Malware Analysis Report

2024-11-30 06:50

Sample ID 240604-b59jasha6y
Target b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603
SHA256 b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603
Tags
evasion spyware stealer trojan
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603

Threat Level: Shows suspicious behavior

The file b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603 was found to be: Shows suspicious behavior.

Malicious Activity Summary

evasion spyware stealer trojan

Reads user/profile data of web browsers

Executes dropped EXE

Checks whether UAC is enabled

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 01:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 01:44

Reported

2024-06-04 01:47

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\80dc521ac3136770.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007888ad220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d31980d320b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da886bd220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e01356d220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068a021d220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053d698d220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df389bd220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000414c8fd220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d6526d220b6da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe

"C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe"

C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe

C:\Users\Admin\AppData\Local\Temp\b27aa85c296f610fec6653a253654195bfdb723c48699ddfd0acfbb979043603.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\126.0.6462.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=126.0.6462.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --initial-client-data=0x2dc,0x2e0,0x2e4,0x2cc,0x2e8,0x80965c,0x809668,0x809674

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 44.208.124.139:80 przvgke.biz tcp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 44.208.124.139:80 przvgke.biz tcp
US 44.208.124.139:80 przvgke.biz tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 139.124.208.44.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 44.208.124.139:80 przvgke.biz tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 61.43.200.44.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 34.193.97.35:80 fwiwk.biz tcp
US 8.8.8.8:53 197.86.237.3.in-addr.arpa udp
US 34.193.97.35:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 54.80.154.23:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 23.154.80.54.in-addr.arpa udp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 3.237.86.197:80 saytjshyf.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 34.193.97.35:80 fwiwk.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 34.193.97.35:80 fwiwk.biz tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 54.80.154.23:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 3.237.86.197:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 54.80.154.23:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 86.104.213.44.in-addr.arpa udp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 8.8.8.8:53 deoci.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 54.80.154.23:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 173.204.218.34.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 54.80.154.23:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 3.237.86.197:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 54.80.154.23:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 44.200.43.61:80 rrqafepng.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 8.8.8.8:53 whjovd.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 reczwga.biz udp
US 3.237.86.197:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 54.80.154.23:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 warkcdu.biz udp
US 54.244.188.177:80 ywffr.biz tcp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 54.80.154.23:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 3.237.86.197:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 3.237.86.197:80 zrlssa.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 54.80.154.23:80 xyrgy.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 8.8.8.8:53 uaafd.biz udp
US 34.193.97.35:80 htwqzczce.biz tcp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 44.200.43.61:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 3.237.86.197:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 54.80.154.23:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 54.80.154.23:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 3.237.86.197:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 3.237.86.197:80 zrlssa.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 54.80.154.23:80 xyrgy.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 34.193.97.35:80 htwqzczce.biz tcp
US 34.193.97.35:80 htwqzczce.biz tcp
US 34.193.97.35:80 htwqzczce.biz tcp
US 8.8.8.8:53 108.116.69.13.in-addr.arpa udp

Files

memory/5036-8-0x0000000002690000-0x00000000026F7000-memory.dmp

memory/5036-7-0x0000000000400000-0x0000000000936000-memory.dmp

memory/5036-0-0x0000000002690000-0x00000000026F7000-memory.dmp

C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log

MD5 e33856ac247d27f4d32c84a9ef423222
SHA1 a009231847b8d74bf51bc195dcec209692e52dd0
SHA256 51af306e3382352189f916c93f7f15c89110415eae31370165adce5c1175603a
SHA512 45d2d730721b51a60b87e311dfaa7ca2b5f5f644588fa7bf70d32b392892d2d74f09a304ab66afbed40c7b2115c27a1c03a183989a03690676942facd7b7b984

memory/1032-11-0x0000000002540000-0x00000000025A7000-memory.dmp

memory/1032-20-0x0000000002540000-0x00000000025A7000-memory.dmp

memory/1032-19-0x0000000000400000-0x0000000000936000-memory.dmp

C:\Windows\System32\alg.exe

MD5 6ecba2b9a4edd3e36a722c7cbd890097
SHA1 ed12e2915e1c4610235b4fef7b93d5bbdd8aef69
SHA256 95faa3bd33a73044c78f64f48d398a78c0aee6cb9617ac4871c0a6b437ce1ee8
SHA512 cf8b67d1346b6aeb9e1239788fa6770a6ed3636b637920b7f623e392f829cd5908c5ed1ffe6a02f1c978b03b81a47c312f9c676fe1ca7cec71c6397e0b8ea931

memory/1912-22-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Users\Admin\AppData\Roaming\80dc521ac3136770.bin

MD5 6dec0faa99ffff1d0c5f2d1c17b5ca83
SHA1 b22737c0fc42ac2737840b425eba28ec3fa41981
SHA256 2277ab29d5e0714f7a55dd53a55f2ea4508b95477fc6715d13ac0fabac1f0253
SHA512 21f2d2c1fbbe4e52fd2ec371a1966733d8a11de22f5a28ef4fbbf6388f6f448ce804e0690f5295df277d12a4b548727bd4d05e02efc29c64ca724a18fc6f9257

memory/1912-36-0x0000000000500000-0x0000000000560000-memory.dmp

memory/5036-38-0x0000000000400000-0x0000000000936000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 a06c6e043eebad8a52af72fb5078953d
SHA1 573ba5b04ef6b236f80e2f8e59215e374685780d
SHA256 a93133facf7af9fc8c4cfe5eefde3097e66763f5882873579ab9ad9345999dbd
SHA512 426ad7083710fae1a74b7a0e9aba08448fc386590eba85ef4f7e2197be98f8fe4079d78adf1cf5508c0652021d4cd4d994a4b5683e2fe7ffdebe456c6cdc1bfb

memory/2344-48-0x00000000004C0000-0x0000000000520000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 04f8219060a689bfbad0aecb3ab09628
SHA1 a710a1d59d62b7da274f7f925710a95596ee5cf5
SHA256 863b5c5534f3f3a725e92e1ff341774307b4d619934036b537f9a490214075bb
SHA512 3abce83b0cf2cbd0c4fd3d5f39478d13b2b3b6deade858013b1bb3b5c5610fdc30742f868f84a087d583690c3ceba8d7b903b85782061d972b217df0883aee0d

memory/4368-58-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/3808-70-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/2036-80-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4368-94-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 7b1b83cee7a74334974608f997ecbb07
SHA1 20b74f753eca0bea25bf5b74bd285922ea17740a
SHA256 ac3eca9011b95711d6d0c13f0e5a1ae7475454a6d30093a61e980416379fb098
SHA512 d3381851b493ac0082941cbffc23507fcdb34f0c5f11fa6a495770bf691218d6ee054faa09c56e5491dc2ed14d97eeb5b89be4c21b5f6b41e5b83dd458563b9d

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 87cf0dd1e083b097db740d0933c3a098
SHA1 83ba16f552b4c0c53da17c24945a408ff5fd508a
SHA256 d4860cf6b8d33ccce6e2ca34f46b69ede52c670ae5c9f055e6dd16c11e430a00
SHA512 43fcd8c709af43b324cfe31fba470d382bbe6fdb68062fc2824013be253bfec3aad77f26e0ac4f85c0a5d06af7ae3e92e6693b1a9cee03156269240ec801112c

C:\Windows\System32\SensorDataService.exe

MD5 5b167a63790ea22284522efd56247f17
SHA1 a1f7012851efae152184531834a9b0949f68ea11
SHA256 8eddcf2352ddaf0d4f0557f1f7415857bba1a61928053150a379754ad0ec0a7a
SHA512 9266e451120d63418fd6b480ad307cdd2ac568b371a8bc35a87db619bf42b5ae133286f188fa629642c329b2e8900ce2d42c91c4e18f7ce2414a1b6794115ca4

C:\Windows\System32\snmptrap.exe

MD5 ee27be757d321be14a8b694cc971a698
SHA1 515683b368012da38ec1bad73f3375890ae8495f
SHA256 f6104b6f8475883efd9b4228f0072488d8724de31ccad392336eed2e7b07925b
SHA512 8dbc0fe57f7b809895d4ee0b6dc62c4fe5e4f142e567ae96016f5f02461893aa5a9627848fc7f0c68f20c8c52ecb8fadccc36321a333f2184d18755ddcd6d0b2

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 bde3d386efd1215049ca78e6d6d146f0
SHA1 bca38f316d0a8212acc786638b9cfed630f6da2a
SHA256 da384fc2e123f6ed3bf6d2c3a5ee6bf8dc3bf0936d215e679c0e9c7a582d4fde
SHA512 035aeee51ca5e70748cc4f1b4d885ee9954675a22d3ed0b0fc5d1923c2d9cbfd36e9bb95c9ebfe49788c77e47e68185e054aed92c2309dd5f89e4979f0e9284d

C:\Windows\System32\TieringEngineService.exe

MD5 b9229d655f5d0ab1f95d7d888f53fe96
SHA1 eabce089cae99ca5ebfb1781ac18cc8fab0a981f
SHA256 bc325d6bb3611164eb3032d6d9385f0ccf10acea40312e44097bc4582af3092f
SHA512 b62e99cd9a4037e702c22e2cc13731ff95f389f2d9667bfbb1145b0fd177729d5de9e942713cb4da89a74c15c96d65b5e5f434b08867819a0695bd8f4212c621

C:\Windows\System32\AgentService.exe

MD5 56d3c5a19765c216e0beb838c61fc72e
SHA1 2f1d6f67d2513204d73256c1e74bee299d2c24c0
SHA256 c50ddbf21a22def03c63696c35f8e61ee228ec450b7dca66c4907d374ef045ca
SHA512 9469e82c8cb7b4290baefbc16b8851bc4f08ca1f98065eaab8e8c4a0a455907f15cf46bfb43970b6867ed080cd972ab1ecdfcfc01577995b0bf9d285b94057ef

C:\Windows\System32\vds.exe

MD5 c5eeb3a68c7580c054fe3a0e33fc862d
SHA1 480b892073f082c8595ab34ccc4a5965083a29c1
SHA256 ad95866ef795b1cb413d63fa97c48ec4040b1d1adf9199f0d3add8c46ffcc8ef
SHA512 7005eaf98dda4ae155de3d665b9b920a1a1bba11c16af6fd827832d4b581a3576b4d62bf733baaa5252a79b2f7fb787db738b9cf384c05b8a9cfe1e00f988cb8

C:\Windows\System32\VSSVC.exe

MD5 71e5790512581cc6066ca59870d7dc67
SHA1 466a2a2e47b84c51a5f41f52c81c4d011168830a
SHA256 857bf50df075d5b0110273d6f0d51b690eaeed62c33f535b81e030c0f8fe033a
SHA512 8932b1d28795b8b91acb030bc1caf8e3b6657db090f19f0a973937622eb6db663c2525dfa75e1ae81dcf8422f3f16d328a780986cb616055129dcd97d0f8bbe6

memory/1776-217-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 d21a53bdaf96b381e493e23ae5ebb1d3
SHA1 fe3070bab4a4f01a8eef9f16d563a5128c9fc237
SHA256 2f30a059c16fc013df8fd8a3dd2664d97c0a62e9078a667abf9535b1adf7867c
SHA512 b9d5a0604e7b0d81b5e1a418b47830520a31e61c6dd67869df32db2286be80df359099650093e841d8a530c5c8aa09fd0a90995f13da64eef7524152d4b9bada

C:\Windows\System32\SearchIndexer.exe

MD5 470d1b30906286f12b848b180368a782
SHA1 17192bb1e53d532d288ab73862300adc26ebbd0e
SHA256 a151cee0c256518aa89b9a2e8792914255a271829ed38c4366504771708eacc0
SHA512 0cdb09d994d7dcf7ea586955c124bb42de2f9eccab7727277810fb6d3a95754d1b900704d6b72e60569a75cc7d8ddddb263418200df29291c2f98c30b0533fe8

C:\Windows\System32\wbengine.exe

MD5 f4e0fc4229ea3920facec3897bd35d2c
SHA1 8350fcc7a8a421a64397c8243d4319e0f5fbbdce
SHA256 31a561166c11c067c5cbddac3cb7fb86dba63fde294eccfc61625fcf4c717649
SHA512 90b4ac3e72375b6df9957899742cc85be96b93cb947f5413a14dedd81b2780f3bbfab485165529aa0a7d720c9a1da1773964d77e346aa29fdb3a4476d584effe

C:\Windows\System32\Spectrum.exe

MD5 ade86ce1221bea908214e72768fef86b
SHA1 b0f1e49c8275dcfb05c9c4aa0485743ca0e42f78
SHA256 c26e292ce5fbbc1727ee6f9eb622f10ef80fd10b68685f4a16b9c337d1332a1c
SHA512 14d727a37acef90a77369257f1793eede0ca72c12a37bafd871f12be146977ca62c01b1c0459b565a6d9bd76f1097117e34638617f5a4d996c99101428ecca9c

C:\Windows\System32\Locator.exe

MD5 9f351318f2e785d30fd8468dfc22d5ed
SHA1 9ff494d27317e4930d97ba6b3231805755072d00
SHA256 830af6f120481590cb715a832924c5a9af1efebde4cd4304532440d68a305a48
SHA512 2688ff3fc4476ab6746e05814ffd6cc1cd8967d542337655058901770be48309b5be922824503fe840cab80d13f6ee54616262583e1bd5d883e4d8dafa171824

C:\Windows\SysWOW64\perfhost.exe

MD5 09bf592158ea23e51d5c9bdd406b592f
SHA1 5a3d5457c621e00da19e8067abcd0d0e45755e71
SHA256 ebbfd83af4ff12bffcca228cdabe4a4599dd15d954bcdc3954d813eaed9a0191
SHA512 c84596ab76913abe143b9c59fb752899e430b7a9d21babee355277ddcb545934f5967cab0f947f1ac83992ea6d1c2395906c11fddc05ffff3840bae8baf0e4c8

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 5edaf5e39438e31e62d2313dc0a63b9e
SHA1 36682ba69496c320b7a444b98e810f8aaad196ca
SHA256 18a13fa0197b8c6881e1ce13bb1f37f5c3ad391db44046de289d997891766cad
SHA512 a5779980f130b52e1a3996f21f5c7c8604aa807b9a5dc6d92dd97cd5a9b74f9ff8dd8c706e8f21bc6cc7dbf53d69572fddac3465293cab3a849a088f540b8c3b

memory/4312-99-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4368-92-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/4312-90-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4312-84-0x0000000001A50000-0x0000000001AB0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 e386a912e08ef9c71a2f01dafa701004
SHA1 bdc205042dfaa409e75a76fe7b58ebe5bd960aa9
SHA256 b010a7fa13dfdb292ae2d8ca88d7c647b1e88763f1a8a9d5763664d65f54f7ff
SHA512 010c7b060d9c556d46e325d142241531d3114abb8cb207b6d58a29968a49690a1d651d83ebec74d4e82b988d49c432b7765217d9dd5369fb976aedbcad4d3d22

memory/2036-74-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 23d41598a4e7cacfb350a2dfd0ba8e3a
SHA1 45a3650662c3f6e2e19b579609bd998d919daf86
SHA256 3322978693498b2d0aad40130bdabb7bde7e54ac33e7863d15dbcd1effe2b994
SHA512 8ea2f820ed38ea0a2402f0fbcbb78efc4924bcee6b0541cc0ed679e1283088bc65d04f74b1fa269fe5bf89c644151aae9b0aa3716f81d7d4b7c128251bad7175

memory/3808-64-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 8b1cf16abcb6f5ebf5bc1c63911defa8
SHA1 618bedef9829d47473145097f428b6a91156b9d2
SHA256 751b8874a13c72159e9568d13e1e3425aba1f41468af9a6f4c7bf8a25057de46
SHA512 6decaef01cf64d44e94f6850cb2322864a0115eac6e5c2adff79c885e423b3c1f87251ace299193d1ab56887141c4fc4b26e48d0287a30a8b0d40790f6857a8a

memory/4368-62-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2344-61-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4368-52-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/2344-42-0x00000000004C0000-0x0000000000520000-memory.dmp

memory/1912-26-0x0000000000500000-0x0000000000560000-memory.dmp

memory/4980-280-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3580-287-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/3076-291-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/968-290-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4656-289-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3128-288-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2188-286-0x0000000140000000-0x0000000140102000-memory.dmp

memory/3444-326-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1188-285-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3460-284-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2936-283-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5040-282-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4752-281-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2044-279-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2036-278-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3808-277-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2096-276-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/2936-545-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1032-578-0x0000000000400000-0x0000000000936000-memory.dmp

memory/1912-581-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3808-582-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2036-583-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3076-584-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/3444-585-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 2111973e1dff8af45802d77908e879d3
SHA1 aa9ab2c36ee68c5502e270dce5801aaa59fb4ab6
SHA256 0c1432b491720b8e64571d02145a5f5277261573a80e58be36728f52b3aac209
SHA512 807d5808ea70817a65b8d340393b9e03ec41d9b5ac57a2c3dbcc8d9ebde98ba379c2ce91871139c1fe40028bf9e2e0740a714d673db0082adf7ce447b8c35aa1

C:\Windows\system32\SgrmBroker.exe

MD5 d49c05c78a2af90091d788de98193ee4
SHA1 5ae1399460fa3d90624215bc94bd832b3739b39e
SHA256 ec424f52f0ee245f453755c25fb3b1b8b5f60b3fbc9ad9ea83b2db9a5e1d4cb5
SHA512 f362baa5a27d957ee069294b06fdb437f777255c08cba30ed7aa3e5f639ac6d98a7cec896112bb4aafb723b80e151e1b815c2ff2a92559af09150f6b107ad86e

C:\Windows\system32\msiexec.exe

MD5 bd3195f48adc87117ae06f8e0b1f5106
SHA1 1eafdd46c8d4109d581e8cb15c32219734e2b7a7
SHA256 43892554a0356c2b2224d5ea6464b4499008f3beda98c01ac7ea343f037df4f4
SHA512 2da2d5635db4b3f668331d1c41e7a4237b98736c96b4b8470da860767955287d29ad4db2408f69526080418133385397d1aeede42187bb1b27f32e92dc02407f

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 aa0e3cce2aebe044f2d3a46b3e3ba6e6
SHA1 88612d7389b91b23380fdaf841ad9e27b591b737
SHA256 ac580ad5bce9a54c0744bf3b7bee060cdeefe9507b2194fcde81e569443b6946
SHA512 2c1c14ffaaa50ddf6212417d027b916c1a0ddb9531081fc2162469732fc4c66ae950d9b7b93dab694c7cd28edf17d6913ccf92f6866afb4951107f4789e09d0b

C:\Program Files\7-Zip\7z.exe

MD5 311349184c0f5712cdc0a00db3b3fb30
SHA1 d77507c91251bb4451d116a5d4e698303fe3b4c0
SHA256 feab830774310402b5acd5b33dee792e11301edcc50ab6a51969288249fbccfd
SHA512 0a7d5fbaf7fb7e84091e204d7bff937ad2bbeba582ac61ab540f5e9b171043f1beff06abb03906dcdcbdd593598cfcd5e7b63b83253a67ec094224f5f01b661e

C:\Program Files\7-Zip\7zFM.exe

MD5 40ff7bdc9fbc1a3569b4ecc7a0a82b46
SHA1 d817da8229a584515ad094d3b68591112ac1fa4d
SHA256 e2a1d20123855688772e7a01529956defbb21ce191b2645bb7d59b93a4c378fb
SHA512 0bbf20022d1755b01f5a55f45db147e211d5a36a6f53c63c232f0aae2c5c8f7c30f8c47fdea60af3d1cb39aae11f08402cadf1646055dec273dcfcbfbe906b99

C:\Program Files\7-Zip\7zG.exe

MD5 304056ae799404fa897aec607b5a033c
SHA1 b2f72c837fffe57f5ecc9f429e349a6908c5d7a5
SHA256 84d44ae4d77b4060c9555739276b24d223e7c3418bf2cb7fdc4e48e92a42d972
SHA512 9062024c32b065485c2cde992ce2116e6aa302038f4a0b19786bb8f11e316d54789c425d022882044043ad00ae5e2ad708470446fc7167bc14ba8cb8756aef94

C:\Program Files\7-Zip\Uninstall.exe

MD5 ebfb49dcd82b6205f6388eec05551f56
SHA1 ef8d94315cb4075254d1107120fe15327dc2e9b5
SHA256 3718d47599ee82156259e4fdfd0023e9da6c58dd1aac1f2b470b06061fd90ec8
SHA512 2bdfdbfbc42bef848e321cf87520582091cf49c1f6b4552dcbfc6fcac96e1d4dcf963b0bce5830483a6a2fe3ae159b083d7e77b972b0ac760b556451a7ba489d

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 a1881f0af86c49f9eba7f52cae05a6f7
SHA1 0b63fb25c2abdaa1dff2f9f3a67d039e7f9a7e30
SHA256 4e80b80f43468b2c26f9820b9293ae4faf60858a2bce094f1b3ac5f4a59dd0e2
SHA512 c3c96d3eb75c91a44e797f359712625b52e6d527c0ebd75b7a2f79e0ce6cf262207314d1c3830db657678df268ba8cd84d64b65cbc1d25c5355346a2140bbeb0

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 eb3362fd5fded0918c224e90a4e9cb9f
SHA1 0f683e32b38bf95756b184a13ee59437aa4195ea
SHA256 8224b3de5480cc154e6a9aa626f0bda0487ac1ab6236eaccc315a342fbe2f867
SHA512 8c064bdf3167335d88f59ccbae4313bed5f21058d0c4de148098b62bbf69b4410c711e0640d84610a7c9a790758a5ba47a8c4278a8aa910b45dcca05ba146e08

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 bf5bd34b3754bbc56c3a0b80b46fb41e
SHA1 36aeb23edcd0f9c002e46d8ac6ae81462ecfb1f7
SHA256 ab2e9a3a9a70155c2cf41c64a3f2f1c8cc6cbd54d0dfbe2b04393554121c8d46
SHA512 a8115143fda52ed2a020eb96d04fc0f78301cdf7f7e65e9044ff653360338db6e390ce286b0ba47cc527e46038a1fa83020b7e25483bee2f8f558fdce092fd97

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 073670c7771b313e5e43eaaffe3f0c20
SHA1 a154dd5faeba28922db2591a54e4ab6a7a3b71f1
SHA256 e2de4bb0180bff254dd5529cd5b0cc527ebf93a9100c2579cb7c26710ba31d8b
SHA512 7599e75422ec9762e31ef0526af1c43a6db745c3898d0b0e1ec3b87d86c10bbada90472ba596ad501131f974275d5d146e6aeebeeb95ebe45c89b9347fdad391

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 fd0836456ae80fa8946cf9a4dd6db346
SHA1 7d6920388429f59e9e52b613194b22821c0f8c05
SHA256 b81c1e037893d2df5d8aaab616526abfd98d4e110631fa52cf200d4823b135bb
SHA512 a8dc6bfd2895cb6928436005cf8dbefebf708f9c298df5bb1ff8c4502909c80aedeb9d8eb31200f5348da329c82d9c0b037e585a5b54bf894426b7ea42b05002

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 408365a27ae7803a1530774f8cce8e3f
SHA1 cec859ffa4accf39e000a1bfdc65763265a94dc4
SHA256 448f07c2767f29ca8232ee39fddd06abe07becac4dd3f1ef210e8df25a7eebbb
SHA512 6024bc0c0e892f8e23942024019a3ca8fbd9deeae9aae5c1df5e4cc3ceae43f0f520374c08d21a3791b8ae596883cb3f70eebc12eff5857ddb2296bc4b1b5b2f

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 e28bf27f9207754fef5a059d0e8fb9ef
SHA1 2824c57bdb3f1e7578fdbe6c637d194039925164
SHA256 3e865aeefbbb617a49ef1095afd706ac7452d4bcfb0d76a1f5cf651d512438c9
SHA512 c96ab7ca792c258b349b071151e09ceb3e73bffd9b533d7febe6e6d50df39991375865f079c1d8f1df1029c75fcbeb64899af0a54419e7017ca50414b08e7651

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 0301520f8a121c63439d0e2cce9770e7
SHA1 a5d7ab0ab6b99a008349f13ac6da74cd104020f2
SHA256 2a6ea59577c8055ec3701a2e5b36d42bec052953c36cff66e051834c066e88a7
SHA512 f51b8331d1456a08f8b9f76dd87bf01ba152321a57f4e58d455b042f4cbc52056dc41650aa891d23ccafdb274fe4cbe1f6e193f4c60aeb2e8654ecd29086f730

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 a27812e8fec07f8b143cb288a082b012
SHA1 5373b69f79503bde3c9d5ef005b8f5dadd4eeec1
SHA256 439407319f5a87662183c93ccbae48cc022590f591398ad5f25e0cef6c6f392b
SHA512 d54f03143425810adaa828479ae89d29abf7d3d1709aeac4d0dec543d42f85ca3fef6efa0dbeea614321de2103921a71776b34921e9aae35afb37072947db2ab

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 d7426b8f52a03a64cae1934610e181a0
SHA1 b9b0640d3fa14af42149935f722973555ed8cc01
SHA256 4efa32c1028ee76fa7b19d1f69d6b32131d41c41ea1c66ef0b32dd66c4251983
SHA512 0546b49c6a1aac5d38a7dcb098699063ede791f52df94e0837840886fe6e4a19a31cb773358306a3dc2facf530941137b6436c7cc09f4f71f89cf96dab10edcb

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 fda46afa96bedb1c7d0e6ba05bf3937a
SHA1 42157ba53111b065f691be7a9d464640d1f7c7e7
SHA256 b98bae43221d68385d660b93f4b80490556c9bcb8ae750986314ebdda48ffc24
SHA512 c6f9390b3596216f19288914a2956c96ffc4e11da705d77ea88fcadc9d9238c132a35def73e838d94c901c219a564a536fcce167d198e2e98250e533fb53de1b

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 d2cf6c6f3d9cf2241a337dc09d828e6e
SHA1 1784973f25483f50a7473038881265f77f6cf095
SHA256 0803f0ea3b1e3398c342b5ba344bc1fb7342e9bfc9a2ee9908cc9a995a4caf9d
SHA512 351cba4a4080fe59961e137ef21acd634136c73f61d86ebcd7ae2cbc7cf4d34d5e00686bb28d3fc8621ccc77b4ad2205dedd0ae97ae7ddddae4bde42a77f230d

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 584be9084d6d47159616a36bb137dbb9
SHA1 325011c3a1e8c481896eb605b2b1581bbf77e759
SHA256 457de660d6381b7e8c51a76cf120bc74d7d8ad34843665ed2a650dc62151771f
SHA512 a9af43ed6139143bc5ad0c3565bb60a2130217b2112e08167a85628fb6397d5c730f52d90ff55af735235a2c794d95c5573098d3ecc1cb829013705a2de7df73

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 b517c3db975bb9e70c5f82986b50b54f
SHA1 2dfa755f68c143de62b483cfd45332f7203ff931
SHA256 7b85d7826ea8ada304d15d9d3e6c229269ff7922d56b2e352d19f5988cab82d3
SHA512 84d3e3ad122fef7a5500c8a51638132675d98e0aedee8626d23cd9eb24274043dd742e3023cebf575cb83944130185235535836a0a5ce919843fd498f733318f

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 ac9bd761c2279192785fed0d5ba54eb1
SHA1 69c93d9d22444e5db8b637f1d99e362dd506c029
SHA256 7b8078f5fbf16f05dc172642020fbd34b88d48a4c34669360f8b405e3df34b12
SHA512 e274b031c11aaf05f76b5feda1697c43e3fb709f5b243baf2fbe3284c337ca98771c7b5258183360397fb1dfdd74761829f7d9ff1b269a3a1130f4eadd3451f2

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 c4c5ea14d908dbfd1b8dedbbbcded3b1
SHA1 4f050edd8e5ae4630886a33d0d0b528f03b5dcac
SHA256 c71e3e5393e5c522a532a452a46f334ada334b0ab30f93f8dd69c1383b0c6849
SHA512 edfc6ec4f7c28e8f784816f72e0d20feb606230bcceb57d8e60d45285eec921c1d20403c767c1d101b2d8d3b417556e3dfbc7d3cbc5e1a80dd3af2899d8432c6

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 d99051d2e8e33cf1e751aaf1f1c74670
SHA1 cdff5708d73ba304ac527cdbf91256f1a6ed8383
SHA256 7dc931ff71b2372a6f64b5c1447a0418a519f4e95de2f8883a66dbb06e6dbbbf
SHA512 fb882f4843188d249dd5618daf3de6a6b29c641a32e9734c3bff187bad7aa80f2d9e9ae87c3075a5a5c60e6f02c572e87beaefa0e13e5efed4c4ae33b2530f9b

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 a223dc14a83f03048ff77b1982ee742e
SHA1 4a2443efaf72b7ed62415771e1a16c5ffccdafa0
SHA256 574065afa20e680bb9136d7213e2259faae31e1a4a1734e491022ea5d416f0d7
SHA512 c208264d2930c5ce93e7d628a1c28fe927cfcd03173418d3c24332808d2f3866063bb4dbab8300bf6775cf632012baa0d40e5f0289e2f0b0852c389354a986df

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 a51d24df217747be01e0f7143015e5a7
SHA1 52f84f7adf2103f714b6042953dbf81dfe2f871b
SHA256 7317a097f4fe9c371568d6caa292a621a842d5059739a80fa8946ad7ff80a3a0
SHA512 299bc620eb3838990187b905011e413f888a9497f8bba323c10395f388d8679bdc5a4538ef668e4fe5216767f1c5a8b1e3408951af6d68b82e9703b67aa92cab

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 763f0ce2b61580ee3fce0a679bba4f2a
SHA1 475b648df8907f24840fbd8b2a1d3fd78dda2ffe
SHA256 65b251e51e806438f991de1e8018a18b390a54cc78e57b19a26bba76bfeb29eb
SHA512 68fe89fae1f8c020ce0676d1ec1c6c8041a13fc60d7d2a805a64f359012e0e632128ec163d742a510264ce704695e5cad3c0ec72a013da841561f7eee1f3e031

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 0d1ea032c95e80d22a1d81ed594a9d44
SHA1 8692f58e0c65db03b80fef2d978c6d73628c7d31
SHA256 b1b0a37c3efb00cc8706f9fad42544d1585b5ced76aa19f4d1d4992c07a11fac
SHA512 a152d45bd10f7d4b26cbcfaa33e2018c8daf10d097f21cbdfd05ee7484d1869decf7d52b84abb47823c0bd1e28ee431d7814169d661cb40a7ff7f99d6882b946

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 f6e14741afaf036dc69a121ba231fa8f
SHA1 0bf3d1e8cf795ef84e152dc9eee974ce2202a310
SHA256 5dad967bea5f788b150cabd685032d427b5f34760632ca9e6fa2beb4d444ed4a
SHA512 71fde1619afe54d80500651d980af9f75433e1238460e0a3dc0f731fc59cba9379ed518ec03b5724959032da93599865b56a33b92fee2a3369d4f80bb79134b8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 3efa6ccbb2756158458ddd5a2b7978a3
SHA1 4d6796410e021c9661644b1a8f990f8b754b8717
SHA256 2048b337c47fd4559aa1bdce8c184a6d638f0c7ba6cb5aa0a4eef4ea2508824a
SHA512 fba3bcbf86ddbf8777242f2c73566e504339f3b81a5b5d061eb4fe2628fe4c26f4475d0acc15af8a1c883a067114c69cf1fda2cc27f71c0d8b524a507aeffc9e

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 29a9af6027717b98e5efc05692037b9e
SHA1 8f67eeaf0fd90c949c4fba5941cb77ace49f5a59
SHA256 5b7eb94c993f56642af250e9974ed1f03b7c9acc30931fddb53e98f404368157
SHA512 d1bef5c454228184f5e227da47c5c669f29e8aa4abc10e53798a313fc21819d1813ad7d4743e94a5e7c0848f7400b6b37792988c617010b2770584940c1e9384

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 c6a75a5e35ff0b9a62dac0ef29b33172
SHA1 4ce62e937c31b68cefe4bdd7744701900416e19e
SHA256 dc3e6a113f8ae31a112526ce2fa5dad57bbe6249b70ee344636b88263203c227
SHA512 ae5eda5270d2a21d383d40c5c376f9fb623ec734daeafe227b861b48bfadfd8e265ef95939e7aedd863ebc021bbeda84390d5116a16454adffba2e40eeed67de

C:\Program Files\dotnet\dotnet.exe

MD5 33253c3a208add0c91a5decd1c8f3561
SHA1 0aa4ebd60aed83727611a5609b79738fa73e3ae0
SHA256 6dc3c811dbff6f62e4d9e4fe195b37c2cb08c9b0e6c9ce018f51cef8bfd03a3f
SHA512 dcd6c795c0f0e1e75fe5dac82a9accb60579f6fbae27c34d23bf7bc506d9896d40595c6d192dd06ef40f24bf78bc154eee34f75f354a1341b5eb8648286ad8a6

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 0650343fcb1a94d524ffcaaebfd05e56
SHA1 7cff8dd122b222a5385292abae4b6997be4ac616
SHA256 51182bbb89e79326e2fa27ea09f979653b003c7e33fd2301d06411c3219b39b7
SHA512 191e0c35352e41d2dfbf6fceb2c466e0b40b7aded7f494a1b3e0127dd2679b4df5402ec17c93fb89cfdab803f777a14d158bb345fbff83c97f2698f0d6348288