHA512 ca028b1c69d1d5980e22d46cefcf6c7d43c0c179c7b40bb5d1a4e62eceb9d9fea6110532823a3acc1f8385871fd4b50cc044e579456327665d6348cf18e7e08d

memory/2476-13-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2132-17-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/2476-18-0x0000000100000000-0x00000001000A4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 15:08

Reported

2024-06-02 15:11

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\57f8d60c8beeeac9.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1e95300ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e685501ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092998300ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087186601ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034f7e200ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093105b00ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2d55f00ffb4da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-02_831f305c732d16b80586ec0bae4b8c2f_bkransomware_karagany.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 34.193.97.35:80 przvgke.biz tcp
US 34.193.97.35:80 przvgke.biz tcp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 61.43.200.44.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 197.86.237.3.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 54.157.24.8:80 fwiwk.biz tcp
US 54.157.24.8:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 54.80.154.23:80 deoci.biz tcp
US 8.8.8.8:53 8.24.157.54.in-addr.arpa udp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 23.154.80.54.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 54.80.154.23:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 3.237.86.197:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 54.80.154.23:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 86.104.213.44.in-addr.arpa udp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 173.204.218.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 44.200.43.61:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 3.237.86.197:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 54.80.154.23:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 54.80.154.23:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 3.237.86.197:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 3.237.86.197:80 zrlssa.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 54.80.154.23:80 xyrgy.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 34.193.97.35:80 htwqzczce.biz tcp
US 34.193.97.35:80 htwqzczce.biz tcp
US 8.8.8.8:53 kvbjaur.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 8.8.8.8:53 rffxu.biz udp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 cikivjto.biz udp
US 44.213.104.86:80 cikivjto.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
US 34.218.204.173:80 qncdaagct.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 54.80.154.23:80 cjvgcl.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 3.237.86.197:80 neazudmrq.biz tcp
US 8.8.8.8:53 pgfsvwx.biz udp
US 54.80.154.23:80 pgfsvwx.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
US 34.218.204.173:80 aatcwo.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
US 8.8.8.8:53 ereplfx.biz udp
US 44.213.104.86:80 ereplfx.biz tcp
US 8.8.8.8:53 ptrim.biz udp
SG 18.141.10.107:80 ptrim.biz tcp
US 8.8.8.8:53 znwbniskf.biz udp
US 34.218.204.173:80 znwbniskf.biz tcp
US 8.8.8.8:53 cpclnad.biz udp
US 3.237.86.197:80 cpclnad.biz tcp
US 8.8.8.8:53 mjheo.biz udp
US 3.237.86.197:80 mjheo.biz tcp
US 8.8.8.8:53 wluwplyh.biz udp
SG 18.141.10.107:80 wluwplyh.biz tcp
US 8.8.8.8:53 zgapiej.biz udp
US 18.208.156.248:80 zgapiej.biz tcp
US 8.8.8.8:53 jifai.biz udp
US 44.221.84.105:80 jifai.biz tcp
US 8.8.8.8:53 xnxvnn.biz udp
SG 13.251.16.150:80 xnxvnn.biz tcp
US 8.8.8.8:53 ihcnogskt.biz udp
US 35.164.78.200:80 ihcnogskt.biz tcp
US 8.8.8.8:53 kkqypycm.biz udp
SG 18.141.10.107:80 kkqypycm.biz tcp
US 8.8.8.8:53 uevrpr.biz udp
US 44.213.104.86:80 uevrpr.biz tcp
US 8.8.8.8:53 fgajqjyhr.biz udp
US 34.211.97.45:80 fgajqjyhr.biz tcp
US 8.8.8.8:53 hagujcj.biz udp
US 18.208.156.248:80 hagujcj.biz tcp
US 8.8.8.8:53 sctmku.biz udp
US 35.164.78.200:80 sctmku.biz tcp
US 8.8.8.8:53 cwyfknmwh.biz udp
US 8.8.8.8:53 qcrsp.biz udp

Files

memory/4980-0-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/4980-1-0x00000000021A0000-0x0000000002207000-memory.dmp

memory/4980-6-0x00000000021A0000-0x0000000002207000-memory.dmp

memory/4980-7-0x00000000021A0000-0x0000000002207000-memory.dmp

C:\Windows\System32\alg.exe

MD5 1109d4dc203d2f41305c497713d6afca
SHA1 a94bf1f70d43d1f2e80f77a0de530b38519967d7
SHA256 2e1a776c464bb5048bc10f3fea54def1fdefe7079ec761c60d2e85898c31b06a
SHA512 cdac17f20385b0f2cedfbd1846acb645e92bbaf0916a716e1cdfb26c6229766745a02b0a8890c73be65239e653a2ab3f7a7d8e1fe76191361f2ecf60cc50bbd9

memory/4152-12-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 98cc3306c088a3de8551b95427efc44e
SHA1 198deaaa6723b32d0a29094ffaff3d932240499c
SHA256 187e9699755d15a18348798e0bbbb7562a087e2850d9fcef4df8d888b794b97e
SHA512 3e0687c50a33c0e7eb9371ea9e14080f0b738a13c6c7919d4f3842763c6473d593add3525d163af2df6cec78a4ae19b121b43f0ff9f5b4801545c10192c23f6e

memory/968-16-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/968-17-0x0000000000730000-0x0000000000790000-memory.dmp

memory/968-24-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 19d35bc19de5db4460c0cc964274867e
SHA1 b1bc36ab77d28d2c48c89fa83e204e191f295654
SHA256 a46dd02966942ee40dcbaa96214ac6b0318afd29a02cc292c9d2fb4422b75da8
SHA512 21656ca2eb6ce318b33e6e01a8c0edb74b522f255c348bfb51aa75ead68e260058e2f22543c11591d9d01c726baeccb954abbc1c7caa8e5971047061c191a3f8

C:\Windows\system32\fxssvc.exe

MD5 196a2978362189ecbe4225d9eaba6903
SHA1 2a7b87d74a6100e8af732ab5e1c886be080b5c94
SHA256 61492e482eee50a839550a4bfbdc6f165e86055fd456448ade346e727cab1f60
SHA512 2eedcf0601960ea0ce44d31b867dbe984b015376ee71a2cf75cd90bfba9c72c9ac6946e213215d7aa716418d30b8eab2220cf21fde53b2cda0f7f6c532e8fb8f

memory/4980-30-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 3f1e32c812cd781fd906ebc23d06d136
SHA1 1b9a20680e2a0f3eaeca96697170a66cbe46f820
SHA256 492fb28986db123f3cc0691393c35505456c468f2062d70a76679cbe4593b8c2
SHA512 9c5ef69beae8b73475cae1ef48a0254cc1bb49d6c02b2ccdaba88e8d19adf03af2b3640aa8fe090103aa379b87dbe839386d164637ef128899a2d1e35bb444a8

memory/4308-41-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4308-42-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/4308-33-0x0000000000D40000-0x0000000000DA0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 7748ca2bc4cc5b99ced3a5660bc781ab
SHA1 69d95cffd9afcf0e1ddb0d717c6a58546380da26
SHA256 be1c2e09b8929a9c1aad063def37ea18eeca8d5657f41dfdbe7b61ac3939c95a
SHA512 33de3e01c7929b8300e875796432f870437e7eebad986cb71e56d992da33e6b94729338583af31bbe56d747a9e5b132fbe94f8cdb53b11356317001da9ccdd7d

memory/1460-54-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1460-50-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1460-45-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 6c1e42fdcc1ffd3598b1f2e31310461b
SHA1 a8af6115e7def3d1c3ef7d625f5539c678bbb2f5
SHA256 5222b94d44e92bfd012f4ff104793aa64cd5a00950415d0cafe9cb79526ff0c2
SHA512 df6abd7fa2a7d5f85cd9195c3eee1723bdae35547a31b4ed6d8c4a29a63625f1a4fd94c57c845ab3979a625946f445d8de29c06003f0644912ff9c5f1562553f

memory/1684-57-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1684-58-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/1684-64-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/1684-67-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/1684-70-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 c0f81c1d3aff407136723ec5390e6ed9
SHA1 3708741dcabd35ef86a54d6944bd4cf86013994a
SHA256 a60f9af2ca4be34f314c7b3a7b340dc46b5b268bfdb821702690233faf16ddce
SHA512 d580a12d1b9e4526d3fae749999cf1fdf8eaf876bdab2973bfbd325b7e9c57c752c14204fec855a4ac4c19aa97cc705d9f7d4d622d86de87ad6b60dc08f90d44

memory/4280-72-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4280-79-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/4280-74-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/4152-239-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/968-240-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4308-241-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1460-242-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4280-245-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 336652cc1a113e4081fe836fb8eb2972
SHA1 d2d388380fd2602d9f945d1491cd4b01184c2eac
SHA256 a74d361e10048bb25829293edde1ded60fa5d5a94144930997d2d11f7445b7a0
SHA512 393bd6701b055a44fd1c91ae3334a464808beb3846f335834fb1ba3901157322cc2fa6ddd66ed74e391cc2f13eb618eac4bd00ad888937de502e9c54a8a04f71

memory/4512-251-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 55f7b08525912fac013311bb1be58775
SHA1 6748b1edc7ea3bb217f422f1e0b264ed5b0e3967
SHA256 3cef7dbf6a6a5523ab588ed1a9b57a30d3572af6cd4b50eab468c1089722dec0
SHA512 ca08a91c3639daa7642dd4d77045ca79c385692706fd04b45ee2a004a3e3ca8daefd30c85a7c20e3889e53d54371e59b2e66948326d093c6ca8dee58c8fbe4a0

memory/1056-261-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/1056-255-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/1056-263-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 0aab14f7bc5679834076ddd76edc90ce
SHA1 dac87331f2b4a19808b2fde7b558698f93b0bb3a
SHA256 b2ede4be8336e83e399bf7061adfc8bfdbeea11256cd5fe86b6fccb38b39d032
SHA512 ea692e37cbcf5a07b466cb6e67723470440813e1a7d5a369fef3651821ea5bf4275a8a9fecae82337cb8ae34bdeea45f8c646a421ff1f110ba1e4f8893f1e98d

memory/1696-269-0x0000000000520000-0x0000000000587000-memory.dmp

memory/1696-276-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 8afcb9471789418543119415a7eea777
SHA1 eb201bf2c3183bf9cb328a658c4581022d38f7e6
SHA256 c988b44cebc9cfdc69f570bb6d2ddd8e05ecd5b267d51f194a065ccbe4ab9495
SHA512 d14bb20843c21de23e01a86c2ff92d2e30949167bf86946165f2f6a488009ea2135f28b9666be4e0931e640b2f2037b6a224508e8168f95da58a1978fb93c321

memory/4520-279-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 6b8d3dde2c695d7e22f234f92faf8f1f
SHA1 df8da5ca2ee99f8b5d89d0676788eac48f58a577
SHA256 fd9088ed89252e11aa0200171f7cb913310e1eb5785c8459a390650075a3bf0b
SHA512 27875b22d956b1447d56b35e0063eeae400ce4467a9500d4cc608e8ec86ae49a02ac5e67db871a36119ac72e115b35ffe8695231a5790d33fab1009885342249

memory/4620-284-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 64ebb9c7f07c07c43f287a41c2159c8d
SHA1 2c9508a7804b8d9a118c8243053360a43f0302b9
SHA256 33f133a28e35cd174585978257a101632589e3821f81453f70c889617582eb71
SHA512 9a06f814ff5427e3b8f84959c32d4fc3ee72fe3abdb296d110ada80fc05086fbc7201234bdb443bad07f49b2df06ce7b883bb172819d9678d64af6b5ee223c5b

memory/1340-287-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 ae162cf5eb0ab43c63aec59146ef39f7
SHA1 9ba948985030bcdf8d63da32a55e0b8362e2cfd0
SHA256 278954b172fb26be9718b472e17b2379f8aca601dd920d816a476ee09a96ef88
SHA512 001e6d0ed12c6a714dfbd2c54de035c8433ed8cdc258415074634a127aa5cdf5a0c672b21d1377dc50d8ab1886040b717ba2af537ba6047fcf55d09040352b8e

memory/2028-289-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 72398f7666fd42c0aa5a0eb4ff28a054
SHA1 c32bfc62edf3a9af749d35fcb4648d6c980c7bde
SHA256 5e667b909e7983a323282abe73900959ecce5a2cc568e81f973f2638c8f3f061
SHA512 6e5b8ec4f90575bab3fee8bc334135e1f2deb91ecf5918327cb95864f71903c9a10038d67a2c6d42fe53fbc70a22dae1a365a47c45d33f37f1a7b9c443555b45

memory/3308-309-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 86ef9134b65705309b84c06219770552
SHA1 35232376751846a9da9065b071d78c9b8e38e638
SHA256 8093fda981b6c3f86d5cdfc2400349b7c61d3dbfaf31b61b41376a3bbda2d89a
SHA512 8099fa162d56d6f9ac0e601ab678ad50568bf1c86862e016c0854790e99b7ca59f16cc1e7e01473b32aa7865b39c7087e1d4569c64c930260027d0ee1bfb7c11

memory/4156-312-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 c55f8825efbadff472a74435aed1fb23
SHA1 6eae3421723e41f9f3d005b38e3b80046ad5883d
SHA256 3a5823de1d7149ff395280135eac141e7d95aa5f9bf09aaaac6650b60cf791c2
SHA512 92c1d090f3922f1b056aafb21d21f1bcb3fdac4260f3cbeff7fc6ea972d55b92b4d4df2aca2e5b68575ace270174dc6f3545d1f2cf3872e9eb826b1dff0d68f8

memory/2996-315-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 9a64e928ad4bcffb91c0ce8a23370bd6
SHA1 4b8d12908be4159a50988720f18827ca332bd677
SHA256 16624c6adf3dd3caa76c843d4b3f0e35de2ce48bde8fba28bc6e9e5f12499465
SHA512 8c05437495a5c3dc42966a46b6cfa36cdff1855edcf71d0cabf8fc850e09c0fa87d5bcd925b13b95508da8885c0bcc6e502dbe22866bd2f6a08481897c3d5436

memory/2996-318-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3196-320-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4512-319-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 f1d9353cc7382422ad2d6d63050efaa2
SHA1 82e0fc956bb192537220a280c83c1032dd4974b6
SHA256 e2d1b5959040a07d22f9bd0c1c32a76d9cdb21f455a94dbc6a0fc579f1e3389d
SHA512 2acb8860de04772586cc364776fa519ae0b903c459fbf11330aac24adc5ca9dcc2a3e19878ee3a2c309739e2f01717586dfb9eaa2e0a697f2c5ee0488059c47d

memory/4576-324-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1056-323-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 96bf146bec4a2622b680ab2e8c1f54b1
SHA1 79bf4a70ac0600373527dc1cfb91843249ec1349
SHA256 cfb5bde1505b2194bbcd4a2949f6a482107a888618ffa416c31c2761f2a76be3
SHA512 44a127dbed9d087f81210ef2cc8a6caa6d3dc00b13b0843ccf819cc125d701753615dcfca43652cc766b011283dc52a2f8956781aedfb2b87510ee03731c293b

memory/1696-327-0x0000000000400000-0x0000000000497000-memory.dmp

memory/652-328-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 226b9501383f5d1419707a90d89cd3e8
SHA1 bc532824718f48b6ea58b57056a95738ada98fe1
SHA256 b0efa2951e759731c901e115451e69f5910f14d192ba7e1689e2eaa86b5d77ac
SHA512 56bffa24f4342a74d98784b12385577961f88528e495e98ef0d09566645d89f8fd389f2eb20ea2d610ec343b99087264cc8802ee0fd9f19ae5e662eba1151585

memory/2892-331-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 5b5d38bb0aa87760171a3a0df5fb3aa3
SHA1 4852383582d4516c00798f1e7610ef47a1fe5628
SHA256 c63a54f6727ee534a8a0b22bc3efd138a676aa1815d5ea1ab0afb2b549347760
SHA512 2490822632b00d576487d8365c6108c0a49a184c7efcc166b2ae5da47ebb16143a4c4958741d0ac0f8cb9cc779ba1dc45d36baf857de52b3594ac14b083bd30b

memory/4108-336-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4620-335-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 a7d3fe9ef9f2367476db687a01acbc9f
SHA1 8a5bc4e04c39b7f418349cc10fad5050c53938e7
SHA256 aa2ca75fbc7874b13fa6e2010cb90145ad3086aab7da747ca2f1dfeae2d0334d
SHA512 84864a8935cb04c457e157094dd0deda5a7b2eaf3358469ab3bbda3d003119f08765be328c59a2b550046b51f036d024c0f46afea3fc27631272bd1a42f8c47b

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 5146181b5c59e8f2885322dd985cd804
SHA1 3b46504659883c3017483554176e02b7c6208973
SHA256 c72aef63fd029903e5312fddc153cb015c502be74b36bf603fc680d71200e6bc
SHA512 a0d657ebfa760d9b6133eb7a5eb0429c7c0829e35ee6a550cdbc9318d333ae3161b0fa4a8a8fbfa6b048f47c4041865d77054c0f50a1ea4743dab5fa082a71c7

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 868ec2b5d347443d34338cea8e22d221
SHA1 56d22395476ab41b202aba45924e27b849eddc5f
SHA256 50f3ce5d02395981612e22f4a2a2a7ef73e1b863a9be39e375bf1732adc646b3
SHA512 dadf3ed74018a27ac9cc749ef1bc930bcf3396d4f4ae7100e28ea507daa887d1bf2efd8e3861657900eae990cdc65063baa5a8d422a2e9eaa6585e5ed69972e3

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 74b6c4efd43dbcff971ee1feb5115a09
SHA1 080123da5a725021d20f76333b54dde155de85bf
SHA256 2c7f8d4fd4b511d732bacc887ce3dffdc982fa5969dbf9c4f4e56c721d619880
SHA512 4590ce1d7cce8ccd9cdba673b766a12200331f97802d827b5502f0c5522ba0394e8e88876b2d178761237e728816b1696d5aacb70cb70fa5f17e0f87bb677900

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 daf95b69072b2009e4c037eacdf05470
SHA1 31a08971c9589378e415b833aadf30bb9d1a0548
SHA256 d95c421d326d86a172654712c88a95060e560164fe09b25844b075d3f2d4d61a
SHA512 2149c77dd8b14514d6517ee77b8ca6da7d6e86adf42f0d9fd0e4836b8a7d7deabe04458557074514bef3908a568afebf7c0e513b4c996ccca6587183e8d0b2d0

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 e6814dbf442f70c78cedbdc1c3dea242
SHA1 f59dc8ba5d6870ea189dc822f503fd39a39d3598
SHA256 e1395b3ada06830290816d2579ac3bcb58c0bfbf8d2b579f8d0ff168468c58a3
SHA512 1071b8feeeea4a13119a8a95c706dc481fe3f68990b0b7c7643c58576df32b957b8478a85deeda9a75e35712a58435808d6018cf37056b7eb46c6d9ba6f76228

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 3ae40ec1daa6d47456a67024969b5b82
SHA1 e86e3e2f4a4f18c6e83e1b040adb1042cb1fb437
SHA256 55e486c653e20e5729ac3ba13dc6eca766f1df88b14e48a3c199e4c3f74bd388
SHA512 a5f2a34f1685fce38381372f713c1145f12dfc39fd46675fc72bc45b7036fa05dd7fe290de84fce393963c6e01031a1aa39ea82bdd4504079f536676ca6b01b2

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 d3c2affb51a624b835eed191581857e4
SHA1 af2f9dde181594b4d7540b90ccbceae754967ca6
SHA256 82f96d50b8c49f6e437c4071c9bbeec3d493eb1abb2e1735164675c5a4934df6
SHA512 a04ca6e3c8ff932247c4526940f4813647d3eeebd8786635067b21807b975188b841a6fa4236edb1dfc18c27d9de333a1143036d1161deb2c2a4fe6cd06ee4b4

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 32b2ba64d87e9d9ee2fb0703624ab10e
SHA1 80a97996423ca702d0ab308a8dbb8405a1ff9162
SHA256 3cdb5b204d745f16e471562c58049a4cbee0adb995392e4f580fabb352a24622
SHA512 9fd621898805fe4845aebd10578f50ee843d8ec25d4f917d8883cbd6c125dba2e3408510d2891aa0ee8073e5acfe169b6190093da4ec0b35326762ce35cc2978

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 8f4bc3e6b143340a62f94ec51745c618
SHA1 07cadc6f113fe615383303f51f2c540b69267e41
SHA256 0e7eb9868dc7791287d18ee55838bb0be51075ca24f42435226e1b983b2fe596
SHA512 4e271aa175aea63462df674369459c723665f9cd9672a956f7ec3c604ad1313e258836556063f1840d8fba708f21181c2aa131271720d93b523a04406965f552

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 fac85889ff452b173ebc11484dc2748d
SHA1 913688d6d537108b51065e2ca47ff44387940277
SHA256 3bb663e19d98f82aa24da90241ca3410f04f4a570c8be1d2587875957c0a6183
SHA512 8825e1d67d6a2c5d4cc9d8e4022d56e8407b8fd2d631385d08a622f356045d16e5456db3725511fbdb96c655f558ec154b0b66bc0a8472f2766232ab6132ae75

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 602965b67756c4f53b6e3ee8089c5f95
SHA1 356bae7637c40067836ed3c179243202e9d51a0a
SHA256 53d1e216bbbbfb2f6d25117f48595ccb4c3da53014e1f87ac3fc0839aace162b
SHA512 84567e30fa02abd42ca54db54a0b272be2a80c2cedf6fec01a3e6f17f0288e577ee8630a7e8aa2dadbaf4011f18ec519ef8666f31a90c6db7391bc1467ee7594

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 ab7eee1e8b73e6006b3a67751826b608
SHA1 4f7c252f0441347f51754de32d12a7dd39d5243a
SHA256 5d7a4b78e6b4c5bfe017ddccf9731dad632cc90ed24cc541a6ed47adfb00cb56
SHA512 07ab62309defc2593c725cfc8b6bacbdbb8b3dacf1fddb52e58770856048fb7cb113d685845d9388ff71633e02f01653e2c11933b40848e586e5cca39e193538

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 3b00b23780c95ebb95fae5d7b48e8ba7
SHA1 e5d1e8e119cd6873efb533e6d6ac55d1bbcf6e0a
SHA256 6958645046ac9d97716676a3df09fa65f79e24b253b30b95e300956df305113a
SHA512 a05cff01e9d8a8ed3b762e78c5f7703ab7f4a846b6f258c9ce16dbdc8e95319ea382a667a9516221474e01e9153171befa7e3d181280dc88b51192f0e2d375de

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 93c2f652786f0325f6af7da8ca291d79
SHA1 d6ff59fd13fcef3892ea30d42bf082a8fd54e94a
SHA256 3b1f59bffc3b71129553cc6d2c0bc28a42f5486be81cacf12e22dde6ac02ce2d
SHA512 fb4ebdb2b87c872aa21bb84120bf06e405ece15d473c49cf2203525725db3a793e5f7d74fe3b1d958e9b5e390d979636f48d2ae57a7276451aaa7007cb27a4b2

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 ca3eff645167c89c38ea5a45a34ae1a0
SHA1 52d24733f2cdc9d8f7ca041ab1ef90e7b0a5ff84
SHA256 f1b168d11ba32dfd120d49ff1fd8dcbc8448db74e91eab8dc57116d2943d463b
SHA512 d8c2a2f0785e6c9996ddabdf10dd4dba773b521b0045e4f62121ed406723b5d5c653cffc6b149f6c0d0b2a3e0a542347208c006959bd5e22f6b37f5a8816bccb

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 16dcb481a1b63fec8e7c62504aba5a3d
SHA1 32ae4383c9ba9913b87c0e5ec989d0402f939f06
SHA256 86a08a610a8cb54f6d4808d6f214f850a568332d9533f38d171c09072b2dc70b
SHA512 df376e5d7244e578a2aab6e1545e77ff8e5537a7fbb463e4877699515d6cf80a3ca435f7020f5b50747dec3c3eb4518958c8cac08e51c870a16d82ed5409f8e3

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 d7c1a767b4b6bda66386898a8b132e61
SHA1 15d86bcf5931dd790300c4e0d5a98850a801689d
SHA256 57fd5623eaf6f5033fb941b09d8c69844711352aa62f2353d6af8ead6a35154e
SHA512 31b46438bab92d30042385e1e0373e0600bf2cf021f021a75fe67d83412e531540876afcca34544708442d28e3bce5ff1f306fd7788e922cdc8a9f25bf71cd74

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 9b0eef016cea399c940191dbaf3ef7b4
SHA1 fc56e7afc118e106777e5d7a479a318dbd4b0cee
SHA256 1c7109564798ec01650bf7fc09f8cef6f322fa181a7ff6a79101dcfd5e4e3fd8
SHA512 d7b237190d216557082876ca35bab5b8a2f2867233b435214950a2e607c76c7e9de0489c84e3bdd5cdbde3f73cec37bf9a1404375f7ecb01474845ec2ced5d10

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 f11848631fe9430504472cb63119c7df
SHA1 51ebe2a8f1aced900e8c6779b4b7b986344a9ccd
SHA256 63cfaf78516b21cb738351321a943ca6f70090cabcd010abbace1345f7d15c16
SHA512 d3c08044c7ead2825c528789dd5dd4a3713cc5c81a362b116506efdd78d9c8c6c2b4c1716aa0fed52f9242f0f35277b38c51b5a6a7029f698ab836adb0e4f51c

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 1a7fb837b1e46f020caf61e25c012a85
SHA1 d5c830fdf5c182c4710894a27b49d72a38c54d2a
SHA256 95b598959e614580dc0980bb5a00b3203c5f413278b99fdfabef1a99aed0146d
SHA512 dbab92e25c9789af00584df6ea4fbd58ae88d1a297aa49674c0882c1731dd9de9d172cdf78e6e080a9ae3a77d08219faefb1f6cac2d535acf33a33378b482279

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 f9d7c2a42ff78183f6660e047e26c603
SHA1 47f676e49c2f7075c9e4b78e8bba5ef4e1eb6033
SHA256 4fcc1bd7e1ac714d72acaf2637d108cd096a3610466864af1f827721954be6a0
SHA512 125ade8e2d39fd0bb08e891d18e6397a153646d1e8d994f72a288722fbb33af2a46f9b13f15aac84d79967d1ef33f8bed4feee29d5137f330e3891458b5738df

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 68d791bfe60936bb710045ed49309c5b
SHA1 c82bb176b5038cb1ce18690e40aa9da85100dc61
SHA256 d9178537562f1d44a2c04f24c4bf3e1ead9c9859f75088e2ae0ac1a9548da1d3
SHA512 9f322e1156c09e101b376b100ad478c02d2a962cb8ed8065188673e5cd1958cc80b3fc94a86ea8512e7f73b68e59a6a8294cedb9b6426da592bc6269724c4197

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 67154a92d9e804b640e49a9be7ef07db
SHA1 473d936a18b41ae2bc0266a09e47371a919d7a12
SHA256 bea8da4b12cb5ffb34704278976ade34ece8448073aab2a1dadf6fff02ba7852
SHA512 3f98e57bc3871f5ce3b96a81efe6e1dd3be3ed1ab34800aa966b5231873c38973c354d1f189746331aa4d6604cbaab8c0fbf19784f48e3b88fca735ebb3a407e

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 3647038827f41e9720ed0232bdf81637
SHA1 9d0256dd44a744af10acad35f702938a9435ee63
SHA256 9d44b341061064c2affa36faef075a0ff7e4f67d7068480b6b7f2a3317d6b56f
SHA512 9db20064be3c507eeae145c3c975eee1f5270b990cce36838faed491c5dabcdbbb856f51e0cb087c8c5db933fce1c98a28701201283879c76e31a7f02e6992d0

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 d09ad50de6146d285113d2641da72298
SHA1 dd8cdb7aa1b0fbe4c7e10931663d2f68e33711a5
SHA256 93f7a4ce644ecdb7c6419946b1e9711be742edd1a107d7536da88dd3e8a08a7f
SHA512 e2b8aa6ea0623954dd30a3ddfde20650ee05c747108e3964f343c08ca1282080eba3e5f47f770a8b797103eaf493e142012e2c6947a0690a78ff41cb2c3420a9

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 20f2b7c697580b9da8fd07527b8a3465
SHA1 e44507fb5a860fc8ae9142e9bbd84d9514501d88
SHA256 20335317400bff5381f9fe909b8aeddae016344d31341b47f5a972a21f9ad491
SHA512 1f59f1477febd571a7c37049665de1dc141832b081daaa1636a06e8fd1563a7e16da78060345573ef0825d7126915ab47cc05118bf874d802e986db2041926bd

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 63bb14f79d527bd705b637e5d41dd068
SHA1 d33d97d09a8f7f0d3136916af36c63d99bb6df8c
SHA256 6e75c348b144179c5b82cdb02fe4a75dd0e1289961d0489b611511972e355578
SHA512 15d7846af4edd891da1e3636bfadec399227101078afefe4867d8364a76c378a0db1c15724cb812322174e5ab68362fc2a15e57095591671fe3e1abbb2932429

C:\Program Files\dotnet\dotnet.exe

MD5 3a0e75c931fb176a8a537547b186f509
SHA1 8fcf4dd8373a13bc3dd76dbfc6e31459bd280c41
SHA256 bb710055926351e1199576a066c904226ecb30f03c8404a619b927358aa1b514
SHA512 f5f20dd25de0be3be9cf5f98289464c756c9396a006a3ffad9035c6393a0e0112eab79de4c52ebef0f21019c0fc7d5ecb7b1bb41b5013dcd2b80963c68b7c29e

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 06e251d60a3f606f44a15a1a7ad65f30
SHA1 3f7aad8673429f1522e387ac30983f8f6c00bef6
SHA256 fd116cb86d1cd235b72cc351589978d30c83212dfa9112afd76abcb36e3ba655
SHA512 8e803c825fc976e396b341c18a76f3d89cf5fcf013bcb574e418e99a49192918479b309064026ff069cf079f59f5ae7b48fa7a2e9422096dd91f900a5834bb1a

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 39b6d2053f598192bc4df72452e0f52b
SHA1 6418ded258f440d490b1a72cf41c7c690fa6986d
SHA256 f15b61d213bd56d0c37e8e6796cbb721e85109cb95d4be75bf3cd3d5105b9809
SHA512 0d42b8a30187723c2e70c537d52929cddcefd846e37cb8e66eed5de4ac717e257ec91f9477f713698a2a5a34845c7fd979ce13798e0972ab433104c3c200b5d5

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 fb822946258f979dd0c1d81ef203b4ad
SHA1 7e5e7e64d7e4b75030abb915745e6a6cb9870cbd
SHA256 6ef0c21e2b359b011a672b28bbedb99090e2447af51de3c8c1c06a4b9bf89631
SHA512 f31686c84eef44d16698da45a33e40eb5166eb33a7f60cc88ec14197bda42ebd6e58a145b65c2b5e0b1558c2aab70215a760129f28959355bd878a3495f25cdd

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 4c58c403ad153fd9e75e7db62648ca4f
SHA1 b674d75b3b02fb766d2b2f3faaa5de4362134800
SHA256 6ca28f5d4954ff092b2d0e70174ba36f94e27c4a8357813982e55801225e19f5
SHA512 6aaa4a5805143ad6bc801e6848d2845197fc591b8299716133030be22946e4a5d6b59d1253bc8eaa2bcc698356c9d9ac5b4870e5a8ecd2642c6a00072efa7e8c

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 6a62448f17515c1fea7e57108dcda362
SHA1 5dbf3de3ce2f3f918c9c58c7dade6a5615c30b0b
SHA256 bf19ff4979646715c1fcce2fd8bdff40920489608cac4123e284ad0ef2c70c2b
SHA512 6b03a19c6aa90912888b06edb55a56c386f5775686ae02eee3e3d99fcf1db06351c76a67236c3aefd0ce220a7df9badc4958e1915af0d790b68cdd638ef9e54a

C:\Program Files\7-Zip\Uninstall.exe

MD5 3ebdb1432c4871dea533b958eed6297b
SHA1 0b75e3ebf3c8058a34bde724709f7bab6984e156
SHA256 bce37ae529d2abd325ad6dd76c20c585d0edeb65c2c766401af11540f4c0d76a
SHA512 628376df0afdf646e47c05ca8dc1b98c4d86eb48b6b93e6659137d56ffbc8c0c7a58730cd97f61eed7bf746b25f9e96b4d2817b3c2fafef63d7dd541d7963e75

C:\Program Files\7-Zip\7zG.exe

MD5 9d644fb811e2b779881d6ad87064ec91
SHA1 0432697ebea3538805ff068cfb56ba3020ee9462
SHA256 45c930218ea44a1d7ede46745dd965f218c1b3014d4d7bfeed8c80747b3d02b7
SHA512 608e6ffc0659a55b19bd26552a547d3b3651f58935d7c714c15cb860f753f01ff1ca5836c7719e0a035a87c9e4fe3c6b6ac1ac383b45fb5b9ee96b43f6c22ade

C:\Program Files\7-Zip\7zFM.exe

MD5 05fdfa07ecd85a527ccf80385807fc29
SHA1 6f7235cb0b141051d59a2f62f6d6718b3e301717
SHA256 7a50b7d99df6c07bfc324514f9b3c661927f11484f20cee2cb7807c4665d5533
SHA512 646ba3a0664a03d65aff13b61368288a1cac556cd34d445a5e6847168b85579a0c8e36df65db8b73884b3aa4c28754aab603c3808cdcf422e804a957c0c8888d

memory/2028-525-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4620-526-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3308-527-0x0000000140000000-0x0000000140102000-memory.dmp

memory/4156-528-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/3196-531-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4576-532-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/652-533-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2892-534-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/4108-536-0x0000000140000000-0x0000000140179000-memory.dmp