Malware Analysis Report

2025-08-10 19:54

Sample ID 250703-gndyysvns9
Target 2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar
SHA256 29f98410c31c84c37a54ec2a292323e2e94cda86fec891c2ed5a5f99aa9b893c
Tags
discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

29f98410c31c84c37a54ec2a292323e2e94cda86fec891c2ed5a5f99aa9b893c

Threat Level: Shows suspicious behavior

The file 2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Enumerates connected drives

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-03 05:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-03 05:56

Reported

2025-07-03 05:59

Platform

win10v2004-20250619-en

Max time kernel

143s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ea3be09c234af75e.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWow64\perfhost.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003558eb49dfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000557ff249dfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b38ef4adfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9e1f449dfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004047b949dfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061cd004adfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8df134adfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8bcaf49dfebdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 44.244.22.128:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 44.244.22.128:80 pywolwnvd.biz tcp
US 44.244.22.128:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 50.16.27.236:80 ssbzmoy.biz tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 50.16.27.236:80 ssbzmoy.biz tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 cvgrf.biz udp
US 44.244.22.128:80 cvgrf.biz tcp
US 44.244.22.128:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 3.229.117.57:80 npukfztj.biz tcp

Files

memory/4552-0-0x0000000140000000-0x0000000140127000-memory.dmp

memory/4552-1-0x0000000001F80000-0x0000000001FE0000-memory.dmp

memory/4552-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

C:\Windows\System32\alg.exe

MD5 0d87579d611a4d1938de8dc2fb4cc636
SHA1 eaa9a3e01d2ee0d5818b1610dab095afcff1bf0a
SHA256 1eb4a16e40aaab55c735d7d9a203acfb7b85fc18ec503914a45253ce0b29f25f
SHA512 2ce51f3daa848b87752101be713b2fa155f1e0290eae4adcd3854f2ec1a53b64855a2a0ab0396b8daf754d20c229f2c1999aa65a7d4ecd002851fbb29e8a7251

memory/2020-13-0x0000000140000000-0x0000000140148000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 c30830fc80a9435b0c797728113523a9
SHA1 1ba3c7ca2f2adcdc0ed122d3cc10f1514359d3d3
SHA256 5b7edae23e60d4cdbdf5d29a57d1d188f3015862110aa780e6539cd10ef8b1af
SHA512 86dc10e77c818323385cba4e2191b7ca7ff1ac711fb5295bd75a5dbdcd07341c9f2a9f1ec8a900f92f22b23fcf3cbcab9594ef16b6a2c7241cf69ff0ba9ca90e

memory/3264-17-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3264-18-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/3264-26-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/1400-30-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 2d91e0ed00d3078e8045e841e9f42f89
SHA1 d5ec59649abd422bb5db7f70b3a4d1d2959674bd
SHA256 424867137ad771181ace57694fabe04b3c5a44dc9a1a411a6a2559393cb24c04
SHA512 a3dfc6bcbb87718746b49c44f1cec0281b7a84234d5a286a10a67048b11172a22c2f165913212b6d27604ee0d60f3a9017017f4e59ffaa53ce7f8f29dafbfbeb

memory/1400-31-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

MD5 e7cb01c184430f197062ddb2e3467384
SHA1 fe18478c4bbfa705a3ecb1748b965f2cef85ca78
SHA256 8ee60d8b184f4adde50d1bed02de89c604f802d0d7b958a8b35f212ffb62661c
SHA512 109a76625c7049d18ac96c4ef786c2657c071387c20c7583ea6cbd601ae4509af61268b3e70f50fda1e5cb3dd694aa4199723fac7bf8da307ce9bbe1e1b3b593

memory/4860-40-0x0000000000C90000-0x0000000000CF0000-memory.dmp

memory/4860-42-0x0000000140000000-0x000000014025F000-memory.dmp

memory/4860-34-0x0000000000C90000-0x0000000000CF0000-memory.dmp

memory/4544-51-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/4544-53-0x0000000140000000-0x0000000140266000-memory.dmp

memory/4544-45-0x0000000000890000-0x00000000008F0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

MD5 b489d48d4aceede83ec50c24b1306dfe
SHA1 f91d201a99c36f7835ba7f2a2e658b2aa5ee2db2
SHA256 8e5c34315a25085ebd4b33c5928f8209daa3734d141ffc5b7cfccec7a0892d51
SHA512 d880818484b77ec9031435b079d78fb0c1e448a110600c9a070f86bc12847134e175ad90f03ef29d7b546a4a51c22f83e597c96f2b03af34800a8e49bdba8f33

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 0ca3365b9380004fb66cd72b64a9cd94
SHA1 809873965b153b9c1a1f8fed1e20386f13a17e8e
SHA256 6910b3c6489ee7ec7dd6f44ad10987e3764a5d920b737ad3831bda1575372f2f
SHA512 9a9c9151cc1956d7303f22004e65d510cfa6bb0e362cca98ef2bdfa4155c6f0c2f5064aba96aab5203ec29ac6f5d1c39fe2da15dd05144ca46d616a16b5ee2b9

memory/680-63-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/680-57-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/680-69-0x0000000140000000-0x0000000140174000-memory.dmp

memory/668-71-0x0000000140000000-0x0000000140157000-memory.dmp

memory/4856-81-0x0000000000410000-0x0000000000470000-memory.dmp

memory/4856-84-0x0000000140000000-0x000000014016E000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 62380749f800a7fc3c2651781fc8abe1
SHA1 efcf696dd52f9aa700655afded9b24dc93bdb229
SHA256 e4fe0d4dcc4afbf279f844e655ce710d33cb920e5999b5cdf29eb92f050d7c0c
SHA512 12e1f69388b57c7c48254a4b319a1af75a694b590aca7dd9b49d67d3e521e600739c55db98fe95f4620009b98ec0746b5a8999e66b5ec0529ccd936baf604b04

memory/1044-97-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 b9d68ef19dda534410426b07402e2782
SHA1 bf297a87080f8f17938cbd5bfdd058e7ae22091b
SHA256 e8f0a84431d36269a4ad88bf7f87fefedc5c50547088869d19b72e3fb3c84561
SHA512 82564ea5e47d3d78c8d8b9688439024cdf99f04cb15ef2951a62140d504b917b3ed09e0e7e627040d087e5bbdf02a57da372bd6b050946c1e23cfa04dcd175dc

memory/1484-102-0x0000000000400000-0x0000000000535000-memory.dmp

memory/1484-108-0x0000000000850000-0x00000000008B7000-memory.dmp

memory/1676-114-0x0000000140000000-0x0000000140133000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 e2cfdcea4e75579a2f79db01d5bd9998
SHA1 c8e2f756d17053bc3bda8e73ae10815a5cd7a90e
SHA256 5f5f5358235e16d6bd3fc7693a08be0e9531325f386c4970c9c196579e20ae1f
SHA512 9ba7bd56fd9bb27870eae0e4b3ad193dde7c23319b196a25c83a886d6cecc0495bd604d4b269825dbacf2de93c455e72c0593e089705cd71bb4c02231a3e9c0d

memory/2876-123-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/2876-132-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2624-146-0x0000000140000000-0x00000001401A1000-memory.dmp

memory/4016-149-0x0000000140000000-0x0000000140180000-memory.dmp

memory/3728-158-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4388-166-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4556-174-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3280-173-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 681a80f92aef35c3975f5e8c8a48e1e7
SHA1 e6c7ae746f54855385b6eb75cf2857d3e9a00bcf
SHA256 6fc23264fc3c3bd7bba7b2571e1b77dbe423c6d3e8317d961e1da6815d939e2e
SHA512 ebcfd5a1f869df775729e56bef5119058a710064da3786e297a33f7c037508f634e1736135b8dfbec988516e10e5f03429f87eb00c4a71af2bda74a20fa40fea

memory/1908-170-0x0000000140000000-0x0000000140164000-memory.dmp

memory/1676-169-0x0000000140000000-0x0000000140133000-memory.dmp

memory/4556-277-0x0000000009E60000-0x0000000009E68000-memory.dmp

memory/4556-260-0x0000000001A20000-0x0000000001A30000-memory.dmp

memory/4556-244-0x0000000001770000-0x0000000001780000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 59d8b66f987af2d762546a31c4773012
SHA1 444b3bb1891fd082d5543ae8a7e20e0ca67f7914
SHA256 57080b7fe7af64396a9a5a34435b7d36c20190c8ebc6ffab2321a3b74a212489
SHA512 c0716b718d96d11b767e1291f155597cbe292744b592d62fc2a87c0b081014968ad73fd756c142949d3983e6358edffcffca6cb52998c380cd377a83548bb6b8

memory/1484-165-0x0000000000400000-0x0000000000535000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 a32c52193ee68910e95877f1aa738be8
SHA1 5677bbc67b386a5655c412904f6c14b87f9dbf63
SHA256 631e1dcebd74200e44f4663cf613d9a52b2ea93cb18f838a6291b9ad342a8e1c
SHA512 d45379d075dff7aadbd7135f98fb81a02707f2b0d94ff75de11bd2f02a8d83b52ec949f21aac32c67586369b1c4ecf21c31e23ca8c3b256af8d8d18e47916b1b

memory/3628-161-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1044-160-0x0000000140000000-0x0000000140149000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 008cd9865b79074976ea40c8f7c19a54
SHA1 9acc98795ad7242b3faa422a6385934257c79a0c
SHA256 216a9f18abd56c8927cb94a7dc488c7ae1d4c35f1349c2f0f05c8cfd9bd9f0e7
SHA512 bcaa2cb59b0c44b0be56c7c0df919ce955db3d8dcea896a700190fcd260e07c0a4f8e3c95c262591ddf504b2906135e393dcec6c03f5b755893bb880c8db78ad

memory/4856-157-0x0000000140000000-0x000000014016E000-memory.dmp

C:\Windows\System32\vds.exe

MD5 cf55fa64e534d991731d7df21f39f401
SHA1 8053be3aaa0beb247799e28a88b383082373aa8c
SHA256 7c0df9403b439a18fec00a001f2c92e17c43cc4624f3e64d04f97343a3d84d84
SHA512 b8b491effdd6fab16102862edcf45c09994688327e86f3d09d0dcd0c7f844dd1a781f202a192463734d359a9973db1544ec465630d6bf5afa90332fb867ce3b1

memory/2524-154-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2524-152-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/668-151-0x0000000140000000-0x0000000140157000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 8feef9c1b8a5a423a8d28e486ea4163a
SHA1 c3903d4c2610bc196182fd4586a4cfaaaf105036
SHA256 2a24acfe646ba080357db7d28763606a07cb8cd6cdd78ca46d97d9f84d30b112
SHA512 628aeb2d2cb20b7d4f3c7f7e895e501ddd1d7be037caae3e3f876954131fd9493f078cedcbbcb34c0581cf3e3873606d011cb7f3c280d838079ab1be888f1df4

C:\Windows\System32\TieringEngineService.exe

MD5 21079fd78c4071d9ee4d427128645f8d
SHA1 326cd91a157b136805495f4f7b84d86404be3a3f
SHA256 eee814453c2ba2c4bd251858ec408ade124067d26507ba3d96eea31b94157b93
SHA512 6da90861fca3a7fd6edbd921286e32ce0175c36c09a7a5e0cbbf6c44db3c5768cfcde457ecafef76c5a6eb472cad22e08762a2d43bc5a3ce740e8838085b7fa8

memory/4544-145-0x0000000140000000-0x0000000140266000-memory.dmp

memory/2624-142-0x00000000008D0000-0x0000000000930000-memory.dmp

memory/2624-136-0x00000000008D0000-0x0000000000930000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 edaedfac8d81f48300e0848719d0c818
SHA1 41dfcd1a9ba1a5c1989e52e0c7fc865809b5206c
SHA256 6d6ba7315c49b5087b7f5f82594202401ba1eb70ed2d3e7326ae7c520c16ecea
SHA512 e12f28c08e0a06a9fe052423fe1d898ae9bd9da0e26aad5f199200c9189b1e0a994fddde365860129397e9f4fa04dacb8e44e2a12bd7de29e68a12d5d2952883

memory/4860-131-0x0000000140000000-0x000000014025F000-memory.dmp

memory/2876-129-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 5f3f81bcb491f92977f10f60e0573efd
SHA1 4b4bcbcbf4f6f0540b030b4b7779c6d785a2b509
SHA256 9c17071b64ca37959018ff6276208247ed8f1dde060a84db74f760ff6d585b29
SHA512 153e27fb1ecb7943fb265fca06018c5295fe0d1e36a66bd2f997ddf0165abc24f26a851d00ec73e1214959c6a581fc5897d742baaeac9500ce076c154f2fecff

memory/3636-121-0x0000000140000000-0x0000000140134000-memory.dmp

memory/3636-279-0x0000000140000000-0x0000000140134000-memory.dmp

memory/3280-117-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 d12940911637e04db085d5e8f15f4e88
SHA1 e1cec55abda3f9ef4343df27a15d4a908078fc48
SHA256 77711864f5d1f09c230df2227564f3fabdafbb872c7a7577512814a54bec1944
SHA512 043b65c5ccc9a7d55ba4ed0d977bd5b1082e31b9d4234ef4cd4b43da4623f22d76458c79c1ad1884e3f2916b15552aaaf97485918d1e901087f2d4d21eff0e8b

memory/3264-113-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 4081545e29e011f2e2d725fc452afb9b
SHA1 cd84146ebebc920881c06c80859eddc4fe73d261
SHA256 b20e37f90e9576d412c6c2a450702943737e9223d8334429abf211362df7d8a2
SHA512 d48a800a1581523d4a25d4dc74243711e6a54df83ee8e58fe5df203ca4b1cb7723708862923cdb02777d21336e178fa1cedf69aaaa1d73c026eb086d9babcf21

memory/1484-103-0x0000000000850000-0x00000000008B7000-memory.dmp

memory/2020-101-0x0000000140000000-0x0000000140148000-memory.dmp

memory/1044-91-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/1044-87-0x0000000140000000-0x0000000140149000-memory.dmp

memory/4552-83-0x0000000140000000-0x0000000140127000-memory.dmp

memory/4856-75-0x0000000000410000-0x0000000000470000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 fda1882745f7082591b2c3f1657ec51c
SHA1 82cbdcdc11196a0fe8b13c964ace5d6f870e6e7d
SHA256 e2ca501a663e9e7ddedb194afde90f2e95ae8563742f9a6791c288e658eb23bd
SHA512 e8c834db236e2d792c69bb1b5521cfc4b240ec673944b9aa0656f5ab5372d8df724ffd187053d1fbb5555b94faa35eaf78910959dadeedca7ceabb1eea2aa132

C:\Windows\System32\msdtc.exe

MD5 32efd40fc9f0fbe90a18992bf3b4ed09
SHA1 3ae7e15ecbf399b704ec24fb66a8efb609b428df
SHA256 31a74f32fd6d7198cfe06b3a5a32440e1239f1051c4c5889f5c06f9b59cdf47e
SHA512 ed738a295d5d51cd5616b7be4fb11b8a11e3af2fe9a8fe876e4b92c94ad32edb5c0cfbf29048d2b6d63e13e905c914db1387a77121ca034639c24adc3375b641

memory/680-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/680-56-0x0000000140000000-0x0000000140174000-memory.dmp

memory/4556-283-0x000000000A160000-0x000000000A168000-memory.dmp

memory/2876-335-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2624-361-0x0000000140000000-0x00000001401A1000-memory.dmp

memory/4016-364-0x0000000140000000-0x0000000140180000-memory.dmp

memory/1780-367-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-368-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-369-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-372-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-371-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-370-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-373-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-375-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-376-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-378-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-380-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-381-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-382-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-379-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-377-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-374-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-383-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-384-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-385-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-388-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-387-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-386-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-394-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-395-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-396-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-398-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-397-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-393-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-392-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-391-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-390-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-389-0x000001F876010000-0x000001F876020000-memory.dmp

memory/3728-399-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3280-400-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3628-401-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1780-403-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-402-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-404-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-407-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-406-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-405-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-410-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-409-0x000001F876010000-0x000001F876020000-memory.dmp

memory/1780-408-0x000001F876010000-0x000001F876020000-memory.dmp

memory/4388-451-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1908-470-0x0000000140000000-0x0000000140164000-memory.dmp

memory/4556-471-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4552-484-0x0000000001F80000-0x0000000001FE0000-memory.dmp

memory/4552-482-0x0000000140000000-0x0000000140127000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 e67286528f0b427b0749d12289c2dc26
SHA1 9cad2a7ac62b2d609f1bd70e0098e7400cbad039
SHA256 eb858938ecd92fa4b3af473f98f06bd7886c332a0d421b74552b4f9915c310d8
SHA512 f14a25e17d277f4683fa2ffa5cf653f438940a7b7f09e91517b4faa8e3069871504ab72c0e6d5c628a043df0876861dd1d52b4624491279d70e56362a5032b4d

C:\Windows\system32\msiexec.exe

MD5 4126059f0b2835d66bc945ca5c207754
SHA1 bbf16abea81e03689d3b871de73a23ebb427858f
SHA256 a51db8d047c7dbacd11eb09420f659e80c499dfa00aa19c21ff3b1ee37523fb5
SHA512 5d01a5e62e2c1975a069ab8cf5f77d0671fff1ce0576b13ff194aff28bcf567d913a8832ac928a7bdb47a5e713482385ac46cc1588c3ad87481a10f545ceed57

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 4596ffdb24a9582193ccbabe7d10ffa9
SHA1 3413879ceb1b6401a2802703d5f5fa9a36f89c2a
SHA256 2d9e77ae30621409c6fcc1ebfc0c9fbe4fc6084e6bc2ac86b76410a136e2ef8e
SHA512 68d9f26c8d841810ccaf98ee9aff7131fb216f737efaf6727c2ca5f6898e15f3481a501187fe5c1456d3468ec495f7508e53131cdc84caca7d26d40e901cbae4

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 ed9554e6d86ce9f313bfe935525ec5f6
SHA1 d958e69336c2db7d318d5b1efef5c9111b6c2cb1
SHA256 8688a61a7e6f3b995a17fb5117f6fe300cd9db3e754b878a7fc9c08a6af9ce96
SHA512 482e7f9b59b759ceaf4f9b5c8aba6665c0d7c22f67ce685ebb72db21f9dba8b421115276c85507c277c9e6741339fd827d5c872a6887398393e61984332b64ef

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 203974523a67ba4ae7bd0ff160bd2762
SHA1 1a78a91a7f906e006736c251613005a57f3a9462
SHA256 61d1001c55b82c6e2319045aa1ff876f5a55614bd7f5d96da3ed237ba0519f05
SHA512 8292fabb2fa3aa3a3da02e3fc742b70101c306308cc2e9e3a174044294321fc68c6eb16ea240f1eccdd902a4c13b4cc9134fbf62505af6226ba8eeafe530b14a

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 f4c3e2a4132bff05883d82047a529688
SHA1 1bacdfb4f14a4244bb40de51b65624bbe10051f4
SHA256 3cb4c9f92277d75440771b9138750772d95ab8bbbda047fc4882fef4138bfddd
SHA512 1f30bb89c309e049390027103c31ff32a4a97f98c0cae1be9b7140f5fd2be3c53ade92e790e00f130eff2e087f55d1e9fd26113e7d721a5f8275f8dc22729af0

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 88eddd047d1852ae053a0bde6894afbe
SHA1 aca6c9a5ba6f44dc1b07ce6f91dcc5f6ab62d01c
SHA256 31c2981b8934ba8c91d405978477889095fcee3ce935a6ae65fd8787c9840af1
SHA512 549bbd49dfe3d1d380d5c76f3bc3c2fc22b7e95e063fe32981e71a1e88d7910fd5e042bec0b91ec700c081ce080dbaf52400cf0f793b82f942dc9e3cf7e0b0b0

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 c11cc8b5ac93f392afda34638badf8a1
SHA1 7d1ca568a818e80026410c964ed3e884f225f430
SHA256 87e0ea2b8098bdbd13debebd43e833a370bb1c05490ed04162d8eea05d41b41c
SHA512 462d19a2302c29af0f4be08bd28c2a14cc348e00ef326b0cd52a8546c418b4d0e299d860e88883b0b15ef2665fd2192c0ed9931f6be040caeea234933e859961

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 0d2de475a06ba879a41d6cda7e292d9a
SHA1 0086ee177d053787e3311510429805a6cbb0b797
SHA256 6f04428faebcbce6a85b8aa8bc6adffe68878aa70325d4b4d48325cf8bda6266
SHA512 58415b571dc4e87bbabdb44bb08aedb21ddb83b4be22910a922d77e5e6ee6bd343d72d8a10a2cffb089ccd8fa0be22b8f717788a9338853c85fc5ca5cf3e65f7

C:\Program Files\7-Zip\Uninstall.exe

MD5 b1e7da9d4b13395f292b2eb0bcb1d861
SHA1 12b439d7375f5912447ce363f29b6ffa5849220c
SHA256 15d05550913387983dc045e4aaf9d276dc0ac602d27f81e97771695667405a50
SHA512 af24589fcb53d28c2fd50f0b095ec246ea8e0aa3a7e7ee52abb14d15e7d30ec16f04567fa0834d7d40a500d07bb0881366b0d9d08ac373ba70bfac256681cb7b

C:\Program Files\7-Zip\7zG.exe

MD5 3061d68156c87a3b1b966d0c4a0860d0
SHA1 88982bd0e7a96605d63e4908b9347db97423097c
SHA256 8ff979718669a5bac33662ee2e79e3620a58e6cefdeee3ed0d00fd6a4c1d7931
SHA512 c1916b4eba879be499a5f15df3b23756189e53152c9d4c60b9b3039cb166ceb72abbf43fe6dc330f18aa1c9bbe0cc4ac13c9f6a04858da51bc1fb26d7ffbf772

C:\Program Files\7-Zip\7zFM.exe

MD5 ee00982b701bde8f3af0d78ecabcf3e0
SHA1 8a4a6ae3adec0fa93d3d2a9b3901f3785f05d304
SHA256 05bac12e15ac76627ca102d71504dd435c43a1f8881b4a0e7172446a22c6ff24
SHA512 0953300be871358a2d2c05728ca1f80f0138318492a52a8cdc85cadb3d78390383994b1c5dda4e778a396761cbedf2de648f8282cbd4ceef2d260d0345c1bd2a

C:\Program Files\7-Zip\7z.exe

MD5 6618aa69283fbe77eec01857b1e18ed8
SHA1 03bb73bad1ad99e0139fc6d33a0aa4f09e1e12da
SHA256 f109d3e9240eb1f70cd86c545ee59141227f243bc81e72639bc40198faa86a00
SHA512 56432116e23d93bf34a2dfe85f42b40b644ec6a2e786c7b3138b855e991ea33c9e7c1fca8bbef11fd5aca21a04d2892480424c55b0eb67c57d72726d2d5d7ff2

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 62c298319b1e357dbea25e5438a30005
SHA1 f677f028b6253e599e806ee0b6a4d387389be289
SHA256 d43a72803afd4a1fcfc74f7ce77a01f8c20790515dd94462e77a61b5f1e7e0f3
SHA512 858ef18068ed88c8fb0b0070b0fe690761dd7d1dc45bdcafd6027573892cf205729b0f43f762e6217837cd8ab2ba6504c9f48c60db85015cc23d7758b15e7c7e

C:\Windows\system32\SgrmBroker.exe

MD5 c49377322695e1b6054e6fb5b45956b9
SHA1 11655956262abcc2457c381f826961f6c2c25fb4
SHA256 86df86386830a7cd6098929dc7e0637b33a4bf18e493f84e0d56c731ba9af00e
SHA512 1001c51813ea6e0544da8f0020cc2fcf8cd44771c854400a7b533f16cc7b9ef6cabcae8378fa33de7e798459361a2704b0d7cc4175c51f5762d4004a4c74be87

C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe

MD5 957aa75e6fe61e125f6216f1c3b7f776
SHA1 98e18a39655d16446c4001675e30c89ab6ab995a
SHA256 c5db71cf1811ca0a6fbfac7f13fb978a8cd1ccc94391653ef2dd74ea70e4efa5
SHA512 7580f431f7f3690372a584c665a1edd488cb0410c2c556d866f9af02d1a68febb383570a74f6bc7e43a9850410a99d8f2ed4ea10bd491b23119e37911809d07c

C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe

MD5 f3678da291251e172e0fdd96626dbb38
SHA1 e8c749481fcc85efd3f20cf95c5e900d4f4e8bd4
SHA256 b9dd529e2fed566a8e1140054aa6ad5b0439f336750d34d8bd4d80ba2561268d
SHA512 5f7ec19d1d718aa6a5fa83dfd30b17942eaf38fd66f0b21d5b3f8a1620827cdd7696036d8dbcc899402c1cbfc87e715f7f973aee9122e5d0ac2abbdd72e7640d

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe

MD5 e05aa0d609e3d2962c2d89d37857ac1f
SHA1 0eb0f003960010bbd3b28f972b8ea36629655070
SHA256 3d85232ae50a1b88e7d1d686458e1f9750e18aff1dfb899d96d220efeabda7e5
SHA512 92ce2c5ef50a6b88ec526026cd7f130829fd94195a8cdf200d330440fad0b8b1fe5981bd052f26e664c7cbbfe0d00e743851d6d9f30fa314050b6d0989c2e3af

C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe

MD5 85f47a4b3663e8cfc49f85d58be84794
SHA1 339d29fe88d4349b135961f4df03fb2f16bbd061
SHA256 5db5847ce76dc768d5ac6a75240dec0d92d31934673af946439f74402da4ca07
SHA512 ce862f093d553e907c6411bca5d41c58fb2431cde59791be024280dcc2d77d8d96f888b24c99c673b63ba07a5d30a04dbd58d79598d587410a4d13ae718a1dc4

C:\Program Files\dotnet\dotnet.exe

MD5 117c4e308f78ff3e079618044683b7c7
SHA1 343082672ddf7720ff4c067525b04cfb643c9c7c
SHA256 165fdc4a3dba5639475f706ee7da4527e79d08fb84f3eea500782270599dd705
SHA512 5f4b8af768a010e0b3916e2f73d35b482d19a618ff7dfbe6a328d5b9acbb6ebac5dcf0f777cbab8abe69ed1a815fc124351c6ed1509ff684160db82b5300d845

C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe

MD5 1c0a9c7d14352a2cd38b3134c045892c
SHA1 fa9e365e6ab69d9afdf4a82a3f02f7a7af9dbab5
SHA256 f19aa728290c50c29828aa0c25562bbfe6eedf2be7e13d767456af3a1ebc4c28
SHA512 35ccb7013f8426daa84b8b651732e750d96a50044a20cb32d38a457abd29d012ee81f24c361fc0c6462e8cde6fceff203315990b4e60a1198794e499d16fa426

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 d5e2c1704db0297798680f0f48e5cf20
SHA1 b472ff2a25fa84a9ad9471f17bb2a50f620e3ffb
SHA256 7c071dfea797faaa04c466627f237f0701f0708145b4536e5eb984a95aafb740
SHA512 6e6fc6f25ce2e9906f6bb92c297d709fcaebaf320ce02bd0b015435b14eba5014eaff102e13bfe61c304b476bc42f2edbf6fa5089e94f96e6cd40cb1c00914c8

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 b746ff5bbb2a69e66e9b4a6c1cb35be4
SHA1 0bca204eea89e894d64fa6412b51310e0b9d9f3e
SHA256 95af9c8dc9cacd563d801e8020e1d86f67a0fde92c698f98a95a1349747fe849
SHA512 d3ab83356124387ed091844c53eeeecf5f0971e8ce5e2fc59405725f05060b1e3f36ec22dcb2aa4870b8da0fedf5b0304836eaa50ba34449bcf515a4b40293c3

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 26d327fdfb672dc53189988cd6e4d39c
SHA1 b73f5a8ca70f252969f331fdce0b1789c42fd2fc
SHA256 10782263b99875ca4647cf5bcac333d968b9f79fa581fd95557319b1b1453d80
SHA512 a28fadbe13cf603641fb76f181453d07ac842e717127dde4d302afca9f24ba3a0d1f156ebd177a3a98c5bff7fb83d31ecfc12f31b5ba0c4c0611d1d718930864

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 73fdeacb8616ef69ac7e84c37e20f530
SHA1 0577a34631bbfe35ffbfbc603ee66a5342e11c21
SHA256 63eda148861a2e1196054cdf0d6e5bd74feb2b44cbbff31a8ec153d75327ba43
SHA512 d237770b171129aaba7749658b106b21ead840dda6f5dfdbabcab36634d9571941552fec0758ce933300dc2d667601c464ef7be01ee52e1fad2f8139c3a641f1

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 66a4896b4dbc231e029d12ff6cab69d3
SHA1 0e8e012b8b6b5f35528ecfd1e503f58e5023f2ea
SHA256 a275ac4cea9a2182495c9fc6a86af37da09278b36ce8377e22824822d21fd050
SHA512 55db40554e045d74b9b41e80b179b0fe2ffbd5c7f702153f22e879bacab5764f3935151ed9c5f5760070a54c2e396e007e5189abc38da3a24b0f124750b3f1cb

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 9b206d6abebbe1593dc7a765838ef619
SHA1 52718ebadff5305324039d0778eb37a60865d017
SHA256 d216a005741efbc9f46c8294b6656c3b935ffd270fcb674baef49704f411ef22
SHA512 6c423d3ec3b68e605bfcf70f3ec84f5aacb50a0fe50816801a4128eac8269acc5350c953e12f5e231bda16698bfc01377d8bc5c541becb5919592f1db908168c

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 58685a2f2f157f6b184bce5bcaf821eb
SHA1 2aef121049bc7898466cb1a55bda396f425de458
SHA256 88501fff760b722d211dd5117924177ab343ba590e79d65b0a3542b551d8e41a
SHA512 840e8ebe162831e4490b7be1653c0ad3984c716ffe1570249391d13d334aa4f78cea6932f412e469cf6b89eee9a1f3e9e6b3ca44d34d13714983ef7f4ab0c020

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 a3be3afbb47c76aa18d9b3f0983c3ea5
SHA1 fe301c7eb6e3c553850be36dfc0c8799e5e49cd8
SHA256 3a0184936998350936b2a0af62486d3357cce9758eba172fa125d013f5bc245a
SHA512 efb99d31d270ab279c8fe4f067409f790ea55ce8e340ae036fcd6386e7f9643af264eccdba29c79c84228109e5b32b3265c786f26ea124e316b88c521b78750b

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 f8c4400704bf9f7b7ec5e858517c041c
SHA1 0deb9dab7a451eeed0c11bdf167e8b341444eb7d
SHA256 916fe0b1babf5034c2d727821415beecc8fe8bdaf6ccc73fc012930487b900db
SHA512 2933c0fb6a4c21e3a63c583449754966eda4255b8c8244863e2c69e7c0d11f985bc4cad8c52825a96d90c6cd507936bde10e9d552149eb14d92f44de1143810a

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 8849d66801293d78174c4e25b67ae794
SHA1 d8b58679107241635beb006d047210e6fe6486ad
SHA256 71001b8c779f8033405e943bd49173ffaed4b07923709449d9ba3326d1ee38eb
SHA512 507856b5993459e1fb3204e60576673ec431abb619ef743ce51f08f868a9cdf10f7fd2228284bf5c921ac397f4369bf3c2c403770e832c4eea7a3e40aa6acbfa

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 4fceb07fd22de1bed8d9b8f19ad6d452
SHA1 b2efb9758807b70c5328332325a0ca0a0811c308
SHA256 fe826a0b75b407f92e6a6577051c772bb8b6554fcf556282d1f5b3cbfcfc1c05
SHA512 ec2b4b58564ae23dbb9d3c95f3866e7d543afc5b03cc5b6de732a9cdf82203a55aceeb222ba6b644c4df7335f7391735afba4354d2fe394ccabea5ad3e6ab45d

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 b1c3e77667ef0685296ed9678301f2b9
SHA1 7c195771cddcdecc85807ba82f63991939b2c6b6
SHA256 577622c16bfbb4dbe6f016685c6e1c7817cbce97db312d7374b585614e58e1e9
SHA512 8bc79f503331bb212ed5a96baf561ce37b1d0b17d66d0dc76adfb4ab98858940289da87d19b6324359df08ec325c190a92e58c7d345ec4824ac823c44fbdd0d7

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 f50a21cd720d9ae87d1b99a80255e333
SHA1 48cce169e645ad5f7c7484b90f84b69c351d8b90
SHA256 f92eb9a17072eda04ec51768479a956c04c8cf22934160e92c89c0d61eb59137
SHA512 50ca992b75ac26bdd499598c2f6250b014cd9effb3889bfabfe802e40628a8fb1c3a9d9bb3b33c0dfe33502a2014fe869b411a750ca78d017dc346630a588ae1

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 6933ee89e71d1c9e68948361fb66aa7b
SHA1 02406b2de687ee6503def970b0f8dee522feb310
SHA256 fe08994d71a5f2203f4499f935b0b3f6f8053a0af0ae94a7abd650b56961b768
SHA512 fdc8b0a035c28e381f2d5935d47d0b3a167fe874b3c75ffbdcd06d4edd9c2905178cbde351206c987e57163c33d93a9d138cf1b45770776bbe62ddd9a1c7469e

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 bf8069c0794445ba29fe6327cc2f612b
SHA1 bb2163ad7cf58d9213633f67853ff79962a4b141
SHA256 466d568db06fb7356f8fd66bdf2c9b55a0927d596f34b2ea64828bb60c59c954
SHA512 5eb41e2cfe1807590d97536a2448d24512fbf3c4c8a5bc3c1d8cc314f522caa2160ab17c811344ee9aa72a09b0d446a0879ac7c18b409cc63bc904c35ed53cf6

C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe

MD5 f974bdf3df1a223dc4aa6e4e42b3f017
SHA1 f21e64609512545d399793bb6299dca662a6bbe3
SHA256 3cda7d77373beea16ae6b795634b1506909b14dc18bf1f52cb4af65114a65724
SHA512 e2f5269c1c390abae3c61b7379789ce985cdcba0887dd2d6a9bdbab0a5c013f0b605726b5f464b920b86e2d37a340fafad89ed4d5292fff3e98e42a177236294

Analysis: behavioral2

Detonation Overview

Submitted

2025-07-03 05:56

Reported

2025-07-03 05:59

Platform

win11-20250619-en

Max time kernel

141s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\w: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\x: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\i: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\s: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\u: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\y: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\l: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\o: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\r: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\m: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\v: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\z: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\p: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\t: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\a: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\k: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\b: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\e: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\j: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\n: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\q: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\SearchIndexer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6220756bdda829f.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db C:\Windows\System32\SensorDataService.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin C:\Windows\System32\SensorDataService.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db C:\Windows\system32\spectrum.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db C:\Windows\system32\spectrum.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWow64\perfhost.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fffe0447dfebdb01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003044cd47dfebdb01 C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007afd2347dfebdb01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3495147dfebdb01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003afb4247dfebdb01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0dc2748dfebdb01 C:\Windows\System32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-03_a15bcd1d72195004bf3786780a6f3bd0_black-basta_vidar.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\System32\SearchProtocolHost.exe

"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 944 2748 2800 928 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 944 2836 2832 928 {85EE815A-7738-4808-A14A-3AD87E32A3BF}

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 44.244.22.128:80 pywolwnvd.biz tcp
US 44.244.22.128:80 pywolwnvd.biz tcp
US 44.244.22.128:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 50.16.27.236:80 ssbzmoy.biz tcp
US 50.16.27.236:80 ssbzmoy.biz tcp
US 44.244.22.128:80 cvgrf.biz tcp
US 44.244.22.128:80 cvgrf.biz tcp
US 3.229.117.57:80 npukfztj.biz tcp

Files

memory/4976-0-0x0000000140000000-0x0000000140127000-memory.dmp

memory/4976-1-0x00000000020E0000-0x0000000002140000-memory.dmp

memory/4976-9-0x00000000020E0000-0x0000000002140000-memory.dmp

C:\Windows\System32\alg.exe

MD5 1f60dfd97b0fe39007c9c624f7cbc7b9
SHA1 90fff491fd3f645b4c9c087f118d0685a9448816
SHA256 2d97aed03cf7b689d846453ad97fa9fc7db3aee9816161ddab6a2d5e1628869f
SHA512 087abfcdca2a84e34e05f84232d320da82d2ab7d72498526a5f06e43f4e01353bdf89a3c6692e14c8f6c3401f8932ac38b23c1eeeebe302a01528abbaf1d3d81

memory/2436-13-0x0000000140000000-0x0000000140148000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 084a3732e34e5a4ec1e59af3043d36fb
SHA1 d24d9a03055ff4ec46af44ee5d2baee52e44d2ce
SHA256 33446d6c5f978f68ac70b4eda7698bc1157f64410dba38dc817e641dff47d988
SHA512 e18e03e24fd4a4004f4187b147e962d661c75e8eb2491bb985d14c4a85bbc97ebb1ca68ae280a3bac7a4eaacd7ae6ddfbe2a148a78d138232d16d5651b71390e

memory/1812-17-0x0000000140000000-0x0000000140148000-memory.dmp

memory/1812-18-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/1812-26-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/4620-30-0x0000000140000000-0x0000000140136000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 298538d57b8a2102ba3a8331ec95f69f
SHA1 774f9ba82870c3d084b7c020de6aa2cfdfb920a6
SHA256 4fe4f39a1f7415caddd2f7cdb900342082922443a2bd86597b471c8969363bfb
SHA512 753bd1b4d57bcc057ac9b946a61e003f33532801a4ce262b8b768d50d0f72c572f66c3ede8dbbc23d4eb5ded46eed5970bc41d341f47402b4138d064db685352

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

MD5 12146a8915ab25f1f3ded6de965aaf2a
SHA1 7f3ef2614def09e650881519abfe1f96c13ed557
SHA256 ce2a34ee304bc72a965990bfd70e0b3fd83516eddb88c789977958ad4222aeab
SHA512 a5464449eb97ec2341ea2986ba53db0f1081ee1a0d7718ad505c9c31b051059a44bc855a8ecfb91eb5a0d94f308eabaeec8151cebadb813a515d295ec000dd11

memory/3576-41-0x0000000140000000-0x000000014025F000-memory.dmp

memory/1556-44-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/4620-53-0x0000000140000000-0x0000000140136000-memory.dmp

memory/1556-52-0x0000000140000000-0x0000000140266000-memory.dmp

memory/1556-50-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

MD5 cd7a02a2c483b41a3b3f85f3a1fe2a20
SHA1 37c1257b7c6322171ee676f881e3ae7dc13ca5fb
SHA256 45f8dc83f0bd0966d21f6b22e0854d5acbd96c946a0fa283a6bb4d79e61a5261
SHA512 c25cd39147a691cbeb92c24b77c91d374625f0759b5a5f64a18cff074405631f327bf9048825dd85aa5bc8e58ba8fb049c66a2cb67d4b2579c061887ed1acd23

memory/4224-67-0x0000000000C70000-0x0000000000CD0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 cb74ddd5888b801d6fba9297893ab80a
SHA1 50894982b797b2504100e710e1323c26c8acc34d
SHA256 aa37d90c6537e0a5ca5679de3a2861ae9c52bb4b65f02d448fc4d78a057ddce7
SHA512 2478481df5d36242bc7b9f0988cfd33303f75941dccad1ce43f70389124d5a4990d6bc3d2f90479a00bdbedaa7ddadc83398ff59632424103d6cf3dd996de23d

memory/5112-71-0x0000000140000000-0x0000000140158000-memory.dmp

memory/4224-69-0x0000000140000000-0x0000000140174000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 01c65c5b4fa36a7c0e6880f7a85196b5
SHA1 733c744c2d2a26977c7cb7d0bff9e8afd876b42a
SHA256 e2e7ebc087b0e6ba7878b8d05b6cf41dd7f94f12172a83ff7d8e3284b20913e6
SHA512 ce912d4caa15f82a469f0e68d60b0e0b79a8da33801a468522167c3cce1f1e93c1c9c705bfa9d441dbb26e3704488cd8da8b2c2236794d165cad23a6e53fe819

memory/4360-84-0x0000000140000000-0x000000014016E000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 acd75ea266208a5491b306524aff6c4e
SHA1 a6a0ae8ce77916d0e34a600532399407f0308482
SHA256 2b2532433a5a15bbcef781024aa6124bc817033e7fff1a0609c83889e13effde
SHA512 dc59b51593c5c4d824ab0d610763dace2c9cb996a7e7881e363a5cb4f663a933f159467195b1e6b519b8ee1e4be1d5a708431ed63c8bdc09d2e3ba1846fe202b

memory/4688-96-0x0000000140000000-0x0000000140168000-memory.dmp

memory/2436-101-0x0000000140000000-0x0000000140148000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 4cdea77d3d90400d78ba04c9c522c2ec
SHA1 7d9954dc53866c9ecad1f9315fe6d71a528e808e
SHA256 132d3e270f11f5e200b07d9e0b9b456a44c8515007822afcdabe4206adc5844d
SHA512 617b9e232d668267e3bfc20a226f7b605c8210b70038dc705b683398843b53b21864cd42d1e2d8d1820291923ee15d3242c79ee8664accfbac00e1796fa6be03

memory/4688-93-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/3160-107-0x00000000008C0000-0x0000000000927000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 4538fc2ec8b5c3f3a0f6dad2c1fe354f
SHA1 1a5299e7d471b3dc00695df6d0d2135b25547b83
SHA256 ba56e1206f64fee778e80b8c1a1d32faeff54207a9939b3717eeda392fc20fab
SHA512 9deab6bc01e2b8c2e4fde4ab660f6c89b0eae9ddce137747c135b8cb14b5382801012c81c7d9fd5b7e826e11f33e86f4374f2c054fe7f1b81362b65a6b3c59ca

C:\Windows\System32\snmptrap.exe

MD5 38c965d4295cfce090e70e2dfdbcd7dd
SHA1 cbcdd928cbce781fd247464e3c777bd83b7d36c5
SHA256 dac627926cf47f14a1c16fbe57a6be04a9f47c4d88ac3ab063a48b2d26ce337b
SHA512 fae1be0d9f2d60f774213b40fb9e4735ca31c8f818b71efed4a42f37efa90c724b7e0d9727012809071f304e92bed8a5ab45d0c6a57860534d1e4eb3af4d710b

memory/3696-124-0x0000000000710000-0x0000000000770000-memory.dmp

memory/3324-131-0x0000000140000000-0x0000000140134000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 5946bb23a2d1c755b383c98e7a5a6d0b
SHA1 ab011e69908b7453fffadce5ecd2fbb618e25e6f
SHA256 336e4714d43f1fd52de4fe2aefe2e4cb51ecf636a369066345a82d4d2584ea75
SHA512 2cda82eb0740ce7c35d0962db3cdfcfa66d974315872150a7d2239d1ef9bf3b9679700643b7e4f048a69d85595a07a56d814c31592871f6ba7e1e0b2000f76fa

memory/2628-143-0x0000000140000000-0x00000001401A1000-memory.dmp

memory/2388-148-0x0000000140000000-0x0000000140181000-memory.dmp

memory/4040-152-0x0000000140000000-0x00000001401AD000-memory.dmp

memory/2216-160-0x0000000140000000-0x00000001401F6000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 553605914bd8c7edb8bd59c9e972a075
SHA1 1f96b2fa1cc04d4ca1621c0df6d0778bbedb4264
SHA256 77c6cae55e59f1c5380d971d0c7b2543033aeeed11b17e1d1817dfc829d7cc4d
SHA512 31a6414be478147797d6e2c6b37c12a682b21d8ca7f889d7a2b551dbaf1d88ca8063379821aa4b9865b6f67cfcf617e7727350f2ce3596149b3096ad0b258e52

C:\Windows\System32\SearchIndexer.exe

MD5 907b988ee4b31301eda7a7d2036c1bef
SHA1 8d3f3f566e74cd5d006c4a0c6624fe8b888fc5f8
SHA256 0beb07952386ee689af7fc464784bcc05c05679f95978cb3fae9d34662c5f1f6
SHA512 62389fba1fc60400b9afdc610d335d79c31f74490702302e1669b0988dcfa5341676b5bdd5fe19bb24f068589b2e72d71ea1185dd13cf4f47cb73e7d8e7b7f2c

memory/4560-181-0x0000000140000000-0x0000000140172000-memory.dmp

memory/3160-180-0x0000000000400000-0x0000000000535000-memory.dmp

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2

memory/4560-206-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

memory/4560-190-0x0000000001C30000-0x0000000001C40000-memory.dmp

memory/4688-179-0x0000000140000000-0x0000000140168000-memory.dmp

memory/4560-177-0x0000000000910000-0x0000000000970000-memory.dmp

memory/4560-171-0x0000000000910000-0x0000000000970000-memory.dmp

memory/4752-169-0x0000000140000000-0x0000000140160000-memory.dmp

memory/4360-168-0x0000000140000000-0x000000014016E000-memory.dmp

memory/4560-227-0x000000000A520000-0x000000000A528000-memory.dmp

memory/3696-229-0x0000000140000000-0x0000000140149000-memory.dmp

memory/2788-164-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5112-163-0x0000000140000000-0x0000000140158000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 a7f77f5870ed6526094f3ebc492e148f
SHA1 122578bfa5a8917c418b6fe16e8a9edcbbd0e70c
SHA256 fb1e24ed9068ff5b959270105210fe70c19ac0f6f10c2da6566954e3465d1e88
SHA512 e9d8100bf62a6ca7480af5502bc86b0e1f8fd1a95e65079f412518efb5643048977c2900f4acfa483fc90e42bb4d6f9c9fd8869aeba55e0527080ffb75f2fd06

C:\Windows\System32\VSSVC.exe

MD5 dec21c8239fe6672d1df48f6d7040243
SHA1 de80a6529a89892a9f8af8a89b4c5c07c011c376
SHA256 2223f2ee043d12556bb0d89cf62ab927dcd0393348ad84718a585fa2fe483885
SHA512 081ff982ef5d49c28e013f4c47a99e23ba9cf1dff3b5cb2e3db5a1dc61a403766f2e7758d2dfb7ca1929df9dfedabed7310e79b690a80e1ad87b004d8a41805f

memory/2920-157-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1556-156-0x0000000140000000-0x0000000140266000-memory.dmp

C:\Windows\System32\vds.exe

MD5 9eee3a126e859074ae0160daa926445b
SHA1 7ecddc5a65f46a601ae99c917fc9e5b1852394df
SHA256 871de4f1e53b70733cb7d11c0d9cc3c13a58c1317dbf9ab80a3b016878a01e37
SHA512 4ee1a8da525bcb9cdd309918968f9f3e59717326e28081be5b0c1ccc2273185ebe9949e7cbe45d7cef929e88450a8fe649eac12bbbb58d8fbbbd281b178662fd

memory/4040-153-0x0000000140000000-0x00000001401AD000-memory.dmp

memory/3576-151-0x0000000140000000-0x000000014025F000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 52b782ddd27fe10ef7a0b7761146cc50
SHA1 09cb42ace034dad3baaf5fa5c238eccdf222ca8a
SHA256 a3d505be1e49d62a91e30aa9026ed0fde3d12ec7a2a1fc2d513656cef4b06f44
SHA512 c7210044f6461821fde0f79740c09c2b8c639279a4ac91e1b921c69c195a7cbc6d3f74577a517b427933efe46420634fa44280138529843dd012c01f2d3f5ade

C:\Windows\System32\TieringEngineService.exe

MD5 2828ab07677efa3aabb699bd0bba3483
SHA1 78ee2720790dbc04346f6e4ef8c874cc6dddc73f
SHA256 5fbe75c965a0b4b2c6234c716de2fa8ebff2126eb2fa7f5f5173aaaf132d0d94
SHA512 d70682af30b8cf0d9c779b656ade4c225451f1bb39f4e8564976714e7c499dd948140b983228113b912ce4fa469e73d525aa30453fadd738067aa078103bc0b1

memory/2628-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

memory/2628-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

memory/1812-130-0x0000000140000000-0x0000000140148000-memory.dmp

memory/3696-129-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1724-128-0x0000000140000000-0x0000000140136000-memory.dmp

memory/664-127-0x0000000140000000-0x00000001401C1000-memory.dmp

memory/3160-126-0x0000000000400000-0x0000000000535000-memory.dmp

memory/3696-118-0x0000000000710000-0x0000000000770000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 621a8ecee633d55cf67d2fae0c786707
SHA1 9d214307f6e02bf72ec6b25c0cd7b718b9107cee
SHA256 84bd31cecd4a96c5d447cc400811a99bb3420b65239485fe0d92e2508aeffb24
SHA512 a2a15ca18bc380ae5bf7741c9c87287ed0c06ae1b125419f125e852061971570bded46ccc6a214363788bfbb8130a36e3c0dbd5979ff9b6efbd2caf6dbfae4f1

C:\Windows\System32\SensorDataService.exe

MD5 2267c7960be029c855317c6744b3bcff
SHA1 f8f8c60ad7d6e05611e623ed9246add236042d0b
SHA256 8c4cbfcd8837795f4e2b75fce0caddc0d2c7202b34b1b2e08aefa6ed369f96a1
SHA512 34764d7044363ba569a41dd4345cb836fbe9322d962dc2dc13a782f54c12e2a1d8b9e3bc63847f63d55245a85dbc532f34ac81b4de28ed454a2372b92aa18d22

memory/3160-102-0x00000000008C0000-0x0000000000927000-memory.dmp

memory/4688-87-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/4976-83-0x0000000140000000-0x0000000140127000-memory.dmp

memory/4360-81-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/4360-75-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/4224-66-0x0000000140000000-0x0000000140174000-memory.dmp

memory/4224-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 dac80c5a107c090448abfbdcc4ed9318
SHA1 e678c6e66f26198e952dda30d3ec66fa3e1ec6ae
SHA256 be226da5d4a5216c0dbdd60a50296973db01de1aea050ea95187ed352043e34f
SHA512 d75f1de4188e5017e571810124b1f3b537a6cadbe7808c2ef3b82409d7312f52da7fbe4819137887c4ab5ee1295e8e0e066b5a2e600190288fadc1d86cbf5f8b

memory/4224-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

memory/3576-39-0x0000000000900000-0x0000000000960000-memory.dmp

memory/3576-33-0x0000000000900000-0x0000000000960000-memory.dmp

memory/2628-370-0x0000000140000000-0x00000001401A1000-memory.dmp

memory/2388-371-0x0000000140000000-0x0000000140181000-memory.dmp

memory/1404-376-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-377-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-389-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-388-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-392-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-398-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-409-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-411-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-410-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-408-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-407-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-406-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-405-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-404-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-403-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-402-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-401-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-400-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-399-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-397-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-396-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-395-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-394-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-393-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-391-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-390-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-387-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-386-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-385-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-384-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-383-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-382-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-381-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/2920-486-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1404-380-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-379-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-378-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-375-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-374-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-373-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/1404-372-0x000002B2ACC30000-0x000002B2ACC40000-memory.dmp

memory/2216-535-0x0000000140000000-0x00000001401F6000-memory.dmp

memory/2788-536-0x0000000140000000-0x0000000140216000-memory.dmp

memory/664-537-0x0000000140000000-0x00000001401C1000-memory.dmp

memory/4752-538-0x0000000140000000-0x0000000140160000-memory.dmp

memory/4560-539-0x0000000140000000-0x0000000140172000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 c1a8e53aa0b7f59b9adfdbc2728134f3
SHA1 e9d49514961b68946b8589bd76fcc40f433061f2
SHA256 88708ac258c668c6a82c193f0939af59d69a257156dd0991a412aecf41c8c9f6
SHA512 5383678115536196483199169aa1f4066c156d44c7a6b300d0980ffd84a98649205c8cb886c8e81439f52481aa1b380b4d2afa49528a076d9fb4d2c59e6cb33a

C:\Windows\system32\SgrmBroker.exe

MD5 b7422aa305f844527b66404f99549dca
SHA1 cc08c86d7907fa269f4d10df709eb67e7fb33987
SHA256 293c76448112b6a15c2d99d566c7d431ba739d5f80123b0dc066fa9a2bd29b42
SHA512 9ae84015ae19c2a279d3065064b7c3f8d3eea518fc2067b28d248156780e65b743649aa92270db1d42177314877dae1477bcc3e511270d7fae8da6a419ef0b44

C:\Windows\system32\msiexec.exe

MD5 b10d4acfae1584c536e5d55d2c70e0db
SHA1 4089c67c98cf1c6cbac0aff30e18cfc34d444cec
SHA256 b5119e1936c5ee891dd41a32b347bffa6cb45f007738ff3d60cee1067cb532df
SHA512 7f793467546200c7c7bef78a6ea31510a333fd85a0516111e624f5b97e42ec5f40ed317b4cc0baee647662cec75c5ba5238b6d12dfe474b5553d5376926ce2fb

memory/4976-554-0x00000000020E0000-0x0000000002140000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 f5ba88d2a79794d866ca563f889c79eb
SHA1 49b4449f7bc263642eb2f84b21d6a342a488e0ab
SHA256 3850c838ff865a200f7240f4d8b88beb51b4fb1189e4d1af4d589654a07318af
SHA512 6d885b5245f8718522a92462a366a5e4ad805bd4942b421f59175cccd878d8288906ca93d05ac3b1e69f11c8b1d1824f63c11659d35774846ffeb548be034110

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 9d64451b56e337ce184c79f1e934c37b
SHA1 4cc8f4066a99a36ce26d42a6954bfa7829ad6c2b
SHA256 65cabb2bcbf948bf5c06818b370fdffbe5fefc3e16c09eee7b90338fa250e100
SHA512 ec49ab0f5519444cd88d5af31cf2ee7bb801fcc529e2a398f8ad9a5fe887b90382f06f0039442d4e8ad9bef34a2a4e51f972352bb731f560efa2af6755698c2a

C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe

MD5 86198685f21d580fa70faa8429d2eb46
SHA1 025c791e8c046518f1a9a1042d25a81c9e6657cc
SHA256 6538839fbc98eafd3b56ff9fecfb75b98238cb3fdf3c1650d12fd8df9c2abb7d
SHA512 ec39ba7d9a3707d6605c16994b621a2f7e6c9e68b479fd904d13636e7de033e830e345839251211a38b034f1c23ace070fbde9892c1d9a7ef42ca701eb431cc4

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe

MD5 60f18d8bb2d184f8d8cb6b4a316198fd
SHA1 ad478221d1c6b557e8c8eacb210cc5fa6fcbc5e9
SHA256 99b96beceb5a841166acc93ec0fe4648252a41da6306f1e5846a5622e74dedc5
SHA512 8bfdbf3b4540101e90a8b15728cf050e94a4e705f7616d4ea1703883bcad4b5e570c2d698fcee2af637ba87ea5b2bb3afe71845b5995b559b34bca42c9be87ca

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 cf5a590dbf373a9edb1ffcf9b5189dfb
SHA1 0e17ce283a5da92d76492c85f82ca9fa74998c16
SHA256 7996d0ab1effb37c66a1e18dd19ead6338aeff8ba9a863e9a0d5e4c17fa345f9
SHA512 fac618ceed0cffe313fd18a7af05dc1e4985c302e5dd9ca77ba48c1514bef7a3937e1de0d2ef65924540b08b655ff7aa69110e1ec92c655ceb220301b3a97d67

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 4da907f6777012c98eb6acd528ada29b
SHA1 ad3223076797c73c19acf92a5f2db511c65c4763
SHA256 4afe3590c726ef2fad6630c3318d570d37b3f238aa3727cf6e1ac30333484354
SHA512 0f609a458d3784b477a0b6d5c1b830a4e31d39cac1f500552a83e612ac3a9cdef2e726cdefc387bef46de86e130ee27bc7d3ff8064599f3fa2ee982335b4a610

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 17378916b2be54442ddd31e980bd9312
SHA1 447da5a7775b50da32331aa87c22019abead870b
SHA256 4b74cdd252c4f18354562d2db140fbf8b572710e38872a5d8262c66c2b641da6
SHA512 5fc423f76fc351b1cd17fb48c511c24962ede098235a7c93c77d148c3ec756c380f8f84297c5dad2507263250cd5d8e9771ae89d810ea2258628b93dd05739d8

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 388d0fda2d64200e66984e9c4fd2d7fb
SHA1 7131c80fc12b3bbf8ba4e29f6a684da468a0ddff
SHA256 a904a7236e7403c2ca0b44c42853ce0ee6b32007d013c70a289a282d493eb229
SHA512 35e913b476d51112b51808dcd84b1a2013e5a2b44bcfb7e141eff65c006704039a4afd9e1479940f6715ab75b5944ca048514c10769a7b0913b8db596fa5a3bc

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 92fb18453770502f4b16f4a7195d049a
SHA1 84bed619f5fe4a870d982af953931fa6c8880994
SHA256 f5d4aa0261bc2b35c6e41b0b49398d08c7bbf0b0fde9ce5a6210f6c744dbc656
SHA512 08ca6761c759d3fb65c8e8b32ef400f00309534ce5a3d5ca99560b5fc0129f288f49260192d922902be8cc76c5ebeb0c4b3ac7cc3b113457b9173ae7997581f6

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 3f43abf65d9043ce3c9e47ed31a8d244
SHA1 f0707dd65eaddcef16033d5e605d11ffb637ba28
SHA256 f64b94bf005dc87ecb18b740e4ed7935654aed685a71405abc6622493713569b
SHA512 26f520d74fae3ee16b5f1924585f110a4154966b9c2e43be82b28ba114e535c0f51cf3e604f9c928f79e47c168cae01ee3148956657f9a4784b1c01c19ca2e17

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 2eda96591073d1628744e0eb2e202cdf
SHA1 0593fbdfd58164cd512b10a65bf6bff880772d61
SHA256 8c977276da8f282698af93f16bcbf45921951e2fb3a42d7548ee94f2d811ed64
SHA512 2fe84c5ca8da795edf77d5a630b97ae7266b328783ac96ba343883805d4c417c8234afe0f8112bf36b168fab95e4b4209d5d89882ed5ba5c9baede7770a93eb1

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 62b96975e3d1fc0a00fecaf5a476b24a
SHA1 db587926920aa6fd08c4ce71563bf2fdc5a9d7ba
SHA256 b491254ecf01a946e1ad4f2ae3454af0d2ff1d18df2c4fa58c28be82d7b5eebd
SHA512 a3d12f47787672c641c6d88b9c955c6e84614c448ad70cadafb64f18cd0deb645f4522222494c7de1df219882f8f045c2f03021f310391dd0cfb9a96b55962f6

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 965cb261d94cf8eeffd2990d1bb8e689
SHA1 166db0e286216c61da5555e03f76d126d423b5d5
SHA256 dde6bc7ad9c1577c00b1a29a483f917cbb22b6e24aa5b07e620220c6efe2c69e
SHA512 793025a5e9c936e7fa6985a7deb2c7da5c16add9a897a6064aca26354e17275b96488a2ac96f7af30bd0a1f62f3ac8a7a02ba9b6df5800a7210bcfbb416c8dd6

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 1d6877e6a3e8019a3034243b5ac409b4
SHA1 4d91e39e895d078f71ce4b8ea225e5c12b67bd92
SHA256 daa4a9fd4cf27abf9d32be7440725ba2e3f5b4dcc51c4ecc2dd9ec84ccadf8f0
SHA512 15a0871d366543a2c655bdc303e4d01d2929cbc874c511662d5113b92f28b84eab3b7218691bc8865ac492977f31769010b4aeb7fd656b47270a520b189ac8a4

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 b6f89a0b97d10dd3732f281fa4b055b9
SHA1 bc1a161d7664051bbceec353abf33740673c3fac
SHA256 6caa0d46ba9061fb6087843f55f4646cf545b74ee66e4963928b076d354c2109
SHA512 3652029e53cd1a10be61d2d439d646b9aeaf016474e1703a342ec0d349d2d993198dbb1b320040bee1c11a772ff4bd1fd61c705887536806653bdf2620917d61

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 efc24ff00c45fd544e965c7c2c1a01b7
SHA1 e90882ed1de4badfcb5489d1c6c15ecd93f70cea
SHA256 bf7705619b6d122b64217b80f3b5752d12d9bb90d63173bb5a3c4031c5d376f8
SHA512 81a30fc8c27a669e29c25b7d1b0d28cb7d12e0b720973e6161817da86fbc3fba8038955d2ed9af0e118037ac4e17ff67bc28fa561aab435e65cb41a4c4e744be

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 ccaf818167329942b039a25e44e063a8
SHA1 edd36cce0c4e348fb42307f703656485c97272e2
SHA256 ba2e7d6748fc358bd87e5e10e3bd42d3da315de8a0c076112b521818d31c2568
SHA512 a75415b394f15d7cabead86281fb2e6bbb5bea1059d284cc55d14227fb318213fcdf6e5b829997a3d5f7cc122a32f5dcc98744845b3551492f993990cfc1c1de

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a69c31e280b7ec205d4d554682fbb0ab
SHA1 4a3c6e9d96276314928b2b90d9e44077b761ee34
SHA256 1e2f10a123f002c8836df7c67f35d9559f7442990b1de3bf043b639a87644c30
SHA512 09d1916df60a56f63a1346b13ca10cf7e240b23aa6d4f5d56931772b7e797668a12054c2d7fd9cf09bb6ea0b391f07165632bebe1427d341cbe99d9432622333

C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe

MD5 82b2cc0677038372f7151361c415f1bd
SHA1 22364423bdf0904ea40aae3f34bf6df18054322a
SHA256 e13d9b446f9206a81fadb3745994835b33d8cda7f63110d97c9e5222b1376ae0
SHA512 549636bcb682c9a136c388cc9addf596e6d0479c6760f6caaaae545971c2d33bc68136afab02841a48760af5029ad201ca521cacca8ecd514ee8fa950f85ff7a

C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe

MD5 b2ab1424a82180e138c26ffa31e7585e
SHA1 908b1570cd0b6ad7e8d127b172adc5f875cccf9a
SHA256 e83253fd94dd479c3dbe8b269daca37826ee37000efdbddfbac37c383358cf6a
SHA512 4431bbf8ca13910ca014852566a40649e7202c7bf44e0e0cda7f8f3150e285e07a4e09e7926516746ab9adbd41dca5f80d684de76dd9f162aaca745d6a74a3d0

C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe

MD5 3756af2842276a59bab99420661b7a83
SHA1 0517e5a58aceafc13018f0064674e907ccefe972
SHA256 80735a113c386a3457636f8480f4c87643ef41db5c39d096cc6054027486a5e3
SHA512 2f776c6b83735cea8b94454fccbccb4c98e9bb9417366bbee2517585926e0a02e4af0726dd632e630cb866c113ebffd6a3b2ff7db55024b58d80eeda4b545411

C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe

MD5 3c1951345349f68ce91d108705a29677
SHA1 2c41ebe1df0966b741f394737820da1ad1ac6313
SHA256 6a3ca37dceb854efe2fe49a055a92ce0ec85457382882cabaafab648ff5ae741
SHA512 669d63247c929b89d099152c137d15a9b460a9320410e2a3d22c965ae8235992279f4c31469346c9802fb30eab1447b7dcee68a06edde5b36a011b7bd32a0dc6

C:\Program Files\dotnet\dotnet.exe

MD5 3c0db6ad66fd7820ca3ccb094249f6fd
SHA1 07db6f71732f3cfd4e320000d1c41a7b26338704
SHA256 d85930dd1f60a1ca459ec0826d9115e165052ead003be6481083ac18d844b77d
SHA512 3908b21b038e811405ce6369c7d0bea833f644f970aa7f9ba12f20aaba01331fcde47bcd4fac302c8e8feee08466af6db4ab29fe5f8c8c3279645688adbfa282

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 a02d723be39d1ddd2a6e474213d6f61b
SHA1 811ae7a304dc34955f4d398f75fad1292f889ef6
SHA256 5378cbf023e7c57a307f48511c324af0b622828014b128ef9bf5baa36d7bc41f
SHA512 f0c9fdc1404a392704a10e6621b396272ca21a409c20eb80b6ec8cf6e082610daf300463ac740b8678f3fe75be9c39b42ab1ee907693e01ff68a87ea436ed75e

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 2c443b1ff5c471c6a44ec9177c7603b1
SHA1 9482c03c2537160e3778b3a3c9bceec3df794d21
SHA256 6aa696ab5242cf4660de5e7664bfe8a6b62546949e8ad51ed07eba7e1d923a56
SHA512 72c5b0c57ff422f52ac7829c6dc1535aeb62f5994fd472c584c2fd21acc79ee5c14289287df0a0dab586c252964bc9f8538b3cba9cda4b094f5e331f5690f760

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 a9148e324dc8b1114fc2b0977f16b6fb
SHA1 bc0ee5acb36cc310ab7ccf303a6660c7205b3f7f
SHA256 2c2e9d9740438709f7bb29a27a4d8680987024fee32e0e3fb7b95e1f72fe6d84
SHA512 a880954a8bda0a0428e24637732434124a55beeca87706755bdb4a10880453fb57dfc9e6a0d7628f0065bccefa06d0f1e229456a413212fdb83e8fc4b3d0984b

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 8b2e8047a29e4a6c6d6ecdfdc387d7ad
SHA1 b4e7fa6ea6a98c2e2421942051b8d56ef95aaa10
SHA256 53e933ab060ec614c7a7710b90edaa2a3675fe8bf3bd7226b722202a4660a489
SHA512 d08243b9343ab1b2f87b40fe0fcbc990e20cbc506a330c5a1f39cdf11a107aa162dc080ff975d9fc2dcbb611a3fdabb839a3a77164b9af0dda6834184c7607ef

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 488718367aeef20252a6108e8289a306
SHA1 d5e0c071e0e0707f182b612906997eb3df0ed408
SHA256 e908adfe82fce439297d4551708ca9cc1c85675dba2cd70df4fe0a68d4844b10
SHA512 adeb8a3f654195b9c9701bc066a10404dcc0059ba5164269c621c00376c827047e23905936f9a4bad8236f41cf09446d452ef9e54af4c059b758fae475c6fc51

C:\Program Files\7-Zip\Uninstall.exe

MD5 93f2f6c56f911939e3f75164aa1583c2
SHA1 03544ab2829f200d97f6d74729157ecbf1e683d5
SHA256 399cc4d77701c2701e1898511787c7fcdcb135f21661845fd30039be4ccf138f
SHA512 425f2f3e5b50302658a45157c098963b50d55826ab2821bccec755217c3aabefb837f69771086a7fd32fc96f37d8f4885d62c5fc29988a7607ca52b963aeb985

C:\Program Files\7-Zip\7zG.exe

MD5 e2a9cf2e5489c15f604dc76008c9e02f
SHA1 3370be39e8e05462b07e1da9025daeb0960d3f54
SHA256 2398988144f3134c6133510865f156a1e684e1da6c92bf2cd6571674bfa1be38
SHA512 1f2a6332708b544cae9a76cf334c76878c482bb80521cbbe61720df7ea74a97681aadb507a820ddf3f1cc86a36c24dac7218e58cdf9c72dbff3eef7413a431fe

C:\Program Files\7-Zip\7zFM.exe

MD5 33da7e528198e7e5b42e898f06e506c8
SHA1 f7b2c84ae8459e29ae6d1735a044a7f5ee30c35a
SHA256 669d2a30d500366c2eb7f63e83b8a9aba1fa10f124718f4044bcfbb8fcc54fdc
SHA512 a5f29acc288330e96ee12b40d6b49c623e3e5584df1fd6f1d90db7e83e42d78e053d57be19b3e48cb1f8e61793284f7b7e41657c824b08f6aef896d7df33d5ce

C:\Program Files\7-Zip\7z.exe

MD5 097afbcc7bb4a8b58fe0484796ae9047
SHA1 88253c733ce74239333478129ceec7bc438d0e31
SHA256 312ee5a1c9dad6e3dd7e5828b79da8bd9b8638b47afffbf7f25ca15c088116a8
SHA512 7fda0ec388b0343361d07166a193fde8cfdb82af723818d5bee21eebd0bb77f6bd1f5c9c26161512479481325f3b9e653a16272c5130a2bfa5e5dcc767760df6

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 d0cc2339351f940a7c741b127eaf52e2
SHA1 9123403d3eee87466447741cb211856816eeed2c
SHA256 cfc3afe25a798436b63f4355f252ec9a23e79629116de74f36786bdf1e3d3cfd
SHA512 debf1500cf1080af8ccd27fe0445acfc66ef297424cd81bec1c289af2c4ad0813444add515b18782fbabdb68dc9a90591703c50b5c9b1657c9f673db0afcd729

memory/4976-552-0x0000000140000000-0x0000000140127000-memory.dmp