Malware Analysis Report

2025-08-11 04:38

Sample ID 250119-pqw7baxrgr
Target 1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7
SHA256 1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7
Tags
discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7

Threat Level: Shows suspicious behavior

The file 1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Checks SCSI registry key(s)

Suspicious use of SetWindowsHookEx

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-19 12:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-19 12:32

Reported

2025-01-19 12:35

Platform

win7-20240903-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe

"C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe"

Network

N/A

Files

memory/2552-0-0x0000000140000000-0x00000001401C3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-19 12:32

Reported

2025-01-19 12:35

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\818898bf983eaefb.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{1D4B5551-822C-42C0-B673-53AB80587853}\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWow64\perfhost.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec55c6426e6adb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3ebb8416e6adb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db6d5d426e6adb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc3605426e6adb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019fc09426e6adb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d65f93436e6adb01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe

"C:\Users\Admin\AppData\Local\Temp\1e5db657d02c4e540214371e6d855018d74d4c3cd394741d934baf57de84a7c7.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 7.98.22.2.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 ww12.przvgke.biz udp
US 76.223.26.96:80 ww12.przvgke.biz tcp
US 76.223.26.96:80 ww12.przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 zlenh.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 96.26.223.76.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 60.153.16.2.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 47.129.31.212:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 47.129.31.212:80 xlfhhhm.biz tcp
US 8.8.8.8:53 212.31.129.47.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 72.52.178.23:80 fwiwk.biz tcp
US 8.8.8.8:53 ww12.fwiwk.biz udp
US 76.223.26.96:80 ww12.fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.227.7.138:80 deoci.biz tcp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 72.52.178.23:80 fwiwk.biz tcp
US 8.8.8.8:53 ww7.fwiwk.biz udp
US 199.59.243.228:80 ww7.fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 228.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 138.7.227.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 deoci.biz udp
US 208.117.43.225:80 gytujflc.biz tcp
US 34.227.7.138:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 225.43.117.208.in-addr.arpa udp
US 208.117.43.225:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 18.246.231.120:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 120.231.246.18.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 34.227.7.138:80 gnqgo.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 18.246.231.120:80 jpskm.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 18.246.231.120:80 vyome.biz tcp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.227.7.138:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.227.7.138:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp

Files

memory/1372-0-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1372-9-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1372-8-0x0000000140000000-0x00000001401C3000-memory.dmp

C:\Windows\System32\alg.exe

MD5 af72547190b6b1b6cffafec137733e2d
SHA1 d060a735cd24b8fc0a71c0cfd62254cd525eddbd
SHA256 59b8c6b809555a6dfe88123d18d5f72555e6e0ce9b599b8c9de9a68c1c93e904
SHA512 c262454b10b6aed2636edc97a51214c3548501dcfac5895a95f84bebe185fa0cdfd05dfee5e7700862b2762f9b2acd8837a59f69989222b95e266a09e0d337ba

memory/1256-16-0x0000000140000000-0x000000014015A000-memory.dmp

memory/4452-20-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/4452-29-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/4452-28-0x0000000140000000-0x0000000140159000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 9d226985760c9325265585724ed94fb4
SHA1 148c6b71ab20d43eb0742d96f10c4a123c708ac8
SHA256 ce8f6323c49f23be32aed69b734955da33a2188aa15097d9f5d0888d5f018ef5
SHA512 a8df658dd411322157631da9e47b536854117330a47821d1ea715ec8dfdcf182f42e1e1d3d8694d71e482261a1aa4b7869904d69e2f60361c3d01b58efb78563

C:\Windows\System32\FXSSVC.exe

MD5 a0e04221c8623761f40aeb300fcac9e6
SHA1 74444e66ed6430079ecb067b87a1a7ce06d72c6a
SHA256 896560f20a93b9761f2611901e75376012512d2ba63a2c9613d53589dad505c4
SHA512 e3fcb44376ca5a887ce8626788111d7b1cb612f5a826648e87b40ebc1b59a3afff853cbf12aaf6f9c33e5c0b47395084e077f472b486a18a4bffd8c76891380e

memory/3704-33-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1468-43-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d6b549e8d7c546dd795fe72e1fd2c50b
SHA1 994e73034df512527c57360e90c88fed5e72c6dc
SHA256 ecf61c42a4727e6653b77051ed5533ed5babd6dcc5826602997dd46136c19600
SHA512 5d9af5cf4fa63fae1a0929ca72d72644051fee1b63433ee097aa82117826dbfd7bd095ecf6a477e2a54e413cee20e6c5648837c388f643358d9678deb7d20906

memory/740-66-0x0000000002290000-0x00000000022F0000-memory.dmp

memory/228-75-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1372-74-0x0000000140000000-0x00000001401C3000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 b923e7df5336031e9d6ff3846da344d4
SHA1 835c1d7938e023ff99677cd050e81b12b2afae91
SHA256 9286fc10f4de01c78ff3534c3dec0f37f6242c6784f56737fe5f18f9754de610
SHA512 cdd5450920e580b6213bbc3c222966ae03702a69cc805dd281b95cc3ea44554c1bfb8ce9fb37d5328c5e3c42ca7168e91c2ef02d4f193dc692f77a295a5356fb

memory/2980-86-0x0000000000510000-0x0000000000570000-memory.dmp

memory/2980-85-0x0000000140000000-0x0000000140180000-memory.dmp

memory/2980-79-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 8adf7fec953d6c1379d866ca30ac86dc
SHA1 1cf3c8a115def8cd7132f8e2e30ece3de55545e7
SHA256 bdb9b360a04f992edf4f139678c9844ace625acea69fa22ba179d8e4909702f6
SHA512 edc58d78aab533dce2c07a26b70e36ba54c43a923045beb071e0b56cb3b4c34ffe71708d57ab5c41921f53517cb439b535fd283212338f62c7f9679e597ee2eb

memory/740-72-0x0000000140000000-0x000000014017F000-memory.dmp

memory/740-71-0x0000000002290000-0x00000000022F0000-memory.dmp

memory/740-60-0x0000000002290000-0x00000000022F0000-memory.dmp

memory/740-59-0x0000000140000000-0x000000014017F000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 021ff695892f0317402f5609fde8a103
SHA1 b6fdbaccf803e9c0292f3a694f6893d208d47ff3
SHA256 d2e15d293fe5ba3043d80bae7af085ea1da4cd035fcba2ceeda640f39d157fe1
SHA512 6a1fdce8ba995100b5c4b6987d6e79cfdee2388579963b7d9d7cf78bbb393104570be39d93f0b18d931344448ce54b9d5c4e722019ebb3ae861f063ccc9b45a8

memory/2440-55-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2440-49-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2440-48-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3704-45-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1468-42-0x0000000140000000-0x0000000140234000-memory.dmp

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

MD5 10a77c20b3f12c4b09b3b65afc6ad847
SHA1 36a81f1dd48303be5c1f6041879407ddb2be4c61
SHA256 78d9acb506b4ca8bcc38c30002c63b8fa3c9b25e8238ad446709c2fe2bcd4347
SHA512 3b217be1dc5b1adb4eca56a4c43d2b12f9870c313264576c09c48ca6dc3ef2d19a139bde9d881acbcd73ad29416c36f0a82d2b2ebd1242d2d879768e120d4a81

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 0f47617a82f2e5bbe09b1c506d78ff63
SHA1 6052229b1009ceed0d247d341293bb27df0d6ce6
SHA256 ed26d0668dbd88f9c1e2bf5f79278decc2ebfde64d313903a5417aefd6772b43
SHA512 fa34a05e3b8dff4e658ab88d17ad49dd51e3257e2971951ba6ec4009125590a44ced59348e4ed687a696b83c9a0e36e53fdf02bfc6f52becd9eeb1f6940920e5

memory/4452-100-0x0000000140000000-0x0000000140159000-memory.dmp

memory/1256-93-0x0000000140000000-0x000000014015A000-memory.dmp

memory/436-101-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/436-103-0x0000000140000000-0x000000014015B000-memory.dmp

memory/436-94-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 842a9773a26df4c61ced8ab6636ec8dd
SHA1 bdcb725e4c82ca1824e41bbb61ec0995f09a26c3
SHA256 40782518bd68c4520b2cea3d7ba13b60552aa2a15599c546b5c9842e7ddb2026
SHA512 f21064e3328b3a63abfe124b2e9ccee71fe45d5bf67cf8fb07f49fdd1c230f2776ac931d02d0b9a9b2a3a01e6a1f347793a3e5c6e0d35493cafe0784dd29f489

memory/3168-106-0x0000000000400000-0x0000000000547000-memory.dmp

memory/3168-107-0x00000000006C0000-0x0000000000727000-memory.dmp

memory/3168-112-0x00000000006C0000-0x0000000000727000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 a78a885ea35ae539bc5a79b009dc398f
SHA1 1c055c5e02b080a6abec7d67e3e7f6fd54d2ed32
SHA256 1f9c16f729cc77062e920e656b48bfc6cee7a1b18143d57f2115228f9cae5fd4
SHA512 54b679dd6e7fb3f50cb838227286535f6b4b5c142d7189b077eb14d0f01aaec4a4b5e6e912bf0142ae7ebb8d75930342c44eef9c61ebe77b5d5e6a52c9b841f3

memory/2068-116-0x0000000140000000-0x0000000140145000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 af2800fb4a4de4116187a23669cf33ba
SHA1 0df8fcb279fefd77763bc8648340e5e7ac948482
SHA256 07759e4f079f2cb4b17b9a98f12f7bc4b03d45efd435666e86d937307e37681b
SHA512 c5e4d00285e88d10d8bbeff755a915e981b12f8436ac73847cf5163db8f685ffc419e19bb5de92f8c7984c0579fd58d88bcd20b8e39b530698faeebebf56a326

memory/3664-119-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 fd1d0d813d67040caf1cfbedb5dc5ed9
SHA1 4c56381b860fad0bba00884ee261e2e9d6e230c5
SHA256 f545868f123cdc72e2d7d1f7b8562e12606c2a161529452b5160cb2195c85177
SHA512 200be8211f54f9e42333395fccd365a19f60c3661bf77dad28830ae976f20cc13623be719be79fd1bf7c3f2a5e77bfedf37b44e2dc67f92c25ed9a3001fbb40f

memory/4800-124-0x0000000140000000-0x0000000140146000-memory.dmp

memory/1468-123-0x0000000140000000-0x0000000140234000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 e268d53f22a2fc60032fe7419d7ca79c
SHA1 0c63c3035aa5467eff1083aaaa7598aacf4ac096
SHA256 3ef0dfb8acb278bcdfdda69abe5fddd1dcce6a56b9674a8c23569b5b4d56133d
SHA512 8e9ad2e769c7927e4762bc8c1fa5997233fea2bc13498b38a7fbe786d98b9be2eed1036e1f97e45805c173200c3c70f7c22f9b68baf5249fb5459ca5258c7a1b

memory/2440-127-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4892-136-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 5bfb6ae1519c1dd6a79f4462171d40ac
SHA1 632f7fce186a9dd7cabee74daf09e0638f275375
SHA256 377289bac9516a162b9cef2fb9e84ebcd25bd69c432da49773c98bd108b2aa6e
SHA512 13aff0e2a36dd9ae36a2527421ab21a2eb71d48d517898b0cff07e1532278df48e9c9927b1f01e78009f12ca3ac86e1b1f31989530534547dac06c989be698e6

memory/3540-139-0x0000000140000000-0x00000001401B2000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 e50bf32db6af46d700dfb1ac0619630a
SHA1 87c19c3a747ac6988cba261512530fd33b1fd732
SHA256 41a854b6c6c498d2645c31f689fbf5bfbb8e68332463090d524eaaf2a9a828af
SHA512 8fd2352f615ae4c566959ceb43668bea2c1e3e83dc66250ff481a51b34f4c984c8dc57e576444cbf0c54c023845767ff1e3cf503c2b6d3b8f1ed2cc39b7a5563

memory/3132-152-0x0000000140000000-0x0000000140192000-memory.dmp

memory/228-151-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 5f6a4c12680c6d1e8f9fd2af529aace2
SHA1 a7896f5b08b1af0e4e039639b27ccadffa449226
SHA256 b450e9b7dd1544ef14a7dbef85dc69c7223d8278ad814f3a8e27a70cb9a33fe6
SHA512 407a24829762a31c165ca0e02c9147a75ce8969e29c6cec3669d16ec6e6907c5636764b3d01634ffe1919e7d3013fa8a87a9cbb1120cf504efa54a7e6531ec93

memory/3532-156-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2980-155-0x0000000140000000-0x0000000140180000-memory.dmp

memory/3532-157-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 88872cbb5dfece7456d5ab6afaadb0c7
SHA1 a8c64c2affa1fa1c65947c26cb4d0f9c2c43e7d9
SHA256 76e458bc005e76e0bcab3811334a1259ed3872c5a4925d8e83c862aaf289e45c
SHA512 b83173b33196eba226fe9ae79590ef131ea59912dd0445ebdd475bc460d7c7992f02a298aaf6398de2efe4fe8c5c6d333f6f1eeff00bd12d25b8d17eb8f69a1e

memory/2308-160-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 35dcea85147733c606cfeb725ae78187
SHA1 222a30e9a05f909af50ffe10bfff89dcecde54f4
SHA256 9ff7f8a404de78c3db9cedc84b62b691b428178531f53d79b03d64b972af7a87
SHA512 863185766f0a63e141ff01773337d5da13df4ac0ad0dcb252b012e0a1c2f34c0dee30cee1bc8b6768de2df7421c9443f123b8bb979fea164e36a87733d6ec9ef

memory/436-163-0x0000000140000000-0x000000014015B000-memory.dmp

memory/4196-164-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 78ee19ae2e64a2dd2c2465db41ac3c1a
SHA1 e74c2fd0c75cc3b78c82174c287450a42f9a20ad
SHA256 ee1faf9ffcee2a739ba8d3017c185c44ba982f60723f9f4a1f8253c2470232af
SHA512 c066f58dfbc2e4c386cbff54215d6d80270a2c971e8be6387d0f7c90a22b6def745d511dc80409b6f636b1bb091949e40b3a0c19c1c0d3b1c6917470eb889142

memory/3640-168-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3168-167-0x0000000000400000-0x0000000000547000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 2d86b0591e4e776d07df90ffaffd1a6e
SHA1 e70f3097b5fc2e7f82eb8072c01e1d976f500d34
SHA256 5c877311e8a05b93d881fa7fe8241d7de00bafc1fbbd52b0eb24d33b1bea4e0a
SHA512 19d4f2db570b9fe24eec9a1874404b5124a4a54a5fcf57a1acb4306575896fe6de6423d6041b6eb55c049b7ddadbed1d2a805ddfd87d87912668d0bf2c6b67b8

memory/2068-171-0x0000000140000000-0x0000000140145000-memory.dmp

memory/2236-172-0x0000000140000000-0x0000000140176000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 f547b276c0189a9b74e01ddbe20e5449
SHA1 840ffea6285e9a99603ecc90b8e08884d7b956b5
SHA256 0bf4757cdbb0dbad22d414698ae5d7e8f899e5506967d8e23fe848f4eb292f99
SHA512 ca0ed82db43d9c971a72dcfd65a99c65b984d3a22c5722a94cc877869181b37b6baba7e5d5766e9a5630e9d43f3e88858765006806b9cd34f9b25cad897fbb05

memory/4848-177-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3664-176-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4800-265-0x0000000140000000-0x0000000140146000-memory.dmp

memory/4892-334-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3540-351-0x0000000140000000-0x00000001401B2000-memory.dmp

memory/3132-371-0x0000000140000000-0x0000000140192000-memory.dmp

memory/2308-423-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4196-472-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3664-489-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3640-490-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2236-541-0x0000000140000000-0x0000000140176000-memory.dmp

memory/4848-545-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 d3ac633870c42c88583f379cb912738d
SHA1 88d9c49e30f7b16e4471fc1d94f02149bab08693
SHA256 0e9aadd90732ffc3088c2f5f2e1b9b6e2386ed97f7c2b883f8ca50afa811cddd
SHA512 cd392c3a97778a45dd5d77205980ee31ec565f21ead86d8acaff80f2d18b7782014e2d993c7856f9efeda9895adaf480d3caa97574a98aadbc5dfd1bf7cc3b6c

C:\Windows\system32\msiexec.exe

MD5 dc04a736dcdc2dc822f214716cc63a91
SHA1 25272448f4a9e28636079f904120df3f47834e8b
SHA256 508b23d12863944e1ae5ebad1060b610875f5ac995080e40b805051c7f1c095c
SHA512 7e76a6841eed8abf0c4b9bbb5262e36c7774f24ecad0a072b8e002f76bb828c3b940d977255c87c2abcb6609c2176af16e4ecf673d38ce472cc8ad5e99aa9da7

C:\Windows\system32\SgrmBroker.exe

MD5 e5434eb8308ddd2f8331aa28dd819577
SHA1 bdc77355adb4bfc9765f54131e4648e9a63a55aa
SHA256 eb1a09a4860a1e9d905669008df42bec0f2c9f2c75ab4a9f3adf104ff621d886
SHA512 b8f50bebcdd7cdd4d86df89501bd67a5b39661daa638ca86b8d45e465a06eb245cfc161e968a6e6e469f5e7f65ef76c7662c2a4fcdcb1ac48188143c9c81e65d

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 d4ab13c228f06fb0f0cab668490d2b1e
SHA1 446007d6137fffb391c75f06b5a9f5e5894b5283
SHA256 0a604466f3cc2c1fca92733d8cbcaa241a69ab052d8f77b16152ecb9292e7798
SHA512 44542c5965fcf5624847eee06ed7088fcea00c5b2932698cecf9b0f6dfb1a4c6de8ad16187c18ca4a77eadb997159b5a77f50ea1427cacee7f8482801ae77ee4

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

MD5 fbbc0d31f8594a79cf320ec8e86de8e2
SHA1 577ed61fac904a7b89cb5a558c77b2b34f050fde
SHA256 a630a789ff0b39eba2ad836a60839dd3c95a7431b35ae9ff689fc651e49d5712
SHA512 9c3fd2c84ee2a63f2815ca5bd3fe4beae76a9fa4ecf20e1fe14727d97ec716eff8a8f6b4954c635bbc035735f88687b53384c16edff5c0764dc2bd3b6a1ab811

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 48ca0561d7d45d9222311aa2a82e5e8f
SHA1 c157a6a497269e3a1911d7468858f2801fa2b174
SHA256 ea1b7e7e6312dbb958f24e2aa4266f4e9463f87549c18413ef33fcf9c198f6c0
SHA512 f048f495b9860f1a7bd0190020b1d46cf5b3e25a14ac73610053b785c116bdbef7398ccfd0de11085e58da59015c5df8c7576ab3e0a0a97568f8086b16107550

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 057a2cdc9d50ffdabb21f59b3d4afe29
SHA1 3df7d4a383e2ce7c023311e64e93e3abfde29de4
SHA256 33b1869be909752cf689f5dd9971dd230776dbf6f5e861e9fb2c8208da9e398a
SHA512 a3864a81d46486402822a474d1d7f1f9fda834331746085fee0a628745283b1f1cf746681f003f73d4019783b1965a484c69457f0daaddb1f2acf46921425b9e

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 d90a314755933fa61fdd5394694191e9
SHA1 93a2fbc6a4f937fd14fa71f452512ae4a27139c5
SHA256 0bdcfbf4592791dfc86ea3ba6ee44a2a344f5d748c3b9c770b682e7f9843265d
SHA512 675aff382a39a9873700c7c5cab54f6c18f0695c60ab123db50c43bcec7f52a24517077ab83d87b4293c688027276a6bbc776e7f4898304e5b231a39ef8a5e42

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 e306910e37b729794e8bc470e72927c0
SHA1 09f8072e8aa28759f58f7866ea715260d058bc68
SHA256 24241d529c4b63176bca2c903d15b4a4b07bec25d9101705b8d88acb65126917
SHA512 8951dcb7b11795cd136f75374cc2e353e1966048ecb650c430222fbaa51628d0eeed2c32ea2f4283be8608d502db7bcbf6162083e8bcda67f86f43684e06faca

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 a1c4f2b04b6b8dc440063995fe1949f5
SHA1 d27a7a2e803c8854ce3ceacb1de3852d3f2252e1
SHA256 07a56a69f4a3df5cf8c1f2e4d6ce12599bb75924ef52cd2de95b42f8bd914b80
SHA512 129a1fab1c4e84de3f43b8b5bc81c22ee60b0ba35bb1cad88704a43aca8d1f4b59b447829494138a64a1dbee7901dd15db026e8e6072fd81d6ae5f47a2ed38dd

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 90e8a1626646e8aa4264d19c09f2d680
SHA1 7064d6ac805214cd40b5cd14f2f370bcec92cfb1
SHA256 3c6cb3083439066d2ec1abbc13db400241e2a224712ff0ba16e55c45c7ee9736
SHA512 0e60bedd0fbadc7b3a8312a1bd477f017123d357f8777fcf80a5aae6d32f9c65a20b2d1dc3289e1f1d4db161dc6109a8be71ed71e83b60ca7fa872ecd8d7b4a9

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 90f4e97e0ab9416f32395e1a9811750a
SHA1 9845bb626fc1f6beca0abaf9fdea118042f33e96
SHA256 4d16f9502474181321915741f4f6093961ba99d89468c28862a3efd3d45e0c23
SHA512 e895fb5396822bbee87797dfe868de692721cfc59bab90d4c04d96634fb0a3a77047e8d3e0b83ee21c214fe4c00db3ce80e4043d197aac2c975427ba71bbb5f5

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 40cca11bb619a363359bfc2fec9dabb8
SHA1 a9cd5dbaea7f7a055a0593ec566593ef4b3874c9
SHA256 2e236d045fd0856d764b468ce720c957384f47469b787c65702146831d107b67
SHA512 5910c4afa011753270a4c7ccb839e80d9e77e7589cfa564bfdd22e7310f620f77b8a52f2c7bb80e12466ea56abb4e2312b3a210258eeca4d776b09b76f7d1ffe

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 00899ee836b014b7118705e8b7bcfe72
SHA1 bcb1867a230eabf607cd503afe1e17ae85293ede
SHA256 5f71158227c6b6eb22dc74c1767c967e2ee459de3572c5b0c3bbf68bdcc0952b
SHA512 3ef7a384adf3c3da0765d1f2d4989a1e26346be5e05dc2cab9ea19ceff9d5e4d4b0f9ab11410161e171448c26d82cab49f136e6a63a8cf8bfbaf40c49ee217a9

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 ae09a84e2ea2be55f1b250148271a0bf
SHA1 0eee4ff9121533200f9bc646391d51809b5b6666
SHA256 3afab3be0861faf6e37a5aa717db0ce7d5d2628cc4e791a7cf7c09ad9a062bff
SHA512 dcefbcd352c86a5dd9c5cd64c536d8a72bdc851acd438312b40e1e13be683c66f707ce00455799b808a5979fb7cae6dafb2b1b531b1df12f4b871d120333469e

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 5990248fc534f88ffd3987fee098290a
SHA1 3a406a4c15224db73823633d6fcf12ba6f0e423b
SHA256 af3daedcf340d89b81df3c70a00c70ba13d04141222b160de9cf9a6b69646be9
SHA512 7122ab41d73b8141101a1fa1af2c45fe8d6da19b35b61e9e1422e6939f0850f4cb504201c562f946df5276f57b620eadf5a69b14046cf05d001f0686ecc90ee7

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 dd4470a3848e021a29446fc280cbbc12
SHA1 d8369f09e74e652eb3b53f922f4cfa803040fc91
SHA256 c06b60f63f81640f0765da714af8daf8af2fb0c81568132896821d3b221ca9e7
SHA512 a5b854de8caa3876fbee905e62161d3c1a9cf7262b63147128afdd563375cba983fac767137bd17c9e48ac9a7f938483cc20764a0338b5c11ff54264c1720287

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 643a7972e52a8179862dccbab3ec10a8
SHA1 fb1e2533a2d63ad5d07aab03851d636f66469fb8
SHA256 d80f2f6edfb1e5d2a9f75e27ea9f8d6ddc3d5e76134562afd67e68e94a1389d1
SHA512 50faf3649a894dc0752453606436a8385f88c948e7ff6c60538c1ecc9dd983fc8fae4c54d28dd7d2684a136e7686a1395f8834a7859bf41b7fe5109f8c55418d

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 1712b6733b966787b82f53ccff42ead8
SHA1 3dc98419cda27efda2ac9f7562e724438a39fa82
SHA256 754fa2755b882278f0dd1d1ba70eff6cdf18fc022a203c7e9dff0b80e7fd3e4e
SHA512 4d1d580a27b3d5bab4b7a9649778938d837539c31789e4b844ed4b53a98ba1aaf5a5d4fc0a2b6e987a1e698e086ce8f0ff4ff306c1c00d7dd064ebdce4f2912c

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 7a96c9cf43ffa9f141d2a412965dcc57
SHA1 3179fa70b1f472cb41200a87c9e4aa1d1b33dec8
SHA256 8c5868d3d8a16ec88c661c9bfd9952f179a34c62fb62b7559d9478fe99781664
SHA512 b6f14524f855b99ebaa67dd3ebb2b97d09b8343941d9a8bbbcdb71bae471e64d3089eaf150fedefa600edfab85fbede78c8cb20c63f9c2428bfaead548e2191c

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 870bf52b8a7367527d56ae9c9d8d3c67
SHA1 303b8a05d1f7f63794e6b77765da8f6da0a75068
SHA256 04beb67c3c1abc2760b064c6e2fceee062c5f1abae9e6278a159535a7a4c0322
SHA512 dfb689559af22c8db9869d1884a912a3a1410d7dd8d5fdd261d13e8affea20254dd65f20c7030b80949d9b89a32af1606d7c533e451272cd9ff9231ba1f6bc11

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 4e6a8c6d68d3aa20f796959e07df8030
SHA1 0208fa4a07aed7c6592a9144a6ce1da33ad3b17a
SHA256 9825a095b169d2fb9bbe6c49df22e462e27652dd4a7bc63ac2b86ce07de5a31a
SHA512 566d568944a659c2c360e828a570072d29e0097201abb8bacc63817b61d93d4f216b688901566defcc2b59d38fa98e734ba9e5658c34e4de9bb7d7ecb9666ec7

C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

MD5 b381f51f3960095722ea556dc9e86f76
SHA1 779cf9ea01b885f21a19ac589e21edc78e89d4f7
SHA256 437e04b4610d1b779b76ae7b49d9c17f1f0254dc7a56d776a97bd46536bf5270
SHA512 849cad688db0fc7efc9242dc5c24e7bb1d4aa654315cfb33406c13f32d4bd9baf4c30507d12062a368b3518d55517e2ab37589bfab0663790a4205c392141572

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

MD5 e047ce353f0ff485e404ca20479bc7ac
SHA1 2d889a7716dd90cb3764a0fb2930db4f1a566c52
SHA256 c3360948ee66da2b017589c6450fed4b069bdd2bbfbc4d5a5eddcf33e6715a75
SHA512 334c281a48af6ce6beb94a5953cef55d57287d2d4d2e7300c00b9d7d8a71d3d711300d3eb4db24fb7b3e3a349b79babf0ecd551720149695a49fbac135f773e9

C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

MD5 37b3f6671a2a1b3acc4d7b6e222852be
SHA1 1a36758ed1f43daa0532a899a10cd69b07056332
SHA256 9c28831e57df4dee781822cd8d29268eb42921fdfb915a512e16b97655014a33
SHA512 8b89e7a3a6ebf508e8f4c1c53dfd04a5942408bdc49c0556b6d83fea703520beb4bc738fae51b0fb2d0fd8d2a1f9f2befa0659bf187ca1c0f79bebf9d8224734

C:\Program Files\dotnet\dotnet.exe

MD5 bde90633ede56caa8f8294ee6d1c23f2
SHA1 482d1d3dcb400fca036174abfd88d6e3ab01f60b
SHA256 709b117a7df6907174ca172f75770a8508f93be5081b18f01616bbcd998a9343
SHA512 34d108009067eec4ebb42f3d7795fa1990dcfc87457b9fbd0e320d4a17b93698e88fc93bca8f51b5a24e52f94d390c1169dcfa02c0eea38ab52b03b0245c4fd2

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 13732735deb734b33bca2c0290a0b347
SHA1 e91ece5e11dccdcf3ebfe90b921e8f6c8f064c85
SHA256 88a87baff6fe9a08add428bcea946c0d440e4882816cc4fc658db4267aab2010
SHA512 23540bd00790bf6badfc6fb6b6ea4e41e21f8c7748436860967f34551049800694c025a9f04162047d0d1814f69ee2f9872bc4bed166f3aecbdd9e9e000d81a7

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 c2e04f0c8a2af15677acfc1fdc043d0b
SHA1 35344691bd926d4294cb3fedd4cc3ed7c8643902
SHA256 7bfc2e34ecd4c1af6902ae4270bdc4dd8f248b12d12685d3b2a63714358e9864
SHA512 cc63bb545204dbdfefbedd5d47f96bfe6f6344676e45608fd98f8c1ebf94528efbd756cb309094082330d946da364eaddd4704ab8a7ce209d3fe6ca0b8f37d56

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 a8812ed3da98b6d78b8a857cf633d6c3
SHA1 12016fe113ad4c2c42df2a1d8e2e0cadc56050f1
SHA256 777d56b831c556935d414e8ca0ce4f5a51413e5c17da7b6d1b14a1cc70f1bbb9
SHA512 c2c78ba5c76e1d6f619929c028848691b20991122fe7400cd611094a13bc3046a455baa6941ff92854eaf5252b97bff046b9257ebf2d95020b0f3e8f0357f0d2

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 912a59ecc01dfd03cb9b1889bc99169c
SHA1 ebd0b8eee753a7e24fe9412ea4a3481cba3a312f
SHA256 030d25217c83a4fdf26cf6b7dc44be7ce8acb8adbaa9dac1198a382a41581e8a
SHA512 2bca5455d2fca010a85cee25b6ede36a9718d9e95257028963d0e04fac759710005f4e9b17b5941ed6830c7aa2acb17b67044f1af6eb781ad17a313cebc8b0ac

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 1682b8e1f59bd5e08a82519dd1ae07fb
SHA1 e22fc1d0146a926e0abc999b5157f0ccb21c882e
SHA256 776f97698a4135f53b7744275e29daee619cbd46bbf54a849a091a5fdec010c5
SHA512 aa4689148c9a2dffa1fcf77738ae5fed963dad288e0ca26b4f68423bfbd45768550464a48ead2826adff79dd18f25f9dc878ed2e70361a77c0731790fb7c3b08

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ab212dabf07394d924b3ff239edc4153
SHA1 c21ec19d3781a8d28e97f1d31f191d1db97d70b7
SHA256 6a198f914852b4f7259a0c489743bc7b0e9c63892b9c0b32c91df470f6c68efc
SHA512 ecabca3631b59e43dc87fbb934fc26c191db415ead5babdf42fddd20fb59ee5c9678a1729c18305eeea0007b8c9710d528640dbb51e0209f381642f5244b35d5

C:\Program Files\7-Zip\Uninstall.exe

MD5 f237d7cf59886f1e9d2e10f28389961e
SHA1 ca60db9c325b04071dc5098c3971dd4dc1cc63a0
SHA256 f6e7a405ea1134a96638fd449d741f9a577840d1cd5c8b7973bd8d45bec2796a
SHA512 6a912ba757a764c240e4d61d057692b0bba4d4181cd3ba962a3a190e507d882c9ddd683470f303cbca74c27c9d5aa7f06fc0cc193f6b38b975fc923f3dee1f66

C:\Program Files\7-Zip\7zG.exe

MD5 a48f7c60a09b40d347ccac9ec78fdf28
SHA1 fc7a83f16c9face93291b4fd6b2c4a4ae1316ac5
SHA256 43cdb83f6a8d19fe381004044547c491a0d6d94fbec176db0d772ffc8524e249
SHA512 cd11d5abe2f6be64b3b4a7b07d4b385596c63e359379ddabcc3223168c1127774b299b6b128d7cc71197a283925ea6dc133c6c8fa1f8d9cbabd0699f764d0722

C:\Program Files\7-Zip\7zFM.exe

MD5 7302444d05c1e549456e9aa66c02be54
SHA1 4e324289fcbbcb483c6167fa4b9c916bb2723c8a
SHA256 be448c926763e573e5e60c4689bf53b5959febde93490ff100f4eac0aac98779
SHA512 0be6dbc28e7a0c2cbe46c6f2a86c7db424443aa30e406f73d48fbabd854d808a539bc9217a426ddbf0ebb2ed080c718dd7e49d47efec971ea582db20c8911274

C:\Program Files\7-Zip\7z.exe

MD5 58d9febb2a8f2c0e2231c9aac8163fd9
SHA1 744c0fae4326a34965917bade7cde53818c603bd
SHA256 7dd2661561693928d3bc6f1e4e8e9acc44c91c4cf4db2b5c4f246d0fe754e5f7
SHA512 774e4989f97d7a392980b45625d203e6ded48f456d78b8c71439857d97e5a19e1c4b16733b57b61c3c9ce455f1ca56bbe462c284f1f4425fcacf3eb79ab7a1ef

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 9df44a44b8308bced715e66a363ddfdd
SHA1 cf2dd6d3278c22e4d5bfffd0b8375ca30f607563
SHA256 803d1fd8e02ef065a270d7b271643db38bb6ee8a9621ddc74bce31f29f8d5e18
SHA512 acbd645f7c116b5ed15a4c310c29e5bb964acfaf2201452ae75bbf5ecd303a3967d0b0e8503c6a0dc7431ed9745b588f5f7cd069edd3c8dab8b10c37c7e29fbc