Malware Analysis Report

2025-03-15 04:21

Sample ID 241026-axf2catrck
Target 986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4
SHA256 986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4

Threat Level: Shows suspicious behavior

The file 986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-26 00:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-26 00:35

Reported

2024-10-26 00:37

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7a0f1711cad6a2b9.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7c134f43e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004abb0af33e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5e3f2f23e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b03101f33e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027cffef23e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fad9cbf33e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010ae7bf23e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071fb4ef43e27db01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe

"C:\Users\Admin\AppData\Local\Temp\986a5e5679e2b0274ed4dc27da8cb838cf883e493ee7dd2640e869cc13849ff4.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 172.234.222.143:80 przvgke.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 172.234.222.143:80 przvgke.biz tcp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 143.222.234.172.in-addr.arpa udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 172.234.222.143:80 przvgke.biz tcp
US 172.234.222.143:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 47.129.31.212:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 47.129.31.212:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 212.31.129.47.in-addr.arpa udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 172.234.222.143:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 172.234.222.138:80 fwiwk.biz tcp
US 172.234.222.143:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 172.234.222.138:80 fwiwk.biz tcp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 deoci.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 18.208.156.248:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 18.208.156.248:80 deoci.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 138.222.234.172.in-addr.arpa udp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 18.208.156.248:80 gnqgo.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 18.208.156.248:80 gnqgo.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 18.208.156.248:80 yauexmxk.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 18.208.156.248:80 yauexmxk.biz tcp
US 8.8.8.8:53 86.104.213.44.in-addr.arpa udp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
SG 47.129.31.212:80 ftxlah.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
SG 47.129.31.212:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
SG 47.129.31.212:80 oflybfv.biz tcp
SG 47.129.31.212:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
SG 47.129.31.212:80 mnjmhp.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
SG 47.129.31.212:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 8.8.8.8:53 eufxebus.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
SG 47.129.31.212:80 rrqafepng.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 8.8.8.8:53 pwlqfu.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
SG 47.129.31.212:80 rrqafepng.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 44.221.84.105:80 reczwga.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 18.208.156.248:80 damcprvgv.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 reczwga.biz udp
US 44.221.84.105:80 reczwga.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 18.208.156.248:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
US 8.8.8.8:53 pectx.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 zyiexezl.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 18.208.156.248:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 44.221.84.105:80 banwyw.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 72.52.178.23:80 wxgzshna.biz tcp
US 72.52.178.23:80 wxgzshna.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 44.213.104.86:80 pectx.biz tcp
US 8.8.8.8:53 zrlssa.biz udp
US 44.221.84.105:80 zrlssa.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 18.208.156.248:80 zyiexezl.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 44.221.84.105:80 banwyw.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 72.52.178.23:80 wxgzshna.biz tcp
US 72.52.178.23:80 wxgzshna.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 18.208.156.248:80 xyrgy.biz tcp
US 8.8.8.8:53 zrlssa.biz udp
US 44.221.84.105:80 zrlssa.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 kvbjaur.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 18.208.156.248:80 xyrgy.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 rffxu.biz udp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 kvbjaur.biz udp
US 8.8.8.8:53 cikivjto.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 44.213.104.86:80 cikivjto.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
SG 47.129.31.212:80 qncdaagct.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 8.8.8.8:53 rffxu.biz udp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 18.208.156.248:80 cjvgcl.biz tcp
US 8.8.8.8:53 cikivjto.biz udp
US 44.213.104.86:80 cikivjto.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 44.221.84.105:80 neazudmrq.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
SG 47.129.31.212:80 qncdaagct.biz tcp
US 18.208.156.248:80 cjvgcl.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
SG 47.129.31.212:80 aatcwo.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 18.208.156.248:80 cjvgcl.biz tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 44.221.84.105:80 neazudmrq.biz tcp
US 8.8.8.8:53 pgfsvwx.biz udp
US 18.208.156.248:80 pgfsvwx.biz tcp
US 8.8.8.8:53 ereplfx.biz udp
US 44.213.104.86:80 ereplfx.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
SG 47.129.31.212:80 aatcwo.biz tcp
US 8.8.8.8:53 ptrim.biz udp
SG 18.141.10.107:80 ptrim.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 znwbniskf.biz udp
SG 47.129.31.212:80 znwbniskf.biz tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
US 8.8.8.8:53 ereplfx.biz udp
US 44.213.104.86:80 ereplfx.biz tcp
US 8.8.8.8:53 cpclnad.biz udp
US 44.221.84.105:80 cpclnad.biz tcp
US 8.8.8.8:53 ptrim.biz udp
SG 18.141.10.107:80 ptrim.biz tcp
US 8.8.8.8:53 mjheo.biz udp
US 44.221.84.105:80 mjheo.biz tcp
US 8.8.8.8:53 wluwplyh.biz udp
SG 18.141.10.107:80 wluwplyh.biz tcp
US 8.8.8.8:53 znwbniskf.biz udp
SG 47.129.31.212:80 znwbniskf.biz tcp
US 8.8.8.8:53 zgapiej.biz udp
US 18.208.156.248:80 zgapiej.biz tcp
US 8.8.8.8:53 jifai.biz udp
US 44.221.84.105:80 jifai.biz tcp
US 8.8.8.8:53 cpclnad.biz udp
US 44.221.84.105:80 cpclnad.biz tcp
US 8.8.8.8:53 xnxvnn.biz udp
SG 13.251.16.150:80 xnxvnn.biz tcp
US 8.8.8.8:53 mjheo.biz udp
US 44.221.84.105:80 mjheo.biz tcp

Files

memory/3444-0-0x0000000140000000-0x0000000140155000-memory.dmp

memory/3444-1-0x0000000001E70000-0x0000000001ED0000-memory.dmp

memory/3444-9-0x0000000001E70000-0x0000000001ED0000-memory.dmp

C:\Windows\System32\alg.exe

MD5 7e9173c8e9d486ac9d16a54b0e05d13b
SHA1 4fa60b26a21a5da2b28e042aad765ccb202898f1
SHA256 d335e0488efbb58be6c291306422e82396f014188b6ca635e7428b54b4ddf214
SHA512 61de758d14e1dc923d1c3a69c38316c4ebfc4a93e765ec7ead94c5822d5dcfea9d0f2c2d616b8c6101984c51e192ea4b23cf9c75605e63c94f121310d3a4cd05

memory/704-13-0x0000000000730000-0x0000000000790000-memory.dmp

memory/704-22-0x0000000000730000-0x0000000000790000-memory.dmp

memory/704-21-0x0000000140000000-0x0000000140130000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 903af53814c486c79469b725bf6a5b30
SHA1 1716798991ea59560c557953d5589f21e1401a93
SHA256 c3349be1b53f5dd3d5a9a59808f0ea19f7806b75ef818856062dcfa50eb35d60
SHA512 34ea93666d3957b4882f4e709114953a4ff082b0ad6a86639b770d8b819e2a93958e3dcb1cd9f97fc333e177b58fac72eec7f95bb83be044e522274f3dfcf00f

memory/4124-37-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/4124-36-0x0000000140000000-0x000000014012F000-memory.dmp

memory/1236-46-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/1236-40-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/1236-39-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 bf7f41e444807ef952b474ec68af5da8
SHA1 afe60fbc9dee3f150d2be95f4d0f751ba8a1d82b
SHA256 db5cab0786eacaa5fb9860237b70c84fb9fc70932110fc69f8e001c46b45adad
SHA512 0eca73cf299f558e7b8da4444122138fb55604c2284a99e57e67a699a7c7c487c7adf7d2cf590294c5a100da47f005ca3671f1c14da6ebeca41209fcb5e08ab4

memory/4124-27-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/4424-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

memory/4424-50-0x0000000000C70000-0x0000000000CD0000-memory.dmp

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

MD5 4cf4dcceed924f902ec98aadc629ba1a
SHA1 1852ed8d1914ee99a9bcae90950addd7f26abff1
SHA256 9b57f48569be12f4e97bcc1f08d43776c7d44d377e513e63132e41fe8274d1b6
SHA512 2f157fd70d4ccbaeaed0df9eb534f6a2089cff56fc5ea3d2843695183848552af497f094e140869b7b1bdc8590697f9529ecf37204957aaf1faa5a900cac4b04

memory/4424-58-0x0000000140000000-0x0000000140234000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 b62ca70d13cf60dce85acd979452a169
SHA1 bdfea94528ff032ebfef35d25311c8dd77d2b489
SHA256 219c664ac28d6c908be8301b7a6df71540bbe1d66eceed992d6f23ecd09c36d1
SHA512 aaca07a3f1e41ea7b40b54ed33dd4cca2aea40c244b691131ec899d56d0cf4c7144d3172073cfc37b1279c8668659e1ddb8e73c6159c5a26d7a8165f1516005f

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 976bd30f80b7a590126361a5462593f3
SHA1 7d82a46d87f401c27e2f58455a5bb4bec7b520ab
SHA256 7a9b4d6339040e926c1fd719d069c93f84140d700a4d8b7df3d5aa9c6eb727d3
SHA512 1c9b16ddb67fc42b25d7f6b022dbe5433b40fcf767ae2ae7d12e902f640ef9122081725aabd77dd0a879d9d2ddd4cc7dc04d9fa614c0cb871752bd339e11526a

C:\Windows\System32\msdtc.exe

MD5 a6223bc2698b55b6c04ee340d39a0517
SHA1 8c27969bb473a339da2f265d6b2990689983f848
SHA256 2ed18c27b5d72e255183dd7f839f2ca7251406778dc0d3ef8e40ddf109de0671
SHA512 09f6832efada7b14e61f0094076bf4c20f53787068d9547d60bbd7ad77e22b65cd2c3d3bd0c70a752b71eb4f570f8f3e9387d73fb166cd68ff708898c9e03454

memory/2788-89-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 f24b457d1db23b5b59d762fe70a496b4
SHA1 ea6725598d347dbe6d2037afedac007dcc1b76f1
SHA256 2b1d6571f871d66da57f09db3e807c4a7d838d27aa0850198616b4055d1fa1d0
SHA512 47bc39208cca45650f387b8a7af08997fd51a38f8ee6482c3d8dfb585c6bbeab16782b4bfe6aa6dca30450d0a92e722f5ba8055347153d82cac593cbfac9aec7

C:\Windows\SysWOW64\perfhost.exe

MD5 0a87eba30c4b1ced70831c0287b741a3
SHA1 d99b6e471eb018d50a5e0afbf4e4ad47de0f37b2
SHA256 66c87e42e1ce47d23b48ef6fff6c9c45895105f07ecf0d63e511a72df5d4e39a
SHA512 c065d37181e0d76fc9be4236b05dbfefd81e49cface08c8c3eb83776afe7bb302d5a794b7817ffe02bc92b9b68efa7acdb5399173c4df9891b67f05d7c3f349b

C:\Windows\System32\SensorDataService.exe

MD5 0655371c1d2cf487d5f7c5f1505a119d
SHA1 fd64a7ebc2fadb725e4ef30dddc77a41585a9585
SHA256 94600c8e6b07241fdc169c0d5205f75adf57ee48f1a329f62f8cc7a2ee67a947
SHA512 879fd130f8e0c150e541574663b7e4cb71e8278a710af62fbf4eb48a037c035c49b42416bb78cdedf742e6fe2d8660ea4e065f1b13887a345578fec0334bd922

C:\Windows\System32\snmptrap.exe

MD5 4cd2c1ec7d3aeb5f2f509523298a2309
SHA1 00b9c81e46392bf32c04e5dac708fb45ad73e062
SHA256 5ed7f0b9e9466382a2bbdbd0cea2555fadeec1774b51a5f473652b72afe990d2
SHA512 e4394171677c87df9aed4a10b03d9f538f530b38b71f2ba05600e275559efb60463d6abec26025d16d09edfa5e709df12cbe48d5d136f9559dde6ca1c5045e2f

C:\Windows\System32\Spectrum.exe

MD5 bd573fae254c243257c80ca7541829e5
SHA1 c64857478785c14fdc4115ac04d9727c600108f7
SHA256 4fd5d98106677caea5c51e33273e04e063e5b4b7234afb8f4b2511f9ddf1a598
SHA512 efe28e2c31e6332c87f0c2ffa54b0cdab45bd4546f3d3c7bcbe4936f67d44d1c5f9345f035ac33b596ffdf8793a4b7a32e747f21e7e48ccc9f5626b8189839aa

C:\Windows\System32\Locator.exe

MD5 6d95709ad5cbc2d222b581ceddb6f1eb
SHA1 725942ea9f811d08889edd2c1285a3a713738ba5
SHA256 5cde8817da345d953f7dfdeff4b6eb6b469a26bc4543bcffe450a7de4083c86f
SHA512 c9eacca1cd51f2a6e52dea4af5057d247c498840498a9d87c44d595d43a4bf95578f789914423ea026d1124e930a7fdeaf9b6f1360468d012c73328f7cd8af12

C:\Windows\System32\TieringEngineService.exe

MD5 92b63eed9cabf47b183bbcfe7556cf16
SHA1 81730027a8938f786f8eda5afc77c869b2a1885f
SHA256 da886ab6b56adbedd7598a76e7036cf55b0fa7b478abfced756fe319eac5c565
SHA512 da6bf7d3a3653a40213962bd1080a9183b750dd03ab9c7ff2cb510ad0f3607c87cd6fcbb15a103938ea1a2113140733dc4ce1614cca2292a99c08772f5933250

memory/368-198-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 6aff61b0fe757f644d3a2de4d93bd06f
SHA1 d4ef9fa093730f2448bf1703862316ea345225ba
SHA256 6141d1bc61ab7b986f27380be2fa3006e639a0491582caac0b171256b7f7d2b4
SHA512 9d13287254b775ffab410bbca8e984f6a042cd8b0857cf2596e65dc4f9f0fc977957a7fe9f46fa2e4dc27614a90aced9219f416af5609621703d8fde9f911414

C:\Windows\System32\VSSVC.exe

MD5 91f7cef1d9dde6265c60a8822ba7e991
SHA1 d10d9f6391df2ecbeed17cd87bff0ed2619b2a5b
SHA256 d77b48045148bd2d0e918ab3425392479665f51b4a0af46870b03ebd51c4636f
SHA512 0de52440ce5ae37a5cdd6f23b723771dd85904dfa89bb66ecd4ea4f373e7c2efa5cda82f1c0c110cf12580a6fdb2fa5359bb984c4b8c2cc35edb63f2d3a36796

C:\Windows\System32\wbengine.exe

MD5 4ce859e6c42fe7b27d84c356677c167e
SHA1 1e0a8d55b1c335d4c9a23973691dddd13bc8a34d
SHA256 f5055834555c45da0d112f85885465c5ed225ff985341d446746b558ae072dc6
SHA512 7133c0f8a784f8b0567ca01ac097e85224bd14b594b8234255a77c4dd55ff7aa308c1f85c82ac8a81ae6fca51ef555d946389ef02faee1043666d9b2fdcf26c5

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7fbf3cd5daca16ce9cbfb02052c6f13c
SHA1 c8ffe7355e96668102f6310f3e46c9278b42945d
SHA256 acc9265e84b248269061bfd97bb19866f702879712ef83ed6965ed71a677d1a4
SHA512 2536ad79effd0d1c87210cf6fc10b40c526f790470a281cb388fedf12d33a8d85f40b0effce8fd4b90c1b524f128add2e6745488169cc5af6fc0dac9b6a43842

C:\Windows\System32\SearchIndexer.exe

MD5 935299d89a319f99c1642f1913b9a0fa
SHA1 f19653f90249b9c6d648f443df3ff7554572e6aa
SHA256 1c630c46adef49a70657143f67df6936bfc0ba3d6a91e3cecbc2172a221153e0
SHA512 5b6d6bbd43a301f572229a96b825dc6512b525c34501519994cba1eaf500f3c08a536d74c63db2ba071ea49714615dad0a181c69da35dccc3bab2f39d9d80feb

C:\Windows\System32\AgentService.exe

MD5 fb6dcfda4360a67feca0a5ebfacfde09
SHA1 505be3de8725795a1cb66b22d333bd877f69865c
SHA256 165ab4edd8a04d7bffb192ca5d139289ef7894b6643b91d233cc6f5186287ef8
SHA512 0039fa401ca326d10211500e70e1dda84ce2e97587b27a70d6b35a66a733f0d20b608734fa6bbf9b2c42d9f2400e89e0aef7ae976b7668587650dc2dedf42d3c

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 25477dea054436d9882f1c9561bf1e26
SHA1 ba7630be93150217d4f2767183f84477081fddcc
SHA256 8b97040bea9905012f14882d2f3de63d3466e6fdd9fecbb0e3adf321fd6f5b41
SHA512 0f9823842ec48c58ec58c0a0c6088514547da48af6b8875057e3625839bfbb10f81f2941e69714d99c57b1e0031e7a58ac3378bc879f25d8dee8ca359b2b1844

memory/2044-258-0x0000000140000000-0x0000000140155000-memory.dmp

memory/5024-257-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1964-260-0x0000000000400000-0x000000000051D000-memory.dmp

memory/3660-264-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4960-263-0x0000000140000000-0x000000014011C000-memory.dmp

memory/4436-262-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1732-261-0x0000000140000000-0x000000014011B000-memory.dmp

memory/1356-259-0x0000000140000000-0x0000000140131000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 db97e1e899475cc087958b01b3d06753
SHA1 a42d554848d4290e25c2567f3c39a221774b2a75
SHA256 31d1dcc7a441fa8c3ec3e9f6ffd672823c6d5ff7d28d43861cebf9843907666b
SHA512 54524011e64a737a39ce21a7db8a86c407bf44b6c336b2a935e566a5dfd27fa14d736668a9dd723fbc095892ef7be6afb27d92b0f5a1f4518a9c72d4efcd5bcb

memory/860-87-0x0000000140000000-0x0000000140155000-memory.dmp

memory/860-85-0x0000000000D20000-0x0000000000D80000-memory.dmp

memory/860-81-0x0000000000D20000-0x0000000000D80000-memory.dmp

memory/860-75-0x0000000000D20000-0x0000000000D80000-memory.dmp

memory/5024-71-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/5024-65-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1236-63-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/1236-62-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2852-266-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1632-270-0x0000000140000000-0x000000014014C000-memory.dmp

memory/4024-269-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2788-275-0x0000000140000000-0x000000014013F000-memory.dmp

memory/3444-274-0x0000000140000000-0x0000000140155000-memory.dmp

memory/3092-272-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2880-268-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4340-267-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1240-265-0x0000000140000000-0x0000000140188000-memory.dmp

memory/704-435-0x0000000140000000-0x0000000140130000-memory.dmp

memory/5024-525-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4424-524-0x0000000140000000-0x0000000140234000-memory.dmp

memory/4436-528-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1632-531-0x0000000140000000-0x000000014014C000-memory.dmp

memory/3092-532-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 ac43be095b97d8ce911e13789fb0f908
SHA1 d25cfce13c8e9addfdc4bf39493b42d22b506778
SHA256 3dcf3524eb69eb9865e64325b88fe6d844b832fa2c9dbc3cab5b4eef45404870
SHA512 240ae78418b7de680a5234f685158178d80d8ada1efed61ddfbe90ebd024f872f8b783a87f8a1077af00f12db00fe7e6142f17440d3d0cf1650fa715b6ce9f29

C:\Windows\system32\msiexec.exe

MD5 b82b790594008e5ef75b5ae7dbf0ff57
SHA1 68d1cfb2d20145e087f0bec3c6ba827323d97a1c
SHA256 2100cd7c85815c189321d09a8b034df6faf83b209a7165c0582b2924523e7b8c
SHA512 35b8ddf1f5a8166cbf0754a15183161fda1f9c3c0c7e3546e434b6a8d19356c38892ba1ecb801c0c18f64fa361c9f2944b9e9d0ddd7a567a73aa3ac67ef8ad3a

C:\Windows\system32\SgrmBroker.exe

MD5 e4d78f2bafb37be4db970306fd7e8440
SHA1 932cbcbc6fde8e0271a5b07845ccfe8f0e441900
SHA256 48b03b0aac110099a7a392c18b761de08a94808d3eeb64f8de65eff5a8bf61e2
SHA512 1dcecd4975f2010f8d1397a52662e5b4df00b4692feaac7101eab32acf9b3eccb9252af8def4cd9793bca443b419b1259ba4f88d5b95dbe04e427ce65a12b271

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 320daeb726e567e154066a4c1851a1f0
SHA1 5452085e8e9cfe75e1108e07b7b39ee33789bc8b
SHA256 6022fe9e5c33342190a71c9d7b247be1fd5de1e97d1f16e20a360844431e3574
SHA512 adab4d398d43ccfdca51e85f53e4a8096455cc4231c2ec74d871f9ba72de93c38b4285c1da1d5d81155b21f9975fb259be0c2a18cb557bcd8a372be86d2a8b9b

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 2da8006b037eff934e7c97a2f80c983e
SHA1 804aa3aa1c0807764f31085636b48a5f052e0872
SHA256 6110e4e5424364802337187bb9d5228e324fce3c363bf33f690e636cb85d0925
SHA512 ed835520480cc316990af0dddb48928df4901169d15cbca349e8ce169cce5f9fd8b3281b67ddc3b50dcca186fa431e3761ec4462fb5cd07da94690a2c16dd94f

C:\Program Files\7-Zip\Uninstall.exe

MD5 e230a5a52e861430162a6dac6a2d5dd9
SHA1 059d6dd9cc8accfe20399d8a4fa8494421769fe3
SHA256 489fa4efe3285973b60b824410d93578a12f2fbd1bb260e81948b8e2c3df96d4
SHA512 89b9f8c6d366df8f3ca1450d5c49b9d5964ffc7af2ff673ca8169c9c64bf30cf4bc95818fad14e8427e272b62aff492f3c7f50f73b79e9bd73fea120bbc7e357

C:\Program Files\7-Zip\7zG.exe

MD5 f6bd91bf5fc2303037498eb6cdc5da9b
SHA1 4994a1bd9ad18d02053b777b5cd4cfc3a145a514
SHA256 c4ad307e19a7507bae02c5418e671f2a932020d7a9eded7743407b463d22cf9e
SHA512 8ce046d0f1475bf62cfd5f9647de162ca6653602af24545a9830b2cb0ff2faff716593ebd3abee731d15973d88473882ebdb40d87ab610de6de933fc4c1f1022

C:\Program Files\7-Zip\7zFM.exe

MD5 99ef3ac72b9a8c4847f1c09bfba12198
SHA1 8556cef242af810b48b655e4c465e473a2f9ec61
SHA256 f4164061d6ba1d1c1bbd8bb37f63d8452e2b6739a12fb17dd50e7b6e980d0639
SHA512 f6fbbac0ac0fe0bab04d6b58a37ffd272bd32f1c0c1932e0da7eaaf2a06d851b89054c1605bf917ec68dca3abb07e70bce77265a7a9c197ceb823369db6751e6

C:\Program Files\7-Zip\7z.exe

MD5 43c31fa3a7674acbeecfc875a9c383ec
SHA1 fa6f9dcfafc16fc649302c0d5a09bc1dfd421406
SHA256 743f6489524157f4daacf0f8939fcfeb21d8b5cfa8ecec918b02d6df4702f7ee
SHA512 840610737ef4945c5de0aac917688d47cf89fa3e6deeb6ebf318d03564b02452e2be658d9d6d7459cbbb947c6ec4a377119581207e929e2fb040dd4e29d6faae

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 489b65177e42bf9b9ee38ce25d955229
SHA1 da32c2c32c9f9662596243a9107a27930a4c2a68
SHA256 0c4ffb6c9273ca86cc93851a65be10d5c49b111fa24a6abe81f3dcbc81f549e1
SHA512 5162e194f3897032a32a30fdfc48874763b39df28cfec8a1c207c5d5e2f9dcb533a1d0d5ccb5ff07ffeff38ef3ef7d9628340242cf12531da4fb42f104cbb692

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 d7a2899074a51b5f5c619e2c4870548d
SHA1 5b169c8e70a9ab23d8d8edb65d1e0e0ece2a2704
SHA256 69dba776922a6e292a0d2ea94facf860bf4b12e18ce33d4ebdcf4a1f2f8df49f
SHA512 fd42884ede0047f32e1aec34d5a5960fea3d6295c849ee3b30ed4a82eef4319b3737af6f904df47e41b6a69e3b896a749a1a82264da4b6fd80fb68fb03f3b788

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 bee2c43b9987732ae92424d3dbe15d20
SHA1 0845b2074254a06ebebae93b306fa7d4c398c7a1
SHA256 36eacd419da572c66d0c20874e02e55323f3276ac6a9463468cea8971c5b270c
SHA512 6db515b20220424b0db9dc04aa81e57c28f81286486569794d4d74595fab30a5bb47911b78ba31e0bcfb1fb027b32634947e1de1d362de985043532f343ba8ae

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 b3b7dcb6e76d6ee8c668f31cf4a5ad76
SHA1 bbd50a0babe8980776f27d49159f269376fce180
SHA256 849ee4b7ddd8f31f1d79cc753ebc20f1984926108b756499b0a2201afd5058b5
SHA512 a2b5ae0befcd3c020e3427204b23bdba947a70a16a309ef8384d964962b6940f0be2d49d79f7bc980b5c850abbc23dea811c588fd0e9af3e5953191ff3f7e47b

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 57e5d5b332e10a5bf836aa0c669185f5
SHA1 d7b61286f469e75b9a58296ff6fd8d1e8350b2ca
SHA256 a3be3ac06b7d3b974ad3275b6d4098aac1b9f71a9e1bb3f6e772d68b68568478
SHA512 f36a9efaaca921a6ed8730d3e0bad0f0bf8a0327748f26b7ad9509124a8a31e3cff3be5526d52a49f3a6cedafa1a0827a8f47814eae5248c1f45905c777dcd6c

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 00e6004690e81e2325c2be79dc831901
SHA1 a86e3dee6681dd8e4e2c140ab34912fd17649bbb
SHA256 9778ea5d833514c78134cf5291a5b39af65eec17ddf6cc4e2cbb3df06f034e7e
SHA512 78d0f1068d7ea5f6fcb69bb12786f1cfceda2021888a2dfaa270d448ebc50671742a24cd7009d54b2c1cae35e63e858adf5b41dedf2804057dedf1ca88d268e2

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 f7943be3b36f5e2b17e5989854e5d6f2
SHA1 7c6bd3a49ac5d6a90723272a15eb3b6e8146b626
SHA256 7a35013930e43fb6dab51e26a6d708dcafe3978949e6ee2a88345b1e243595f2
SHA512 0685e3c1b61da882fb6f49259b6ea1f64f9638253fd8ca4abe8ee9f71d6c229dbead596d0d1532f661e79eaef70b1f088719bb2948b630ee7aa07cc0995c373d

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 817ed802ced37047714d31433d9310e8
SHA1 99ac8c8ee989df168a45ae93d06fe75ade95c8c4
SHA256 e5e2fa36446dc4cf0692c503219cccf4b31832ecae6987c42f37865d44eecf46
SHA512 d7fd62253c16cc8f57102fb976effaee87801e4b88780661ae59ca12195f0ff9b61d315401f85f85b6e1700afd4a46ec93327d6814f9704e31dffee755527f4d

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 c952b30d525049c16fc5bf867dda9e2b
SHA1 ace6d77add4ba49c4f1226526dc43bfc28a28c6d
SHA256 0e207c01b919c79d46c2d754957a2bf6b309a8e5871bd71b159d28ba0c34b031
SHA512 e337434693c3d53c61876fd825d167afb2d76b6604fe76a1935bd7436be3265562474279ced6d929fd1a00cf34d20c15f8a7fedc534166b968525edcd04e6ce9

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 40012cc32aee1887ab42617e65a2a2e3
SHA1 0568ae6f4e8cf0439a5b2dc2179bcc044a8bf7f2
SHA256 35c839c0374e8d380dba8a40b08e4bbcdf826a027198980f8569f8d9e95c3ca9
SHA512 d708e6a978a05771acd0c23fa608fe503e3af64c28420b8a850d71dcc452006eec39eb6c1b35cc8e8d6a294da04af728307456e0d9dbbd460b2a95dc90c9a4b0

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 f821ffe560f097c5df48234f2df66aa8
SHA1 2b5558e4c91d47b75c194ac4ec7f56112e16a93b
SHA256 51bb9eafe831bcb524ead03d3652bf2d2dbbe0ea057efefad59412a8c2755985
SHA512 88d0a1f7bcbc8b284d352612732dd7c1184dc92f4f465199b2e209d813d6b3db759a08fb8ace42c7dd23a0a7fd63b7ff15a889b8c6f58a0841f78129cecfff5c

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 1800100f3304df7ba9ab71a3e0ea7390
SHA1 a5b5a439b0a735c789a26688c5c6d3854373ba2d
SHA256 591b9d6ae51efd7987ef7f0c9d491f85193a221ec843a4502733383b7f823adc
SHA512 ca113268e662a1f0aa397ea897ac0d8dd75c4b02a8c0a1beb6567614926ff528ac1ddfb40478ddd75bd9706a060873f3228c75deb712300ea2a6d2c42efb7da4

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 1305acbc6d41ececd421167bedd6ec86
SHA1 7a403563b11c338c1adb6dcd52c1ff3d4fb12798
SHA256 275a72f5a8e1752c7059d00dff36fa9c88331970322b8fd026d872dffcbcd160
SHA512 c5aa8bb171e8bd3d90d6a4ce391c303da683ad240d467a32541ed57a3982150be814969b9ff82d85b6b703984d184c0b973acf140bebf3728e5f5eff9ac69ec7

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 55469599a66c29f44f6d1aa0824aa598
SHA1 0142236d4e87b7486deccc29daf14f261ec7c81a
SHA256 f07b286b4c1e072212f58caa7f5871f714d3d13569d892322677e5c2c22cfa17
SHA512 510bbd19e9b37b8d35f52f6238c1b822bdb997d45e77476118de555c0ef61afe17bbd5a4a8b1cecb3452bf1b1b3b00e5448cd4c539947909aef84a5d0c366495

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 b2891fa907c8fd1f7de2d586da995929
SHA1 a407349f16d399c67354e00c28decefac3255223
SHA256 3ececb040e359122e0b297c93d6f44a07793aadaf5144475c5bda23e704de947
SHA512 d108954af60d0f27023e0f9096fa8caaaa02372fafb487426d31443e81866b7d004cedda2d89b443e57d54a476ef28b9dafd1af7a5980be78039663a4a0b9801

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 bca1e6094e9ea500e7385d55e535f010
SHA1 16b55ad2d2ea4de098376936fd5cfb0418053e0c
SHA256 30ab80edc1e892e6de15c70c064f9eb65146bb1ba54fe32686f9630cf9f87780
SHA512 8ae3234df0f0fddc168275748d4bef5ddeeb5cc75fec2a208914f92b86d88bb7d31fede6a53e5b6bdf8c5de026887cccf62fa8847486c8be56d38c5f05d9b823

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 d9dae9569ec79732c86bcfab4f046f42
SHA1 dad72952d90967d61175ac44254463d4be7f80d9
SHA256 c147135375dc4b155b91e68f9e63aa6ca0655685446c457836839a7823af8b92
SHA512 3df15ef4a21e42cd6a633b93dfe4f8e8c41055106c8d569e460e8799e95b58168e91e9b005103d574490ef3f171a6df3d4da5ec054d95c2ab56fb2fc008e5488

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 59cb8175b97f4060933f9ca7ba57f9f1
SHA1 6268cc359da2f3eb2c4545b98156ff140cfd340b
SHA256 611d8ed95ef253a8e87a5cc41a96825b89d46f8c4be9b5de352f3ce12be919a6
SHA512 0b99eb0c8a493ebeed20d23203c38956d249b11887a9b2f37fd9473d5e90a7134cfe7c362eb4db7c78c2645c13071f299f7c050c551d7ee11bb8e0eda8fdd611

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 681e634b2e1af9b6a1dae4de21a3786a
SHA1 a251fdc696e539ff8ba994198825c793f65c29cd
SHA256 510a8bae095a76c5c8334a90c5276e70ab1b63969f211c279306b220d00512d1
SHA512 2736edb0ea621cd8694614c59ca0a542aa36d7213b40918336c1b830940f2d0c220f1976a2b1f215fccb578e4ad95bdcf0d5276458664d283c2505537edd23d5

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 b919148a1733471e809687adc50c6a19
SHA1 4f5056b6ac68797ecd1a91cfe9eb903eee6e034b
SHA256 8edd3dea5f90d4d9eee26ead64d3259f98610b10bfc6417d379aa972deece321
SHA512 9676eb0223b1036af9c2eb8f2acfcc69324b47ab2eb8068e5403f614793f130e1abb6e2d25ec03f5e200bf035862c54df536938bf211adc1fa54240aa6c8309d

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 b3737bf07c40fb40e45aac3afdfec2be
SHA1 22fae65006fc98da0dd5d4654f9274a7acc3634b
SHA256 97ef61c03794fc61b854b287a1c2f931ff5c139727eccb191f22a0d9893073cc
SHA512 e50feeaba6af75f1ebdd6ef5583bf078808f925f8034da369813fe15c5e629aeec5e626220631804ac3f1a7975818c9f727867bfe16228ebde7121832565d6b8

C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

MD5 2f750d24b5d63ad4d6a7510180fb53d1
SHA1 a002142b672ae351cd079920b99dc66b995e0db6
SHA256 099a4fa890f716e91ce8a8ef543bae4cc9cee8c60bf936b3852ebbf163bbe3da
SHA512 55e06cdb5ee0b5f295963d0b7903c398b6e449c7bb5be6d874862492a043b4432b5f263305ec87e81e48b8c94262b918b4ab8308f3ad70246e402aad6647c65d

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

MD5 50dcd44bd14255acd3c76a57aedb62dc
SHA1 142ac3736c9e23d426481be65635b7d48b4cb46f
SHA256 a1e37ce75e32c5121abf0f0d386862b51364cdc29a626b2970da68cde73554d1
SHA512 fa7922330e1bb57ba6801b270173130cfc84b3b0c15b52b1ee4de56317c96ad4bca1f22303e65806c1ea164a7e57d0e8f32add9db8b8111f412698cae012f86f

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

MD5 9c03b2b245f780abd956a77b39ecac5c
SHA1 07a9c411733a6152bcc06553fa58df476016914e
SHA256 463ae22d15623eafd00323786242b100a1197ac60ab26502ff460fcff974fff0
SHA512 0b15f8b281fd2dedb67c42d0bb4184f9ce4392ceeb0ba97ad2b9ab237da8e7c62126660df3deea53c7249c0fa47ff2ca4035f29194f5d537688c8a05fbc340ae

C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

MD5 9f08e29188673c8c861cadb2f602c0c8
SHA1 bce16e5afceabdbd2e1672dfbed7273fa1ae3a90
SHA256 4ff304c6b5aa5f5ee34d9233b52903eb1ecf73556d557df2e44dd26ed3e6403a
SHA512 0319ea58cf177f55d3756fbac9c2dccd1bcf580134f709c5110f5b2bbafa0288e72ee84517bc0f81b9517f8220b4d48de1e659b6edca944aca96342aa703966c

C:\Program Files\dotnet\dotnet.exe

MD5 1fc01a5c6b3d6ad96962f6d0d910f90e
SHA1 3e0b83e9fb29dede905b3560bd6332ff102b804d
SHA256 a18664706f26758dedb54873c015e4bb0cab022d7a25b755fb7cebb9742bda73
SHA512 e01f946d849e134a639c8ed9946f3dcbc0cbdd3242c60db9bb21fa8e419b35b69355381319dce48b59f87a2eed2fca877bd47956d243e416a0ed3540420fe3d7

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 8d1ff72d0fbc720bf941bd20d20dd3a9
SHA1 7598fc4a244d1464b5f2e9d6f202cc38725c0e34
SHA256 af2ca81ccd1d3accb4ae92655a9e6a196cf8eb468bf9639bae47f71a57bf0c71
SHA512 498553964c248925d3067cb68cde4dfe9d2f7cc7100d93461aa0ae7d0276d500c6886c32898ff67f8787f29b8693fcbfb29a0986e59897723d996f794dee8789

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 d2f82e3932e252b94342ed8eec0eb29f
SHA1 53e304fac8717af8627a4704fb9e96aecf24f0d6
SHA256 ecdee6fd70e2ec9691df6f5c0b1c77e1a2318b3d4e10c772b56cceff1999ecfe
SHA512 c5defe692cc83edc1819354d35b758c03134d696661b311ec90ef2247e4a55514cabb154ac885a0e1e2c3fa653ec32d9474dc2cfd8c4b5fe5c0e678bea5e28ec