Malware analysis ww_uu_gool_uu_yy.exe Malicious activity

Add for printing

File name:	ww_uu_gool_uu_yy.exe
Full analysis:	https://app.any.run/tasks/7c460a9f-be57-41ad-91da-61b787d68607
Verdict:	Malicious activity
Analysis date:	April 29, 2025, 13:57:57
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	phishing lua
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:	B272A04E9C1B350CB771E69C77192CCA
SHA1:	12D8BF03F1123E085AD0973522EB9F46F326F69D
SHA256:	A4B0F381813EFD51A931C3ECD7F9D004AD416AE2B5DF70D5278A73682AE2332E
SSDEEP:	393216:ttWdq6LqnsiSrX5+Y3OsRVvO1RSRwV3HBI5qASUYfv9O5tFDPNFAblWH4:L1n5m+3sKVXfUnFD1abZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- PHISHING has been detected (SURICATA)
  - svchost.exe (PID: 2196)
- Adds path to the Windows Defender exclusion list
  - F0j0RSKP40C.exe (PID: 8024)
- Changes Windows Defender settings
  - F0j0RSKP40C.exe (PID: 8024)
SUSPICIOUS
- Reads the Windows owner or organization settings
  - ww_uu_gool_uu_yy.tmp (PID: 7960)
- Executable content was dropped or overwritten
  - ww_uu_gool_uu_yy.exe (PID: 7940)
  - ww_uu_gool_uu_yy.tmp (PID: 7960)
- Likely accesses (executes) a file from the Public directory
  - F0j0RSKP40C.exe (PID: 8024)
- Deletes scheduled task without confirmation
  - schtasks.exe (PID: 1056)
- Contacting a server suspected of hosting an CnC
  - sihost.exe (PID: 4984)
- Connects to unusual port
  - sihost.exe (PID: 4984)
- Starts POWERSHELL.EXE for commands execution
  - F0j0RSKP40C.exe (PID: 8024)
- Script adds exclusion path to Windows Defender
  - F0j0RSKP40C.exe (PID: 8024)
- Executes as Windows Service
  - WmiApSrv.exe (PID: 6876)
INFO
- Checks supported languages
  - ww_uu_gool_uu_yy.exe (PID: 7940)
  - ww_uu_gool_uu_yy.tmp (PID: 7960)
  - F0j0RSKP40C.exe (PID: 8024)
- Reads the computer name
  - ww_uu_gool_uu_yy.exe (PID: 7940)
  - ww_uu_gool_uu_yy.tmp (PID: 7960)
  - F0j0RSKP40C.exe (PID: 8024)
- Create files in a temporary directory
  - ww_uu_gool_uu_yy.exe (PID: 7940)
  - ww_uu_gool_uu_yy.tmp (PID: 7960)
- The sample compiled with english language support
  - ww_uu_gool_uu_yy.tmp (PID: 7960)
- Reads the machine GUID from the registry
  - F0j0RSKP40C.exe (PID: 8024)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - powershell.exe (PID: 7364)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 7364)
- The process uses Lua
  - F0j0RSKP40C.exe (PID: 8024)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Inno Setup installer (67.7)
.exe	\|	Win32 EXE PECompact compressed (generic) (25.6)
.exe	\|	Win32 Executable (generic) (2.7)
.exe	\|	Win16/32 Executable Delphi generic (1.2)
.exe	\|	Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2025:04:27 15:04:39+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	704512
InitializedDataSize:	258560
UninitializedDataSize:	-
EntryPoint:	0xacfe0
OSVersion:	6.1
ImageVersion:	-
SubsystemVersion:	6.1
Subsystem:	Windows GUI
FileVersionNumber:	11.852.415.320
ProductVersionNumber:	11.852.415.320
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	This installation was built with Inno Setup.
CompanyName:
FileDescription:	c4c9ec73
FileVersion:	11.852.415.320
LegalCopyright:	© 2059 Pixel Alpha Industries. Statement 12
OriginalFileName:	c4c9ec73
ProductName:	c4c9ec73
ProductVersion:	11.852.415.320

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

138

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1056

schtasks.exe /delete /tn "98C95FAC-D11A-4B54-95D5-E88ABC7618E8" /f

C:\Windows\System32\schtasks.exe

—

WmiApSrv.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Task Scheduler Configuration Tool

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2196

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

4984

sihost.exe

C:\Windows\System32\sihost.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Shell Infrastructure Host

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

5164

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

schtasks.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6876

C:\WINDOWS\system32\wbem\WmiApSrv.exe

C:\Windows\System32\wbem\WmiApSrv.exe

—

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

WMI Performance Reverse Adapter

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\psapi.dll

7172

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7364

powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

F0j0RSKP40C.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

7392

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

7832

"C:\Users\admin\AppData\Local\Temp\ww_uu_gool_uu_yy.exe"

C:\Users\admin\AppData\Local\Temp\ww_uu_gool_uu_yy.exe

—

explorer.exe

User:

admin

Company:

Integrity Level:

MEDIUM

Description:

c4c9ec73

Exit code:

3221226540

Version:

11.852.415.320

Modules

Images
c:\users\admin\appdata\local\temp\ww_uu_gool_uu_yy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

7940

"C:\Users\admin\AppData\Local\Temp\ww_uu_gool_uu_yy.exe"

C:\Users\admin\AppData\Local\Temp\ww_uu_gool_uu_yy.exe

explorer.exe

User:

admin

Company:

Integrity Level:

HIGH

Description:

c4c9ec73

Exit code:

Version:

11.852.415.320

Modules

Images
c:\users\admin\appdata\local\temp\ww_uu_gool_uu_yy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll

Add for printing

Total events

9 276

Read events

9 263

Write events

Delete events

Modification events


(PID) Process:	(4984) sihost.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy
Operation:	write	Name:	WasEverActivated
Value: 1
(PID) Process:	(8024) F0j0RSKP40C.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Operation:	write	Name:	3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Value: 8FE3FC3E8F25F83EFFE3F85A8FE3C63E8F9DF83ED1E3F8E68FE3873E8F0AF83EEAE3F88B8FE3293E8F77F83E1BE3F8C78FE3313E8F66F83EBAE3F8768FE3363E8F97F83E79E3F8A08FE39F3E8F80F83E50E3F87F8FE36C3E8F46F83EF3E3F8BC8FE3B13E8FEAF83E6EE3F8598FE34A3E8FF0F83E41E3F8B48FE39B3E8FF0F83E79E3F8778FE30E3E8F62F83E5DE3F86D8FE3A23E8FD0F83EC6E3F8048FE3153E8F51F83E4EE3F85D8FE39A3E8FD4F83E94E3F8C78FE3EC3E8F8CF83E74E3F8FA8FE37E3E8F6AF83E04E3F8AF8FE34C3E8F04F83EB2E3F8408FE31D3E8FEAF83EAFE3F8F88FE3D53E8FCCF83E1BE3F8258FE3383E8FFFF83E80E3F8C28FE3FD3E8FC8F83E5CE3F8E38FE38A3E8F1FF83ECBE3F8208FE39A3E8FB8F83E8AE3F8638FE3263E8F18F83EB2E3F85B8FE3933E8F53F83E27E3F82A8FE3583E8F41F83EA6E3F8B58FE3963E8F54F83E48E3F8D58FE33C3E8F7AF83E96E3F8A48FE36C3E8F86F83E2CE3F8878FE30C3E8F83F83EDDE3F8588FE33A3E8FC2F83E01E3F8B98FE3FB3E8FCFF83E11E3F8A78FE34C3E8F1CF83E9FE3F85C8FE3863E8F7BF83E32E3F80B8FE32C3E8F22F83E06E3F8F18FE3653E8F70F83E81E3F8308FE3C33E8FF9F83E00E3F8D48FE35B3E8FABF83E53E3F8B18FE3D43E8F16F83E88E3F8948FE3763E8FCCF83EC9E3F8AA8FE33A3E8F2BF83E72E3F8E18FE3F93E8FE8F83EAEE3F8828FE36F3E8F73F83E4BE3F86C8FE3383E8FB1F83E01E3F8A48FE37A3E8F6EF83E73E3F8B78FE36F3E8FEBF83E6AE3F8508FE3213E8F32F83E01E3F8668FE3D43E8F47F83ED4E3F8008FE3633E8FACF83E4FE3F8468FE32F3E8FEAF83E16E3F8BF8FE3153E8F6EF83E3AE3F8668FE3903E8F5EF83EF1E3F8488FE38C3E8FE1F83E35E3F8738FE3893E8FDAF83E92E3F82E8FE3143E8F5BF83EF8E3F8CE8FE37B3E8F73F83E06E3F8198FE3073E8FCCF83E1CE3F8D28FE3FD3E8F22F83E9EE3F88B8FE32D3E8F20F83EBEE3F8AE8FE3023E8F58F83E2EE3F8588FE3BB3E8FCCF83EE7E3F8368FE3263E8F2FF83EAEE3F8B28FE34A3E8FD0F83E35E3F8098FE30D3E8FC0F83E81E3F80B8FE3A83E8FB2F83E56E3F8228FE3643E8FCFF83E7AE3F8328FE3F73E8F0DF83E3FE3F8DA8FE3D23E8FA9F83E38E3F8658FE34E3E8F78F83E21E3F8408FE3A73E8F1FF83E02E3F87D8FE3753E8FD0F83E61E3F8318FE30A3E8FFAF83EDDE3F8AA8FE35A3E8FF8F83E2CE3F8DD8FE3F03E8FFEF83E89E3F89A8FE3213E8F89F83E25E3F8268FE3333E8F73F83E17E3F8538FE3193E8FE1F83E9DE3F8008FE35A3E8FF8F83E5BE3F8898FE3D93E8F8CF83E2EE3F8898FE3283E8F59F83E65E3F86B8FE3B83E8FB8F83E6DE3F8788FE33A3E8FB8F83ED8E3F8178FE36C3E8FC9F83EDDE3F8BB8FE3223E8FEEF83E6FE3F8208FE3FD3E8F40F83EDFE3F8348FE3373E8FDCF83E65E3F8A08FE3DA3E8F2FF83EDEE3F8F18FE3BB3E8F80F83E14E3F85A8FE3963E8F78F83E2FE3F8E28FE3843E8FC1F83EE4E3F8448FE3333E8F2BF83EA5E3F8508FE3C03E8FF4F83E66E3F8E38FE3113E8F26F83E16E3F8758FE35E3E8F45F83E20E3F8A78FE3223E8F02F83EDDE3F8168FE33A3E8F76F83EE6E3F8ED8FE3F83E8FF5F83E79E3F8198FE39D3E8FB1F83EE7E3F8578FE3463E8FECF83E70E3F8C68FE3273E8F57F83E41E3F84A8FE39A3E8F0DF83EC3E3F8F58FE3E43E8FF7F83E90E3F8938FE3423E8F8FF83E2DE3F8CE8FE3903E8FCAF83EE7E3F8238FE3D63E8F28F83E22E3F88B8FE3303E8F0AF83E62E3F8258FE3D13E8F35F83ECEE3F8B08FE3B63E8FE4F83EC5E3F8918FE3B83E8F3DF83E92E3F8748FE33C3E8FBFF83E78E3F8C28FE3D83E8F88F83E73E3F8F18FE3843E8F18F83EA3E3F8458FE3623E8F2BF83E6FE3F8A58FE3DF3E8FFDF83E0AE3F8EB8FE3003E8F3CF83EDFE3F8F78FE3C23E8F40F83E12E3F8058FE3B73E8FDEF83ED0E3F82E8FE3373E8FC1F83E15E3F8A98FE3A43E8F67F83E0DE3F8AD8FE30F3E8FCBF83E4BE3F8728FE3903E8F78F83E20E3F89D8FE39B3E8F49F83E13E3F8F68FE3C83E8FD6F83EECE3F8928FE3853E8F6FF83E33E3F8EF8FE3B43E8F3CF83E0EE3F8318FE3F83E8F19F83E7AE3F8178FE38D3E8FABF83E98E3F88B8FE3223E8FCEF83E3AE3F8258FE3E13E8FAAF83E74E3F88C8FE3C23E8FBBF83E94E3F8658FE3D83E8FA6F83EB2E3F8658FE3BD3E8FB9F83EF4E3F8248FE3613EB77EBB3EF5E3CD9CC9E3E43ECCC4D53EBFE3C94FBEE3513EA28FCC3EAAE3CD86BBE3943EB64FCD3E05E3CDA9A2E3813EB7F8C03E77E3BA1CCCE3443EB9CFC93EADE3BD38B7E3BD3E8FB0F83E91E3F8468FE3853E8F54F83E21E3F85E8FE3F33E8FADF83E8FE3F85E8FE3063E8F2CF83E34E3F8038FE3203E8F0FF83EB5E3F8F78FE37B3EFC6F8D3E6AE38AB2EBE33A3EDF79BD3E0AE3F8D98FE3FC3E8F57F83E27E3F85F8FE3BD3E8F43F83E21E3C2B4D3E32A3EFC7C9D3E65E38B68D3E3DF3EFA889A3EA1E39158ECE3D63EEC53CC3EB2E3C173EAE3EC3EB880CB3E0EE38E01DCE3543EE94B813E3BE3A4CBEAE30F3EC752D63E63E39408E3E3853E8F16F83E6FE3F8448FE3183E8F55F83E49E3F8A38FE3D23E8F2CF83E40E3F8528FE3153E8F3CF83EFFE3F8818FE3973E8F28F83EF6E3F8118FE3B93E8FD0F83E56E3F8D08FE3533E8F71F83E31E3F8E68FE3D03E8FDFF83E47E3F87F8FE3393E8F9BF83EEEE3F8A48FE3F63E8F41F83ECEE3F8F48FE3833E8FFCF83E78E3F8908FE3D63E8F0DF83E24E3F8B38FE34F3E8F4CF83E80E3F8588FE33D3E8F7CF83EB5E3F8728FE3AA3E8FCBF83EDEE3F88B8FE37D3E8F2CF83E12E3F8278FE3B43E8F8CF83EA5E3F8C98FE3A13E8F80F83E64E3F89E8FE35A3E8F79F83E5FE3F88E8FE3373E8F0CF83E53E3F8878FE3EF3E8F22F83E97E3F8C68FE3773E8F3BF83E18E3F84E8FE33F3E8F18F83EEAE3F8B88FE3E33E8F84F83E59E3F8858FE3973E8FAAF83EE5E3F8558FE3BA3E8FCEF83E01E3F8A28FE30A3E8F72F83EC5E3F81C8FE32D3E8FA6F83EEDE3F8988FE3C63E8F3FF83EC2E3F8578FE3EE3E8FFEF83EF5E3F8EF8FE3073E8FF5F83EB2E3F8BC8FE3CB3E8FE9F83E48E3F8F98FE3093E8F95F83E4AE3F8AB8FE3373E8F2AF83EBFE3F8DB8FE3613E8FC7F83EDAE3F8338FE3433E8FA0F83EFFE3F8578FE3A73E8F3CF83E43E3F8898FE3153E8FBDF83EE3E3F8ED8FE3AD3E8FBAF83E36E3F8238FE3983E8FECF83EC2E3F8168FE3ED3E8F39F83E48E3F8608FE3083E8F25F83E54E3F83F8FE3653E8FF8F83EAAE3F8B58FE3D73E8FE0F83E05E3F84E8FE3ED3E8FC7F83E97E3F8EE8FE3D53E8F0AF83E00E3F8138FE3C33E8F19F83EF2E3F8F78FE3FE3E8FCBF83E74E3F81A8FE3F83E8F09F83E9EE3F8F38FE3B53E8F85F83EFAE3F8B68FE30F3E8F45F83E26E3F8178FE34C3E8F6CF83E10E3F8658FE3DE3E8FDAF83E4BE3F8EB8FE3883E8F4AF83E94E3F8968FE3FF3E8FDBF83EDAE3F82C8FE31C3E8F45F83E1CE3F89E8FE3AA3E8F38F83EF4E3F8D98FE3683E8FB3F83E86E3F8C28FE3A13E8F7BF83E71E3F85E8FE3D43E8FA0F83EA3E3F8A78FE3703E8F60F83EB3E3F81F8FE3B23E8F66F83E73E3F80D8FE3FD3E8FD9F83E82E3F8AD8FE3F83E8F21F83E8BE3F8798FE3A83E8F1AF83E53E3F81E8FE3703E8FEBF83E24E3F8128FE3183E8FB4F83E23E3F8518FE3903E8FB7F83EBFE3F8EC8FE3A53E8F3DF83ED3E3F8F08FE3B53E8F74F83E5FE3F8208FE3623E8F4BF83ED6E3F8158FE31E3E8FA5F83EB9E3F82C8FE3383E8FAAF83EA7E3F88C8FE39B3E8FA9F83EBBE3F8CF8FE3A83E8F4FF83E35E3F82D8FE3D23E8FF8F83EDAE3F8658FE3303E8FEDF83E77E3F8D28FE34A3E8F78F83EA4E3F8758FE3D73E8F78F83EEAE3F8BF8FE3933E8FCFF83EDFE3F8108FE3533E8F74F83E64E3C2BFD3E3A53EFC369D3E90E38B10D3E3A93EFAA89A3E33E39185ECE39B3EECF6CC3E88E3C15CEAE3283EB8F4CB3EFFE38E90DCE33D3EE9F8813E66E3A4A58FE3C33EC7C0D63EFEE39408E3E3853E8FA2F83EC7E3F8588FE3863E8F95F83EC7E3F8138FE3993E8F97F83E85E3F85B8FE3D83E8FB8F83E79E3F81F8FE3363E8FB0F83E19E3F8FC8FE36E3E8F43F83EF4E3F82E8FE3FE3E8F03F83EFCE3F8DA8FE3D33E8FDCF83ED3E3F8378FE3DC3E8FB4F83EF0E3F8018FE3DC3E8F3EF83E3CE3F8148FE35A3E8F82F83E3DE3F8E38FE3A83E8F7FF83E5AE3F80D8FE3BC3E8FAEF83E07E3F8748FE3B93E8FB9F83E11E3F85A8FE3CC3E8F4DF83EAAE3F83D8FE3413E8F49F83E04E3F8EF8FE3843E8F3AF83E0FE3F8028FE3803E8FFFF83ECEE3F8378FE3AD3E8F96F83ED8E3F8CE8FE3E83E8FF7F83E9EE3F8158FE3703E8F67F83EA1E3F8EC8FE3EB3E8F02F83E35E3F8648FE3613E8F85F83EDEE3F87C8FE3C03E8F9EF83E80E3F8E18FE3433E8F86F83E29E3F8A38FE3A93E8FA5F83E5DE3F8C58FE30F3E8F45F83E48E3F8838FE32C3E8FF6F83EE1E3F8B88FE3963E8FAFF83E49E3F81B8FE3433E8F09F83EF4E3F8878FE3593E8F6AF83ECFE3F8808FE35E3E8F66F83EBFE3F8F18FE36B3E8F13F83E4DE3F8C28FE33A3E8FC8F83EC5E3F8F28FE3A53E8FD7F83E3CE3F84A8FE39E3E8F46F83E77E3F8768FE3A93E8FC2F83EE4E3F8FA8FE3C23E
(PID) Process:	(8024) F0j0RSKP40C.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Operation:	write	Name:	3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Value: 8FE3FC3E8F25F83EFFE3F85A8EE3C63E8D9DF83ED1E3F8E68FE3873E8F0AF83EEAE3F88B8FE3293E8F77F83E1BE3F8C78FE3313E8F66F83EBAE3F8768FE3363E8F97F83E79E3F8A08FE39F3E8F80F83E50E3F87F8FE36C3E8F46F83EF3E3F8BC8FE3B13E8FEAF83E6EE3F8598FE34A3E8FF0F83E41E3F8B48FE39B3E8FF0F83E79E3F8778FE30E3E8F62F83E5DE3F86D8FE3A23E8FD0F83EC6E3F8048FE3153E8F51F83E4EE3F85D8FE39A3E8FD4F83E94E3F8C78FE3EC3E8F8CF83E74E3F8FA8FE37E3E8F6AF83E04E3F8AF8FE34C3E8F04F83EB2E3F8408FE31D3E8FEAF83EAFE3F8F88FE3D53E8FCCF83E1BE3F8258FE3383E8FFFF83E80E3F8C28FE3FD3E8FC8F83E5CE3F8E38FE38A3E8F1FF83ECBE3F8208FE39A3E8FB8F83E8AE3F8638FE3263E8F18F83EB2E3F85B8FE3933E8F53F83E27E3F82A8FE3583E8F41F83EA6E3F8B58FE3963E8F54F83E48E3F8D58FE33C3E8F7AF83E96E3F8A48FE36C3E8F86F83E2CE3F8878FE30C3E8F83F83EDDE3F8588FE33A3E8FC2F83E01E3F8B98FE3FB3E8FCFF83E11E3F8A78FE34C3E8F1CF83E9FE3F85C8FE3863E8F7BF83E32E3F80B8FE32C3E8F22F83E06E3F8F18FE3653E8F70F83E81E3F8308FE3C33E8FF9F83E00E3F8D48FE35B3E8FABF83E53E3F8B18FE3D43E8F16F83E88E3F8948FE3763E8FCCF83EC9E3F8AA8FE33A3E8F2BF83E72E3F8E18FE3F93E8FE8F83EAEE3F8828FE36F3E8F73F83E4BE3F86C8FE3383E8FB1F83E01E3F8A48FE37A3E8F6EF83E73E3F8B78FE36F3E8FEBF83E6AE3F8508FE3213E8F32F83E01E3F8668FE3D43E8F47F83ED4E3F8008FE3633E8FACF83E4FE3F8468FE32F3E8FEAF83E16E3F8BF8FE3153E8F6EF83E3AE3F8668FE3903E8F5EF83EF1E3F8488FE38C3E8FE1F83E35E3F8738FE3893E8FDAF83E92E3F82E8FE3143E8F5BF83EF8E3F8CE8FE37B3E8F73F83E06E3F8198FE3073E8FCCF83E1CE3F8D28FE3FD3E8F22F83E9EE3F88B8FE32D3E8F20F83EBEE3F8AE8FE3023E8F58F83E2EE3F8588FE3BB3E8FCCF83EE7E3F8368FE3263E8F2FF83EAEE3F8B28FE34A3E8FD0F83E35E3F8098FE30D3E8FC0F83E81E3F80B8FE3A83E8FB2F83E56E3F8228FE3643E8FCFF83E7AE3F8328FE3F73E8F0DF83E3FE3F8DA8FE3D23E8FA9F83E38E3F8658FE34E3E8F78F83E21E3F8408FE3A73E8F1FF83E02E3F87D8FE3753E8FD0F83E61E3F8318FE30A3E8FFAF83EDDE3F8AA8FE35A3E8FF8F83E2CE3F8DD8FE3F03E8FFEF83E89E3F89A8FE3213E8F89F83E25E3F8268FE3333E8F73F83E17E3F8538FE3193E8FE1F83E9DE3F8008FE35A3E8FF8F83E5BE3F8898FE3D93E8F8CF83E2EE3F8898FE3283E8F59F83E65E3F86B8FE3B83E8FB8F83E6DE3F8788FE33A3E8FB8F83ED8E3F8178FE36C3E8FC9F83EDDE3F8BB8FE3223E8FEEF83E6FE3F8208FE3FD3E8F40F83EDFE3F8348FE3373E8FDCF83E65E3F8A08FE3DA3E8F2FF83EDEE3F8F18FE3BB3E8F80F83E14E3F85A8FE3963E8F78F83E2FE3F8E28FE3843E8FC1F83EE4E3F8448FE3333E8F2BF83EA5E3F8508FE3C03E8FF4F83E66E3F8E38FE3113E8F26F83E16E3F8758FE35E3E8F45F83E20E3F8A78FE3223E8F02F83EDDE3F8168FE33A3E8F76F83EE6E3F8ED8FE3F83E8FF5F83E79E3F8198FE39D3E8FB1F83EE7E3F8578FE3463E8FECF83E70E3F8C68FE3273E8F57F83E41E3F84A8FE39A3E8F0DF83EC3E3F8F58FE3E43E8FF7F83E90E3F8938FE3423E8F8FF83E2DE3F8CE8FE3903E8FCAF83EE7E3F8238FE3D63E8F28F83E22E3F88B8FE3303E8F0AF83E62E3F8258FE3D13E8F35F83ECEE3F8B08FE3B63E8FE4F83EC5E3F8918FE3B83E8F3DF83E92E3F8748FE33C3E8FBFF83E78E3F8C28FE3D83E8F88F83E73E3F8F18FE3843E8F18F83EA3E3F8458FE3623E8F2BF83E6FE3F8A58FE3DF3E8FFDF83E0AE3F8EB8FE3003E8F3CF83EDFE3F8F78FE3C23E8F40F83E12E3F8058FE3B73E8FDEF83ED0E3F82E8FE3373E8FC1F83E15E3F8A98FE3A43E8F67F83E0DE3F8AD8FE30F3E8FCBF83E4BE3F8728FE3903E8F78F83E20E3F89D8FE39B3E8F49F83E13E3F8F68FE3C83E8FD6F83EECE3F8928FE3853E8F6FF83E33E3F8EF8FE3B43E8F3CF83E0EE3F8318FE3F83E8F19F83E7AE3F8178FE38D3E8FABF83E98E3F88B8FE3223E8FCEF83E3AE3F8258FE3E13E8FAAF83E74E3F88C8FE3C23E8FBBF83E94E3F8658FE3D83E8FA6F83EB2E3F8658FE3BD3E8FB9F83EF4E3F8248FE3613EB77EBB3EF5E3CD9CC9E3E43ECCC4D53EBFE3C94FBEE3513EA28FCC3EAAE3CD86BBE3943EB64FCD3E05E3CDA9A2E3813EB7F8C03E77E3BA1CCCE3443EB9CFC93EADE3BD38B7E3BD3E8FB0F83E91E3F8468FE3853E8F54F83E21E3F85E8FE3F33E8FADF83E8FE3F85E8FE3063E8F2CF83E34E3F8038FE3203E8F0FF83EB5E3F8F78FE37B3EFC6F8D3E6AE38AB2EBE33A3EDF79BD3E0AE3F8D98FE3FC3E8F57F83E27E3F85F8FE3BD3E8F43F83E21E3C2B4D3E32A3EFC7C9D3E65E38B68D3E3DF3EFA889A3EA1E39158ECE3D63EEC53CC3EB2E3C173EAE3EC3EB880CB3E0EE38E01DCE3543EE94B813E3BE3A4CBEAE30F3EC752D63E63E39408E3E3853E8F16F83E6FE3F8448FE3183E8F55F83E49E3F8A38FE3D23E8F2CF83E40E3F8528FE3153E8F3CF83EFFE3F8818FE3973E8F28F83EF6E3F8118FE3B93E8FD0F83E56E3F8D08FE3533E8F71F83E31E3F8E68FE3D03E8FDFF83E47E3F87F8FE3393E8F9BF83EEEE3F8A48FE3F63E8F41F83ECEE3F8F48FE3833E8FFCF83E78E3F8908FE3D63E8F0DF83E24E3F8B38FE34F3E8F4CF83E80E3F8588FE33D3E8F7CF83EB5E3F8728FE3AA3E8FCBF83EDEE3F88B8FE37D3E8F2CF83E12E3F8278FE3B43E8F8CF83EA5E3F8C98FE3A13E8F80F83E64E3F89E8FE35A3E8F79F83E5FE3F88E8FE3373E8F0CF83E53E3F8878FE3EF3E8F22F83E97E3F8C68FE3773E8F3BF83E18E3F84E8FE33F3E8F18F83EEAE3F8B88FE3E33E8F84F83E59E3F8858FE3973E8FAAF83EE5E3F8558FE3BA3E8FCEF83E01E3F8A28FE30A3E8F72F83EC5E3F81C8FE32D3E8FA6F83EEDE3F8988FE3C63E8F3FF83EC2E3F8578FE3EE3E8FFEF83EF5E3F8EF8FE3073E8FF5F83EB2E3F8BC8FE3CB3E8FE9F83E48E3F8F98FE3093E8F95F83E4AE3F8AB8FE3373E8F2AF83EBFE3F8DB8FE3613E8FC7F83EDAE3F8338FE3433E8FA0F83EFFE3F8578FE3A73E8F3CF83E43E3F8898FE3153E8FBDF83EE3E3F8ED8FE3AD3E8FBAF83E36E3F8238FE3983E8FECF83EC2E3F8168FE3ED3E8F39F83E48E3F8608FE3083E8F25F83E54E3F83F8FE3653E8FF8F83EAAE3F8B58FE3D73E8FE0F83E05E3F84E8FE3ED3E8FC7F83E97E3F8EE8FE3D53E8F0AF83E00E3F8138FE3C33E8F19F83EF2E3F8F78FE3FE3E8FCBF83E74E3F81A8FE3F83E8F09F83E9EE3F8F38FE3B53E8F85F83EFAE3F8B68FE30F3E8F45F83E26E3F8178FE34C3E8F6CF83E10E3F8658FE3DE3E8FDAF83E4BE3F8EB8FE3883E8F4AF83E94E3F8968FE3FF3E8FDBF83EDAE3F82C8FE31C3E8F45F83E1CE3F89E8FE3AA3E8F38F83EF4E3F8D98FE3683E8FB3F83E86E3F8C28FE3A13E8F7BF83E71E3F85E8FE3D43E8FA0F83EA3E3F8A78FE3703E8F60F83EB3E3F81F8FE3B23E8F66F83E73E3F80D8FE3FD3E8FD9F83E82E3F8AD8FE3F83E8F21F83E8BE3F8798FE3A83E8F1AF83E53E3F81E8FE3703E8FEBF83E24E3F8128FE3183E8FB4F83E23E3F8518FE3903E8FB7F83EBFE3F8EC8FE3A53E8F3DF83ED3E3F8F08FE3B53E8F74F83E5FE3F8208FE3623E8F4BF83ED6E3F8158FE31E3E8FA5F83EB9E3F82C8FE3383E8FAAF83EA7E3F88C8FE39B3E8FA9F83EBBE3F8CF8FE3A83E8F4FF83E35E3F82D8FE3D23E8FF8F83EDAE3F8658FE3303E8FEDF83E77E3F8D28FE34A3E8F78F83EA4E3F8758FE3D73E8F78F83EEAE3F8BF8FE3933E8FCFF83EDFE3F8108FE3533E8F74F83E64E3C2BFD3E3A53EFC369D3E90E38B10D3E3A93EFAA89A3E33E39185ECE39B3EECF6CC3E88E3C15CEAE3283EB8F4CB3EFFE38E90DCE33D3EE9F8813E66E3A4A58FE3C33EC7C0D63EFEE39408E3E3853E8FA2F83EC7E3F8588FE3863E8F95F83EC7E3F8138FE3993E8F97F83E85E3F85B8FE3D83E8FB8F83E79E3F81F8FE3363E8FB0F83E19E3F8FC8FE36E3E8F43F83EF4E3F82E8FE3FE3E8F03F83EFCE3F8DA8FE3D33E8FDCF83ED3E3F8378FE3DC3E8FB4F83EF0E3F8018FE3DC3E8F3EF83E3CE3F8148FE35A3E8F82F83E3DE3F8E38FE3A83E8F7FF83E5AE3F80D8FE3BC3E8FAEF83E07E3F8748FE3B93E8FB9F83E11E3F85A8FE3CC3E8F4DF83EAAE3F83D8FE3413E8F49F83E04E3F8EF8FE3843E8F3AF83E0FE3F8028FE3803E8FFFF83ECEE3F8378FE3AD3E8F96F83ED8E3F8CE8FE3E83E8FF7F83E9EE3F8158FE3703E8F67F83EA1E3F8EC8FE3EB3E8F02F83E35E3F8648FE3613E8F85F83EDEE3F87C8FE3C03E8F9EF83E80E3F8E18FE3433E8F86F83E29E3F8A38FE3A93E8FA5F83E5DE3F8C58FE30F3E8F45F83E48E3F8838FE32C3E8FF6F83EE1E3F8B88FE3963E8FAFF83E49E3F81B8FE3433E8F09F83EF4E3F8878FE3593E8F6AF83ECFE3F8808FE35E3E8F66F83EBFE3F8F18FE36B3E8F13F83E4DE3F8C28FE33A3E8FC8F83EC5E3F8F28FE3A53E8FD7F83E3CE3F84A8FE39E3E8F46F83E77E3F8768FE3A93E8FC2F83EE4E3F8FA8FE3C23E
(PID) Process:	(8024) F0j0RSKP40C.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Operation:	write	Name:	3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Value: 8FE3FC3E8E25F83EFFE3F85A8EE3C63E8D9DF83ED1E3F8E68FE3873E8F0AF83EA9E3C28BD3E37C3EFC779D3E69E38BC7D3E3613EFA669A3ED6E39176ECE36A3EEC97CC3E1AE3C1A0EAE3FC3EB880CB3E0CE38E7FDCE31A3EE946813E84E3A4BCC9E3813EE5EAC83E3CE3AB59C4E31A3EBBF0C83E02E3D6B4EAE3E33EEAF0F83E79E3F8778FE30E3E8F62F83E5DE3F86D8FE3A23E8FD0F83EC6E3F8048FE3153E8F51F83E4EE3F85D8FE39A3E8FD4F83E94E3F8C78FE3EC3E8F8CF83E74E3F8FA8FE37E3E8F6AF83E04E3F8AF8FE34C3E8F04F83EB2E3F8408FE31D3E8FEAF83EAFE3F8F88FE3D53E8FCCF83E1BE3F8258FE3383E8FFFF83E80E3F8C28FE3FD3E8FC8F83E5CE3F8E38FE38A3E8F1FF83ECBE3F8208FE39A3E8FB8F83E8AE3F8638FE3263E8F18F83EB2E3F85B8FE3933E8F53F83E27E3F82A8FE3583E8F41F83EA6E3F8B58FE3963E8F54F83E48E3F8D58FE33C3E8F7AF83E96E3F8A48FE36C3E8F86F83E2CE3F8878FE30C3E8F83F83EDDE3F8588FE33A3E8FC2F83E01E3F8B98FE3FB3E8FCFF83E11E3F8A78FE34C3E8F1CF83E9FE3F85C8FE3863E8F7BF83E32E3F80B8FE32C3E8F22F83E06E3F8F18FE3653E8F70F83E81E3F8308FE3C33E8FF9F83E00E3F8D48FE35B3E8FABF83E53E3F8B18FE3D43E8F16F83E88E3F8948FE3763E8FCCF83EC9E3F8AA8FE33A3E8F2BF83E72E3F8E18FE3F93E8FE8F83EAEE3F8828FE36F3E8F73F83E4BE3F86C8FE3383E8FB1F83E01E3F8A48FE37A3E8F6EF83E73E3F8B78FE3293EBFEB923E5AE3AA50DCE36A3EDF32CC3E31E3BB66A1E3B13EF7479D3ED4E3F8008FE3633E8FACF83E4FE3F8468FE32F3E8FEAF83E16E3F8BF8FE3153E8F6EF83E3AE3F8668FE3903E8F5EF83EF1E3F8488FE38C3E8FE1F83E35E3F8738FE3893E8FDAF83E92E3F82E8FE3143E8F5BF83EF8E3F8CE8FE37B3E8F73F83E06E3F8198FE3073E8FCCF83E1CE3F8D28FE3FD3E8F22F83E9EE3F88B8FE32D3E8F20F83EBEE3F8AE8FE3023E8F58F83E2EE3F8588FE3BB3E8FCCF83EE7E3F8368FE3263E8F2FF83EAEE3F8B28FE34A3E8FD0F83E35E3F8098FE30D3E8FC0F83E81E3F80B8FE3A83E8FB2F83E56E3F8228FE3643E8FCFF83E7AE3F8328FE3F73E8F0DF83E3FE3F8DA8FE3D23E8FA9F83E38E3F8658FE34E3E8F78F83E21E3F8408FE3A73E8F1FF83E02E3F87D8FE3753E8FD0F83E61E3F8318FE30A3E8FFAF83EDDE3F8AA8FE35A3E8FF8F83E2CE3F8DD8FE3F03E8FFEF83E89E3F89A8FE3213E8F89F83E25E3F8268FE3333E8F73F83E17E3F8538FE3193E8FE1F83E9DE3F8008FE35A3E8FF8F83E5BE3F8898FE3D93E8F8CF83E2EE3F8898FE3283E8F59F83E65E3F86B8FE3B83E8FB8F83E6DE3F8788FE33A3E8FB8F83ED8E3F8178FE36C3E8FC9F83EDDE3F8BB8FE3223E8FEEF83E6FE3F8208FE3FD3E8F40F83EDFE3F8348FE3373E8FDCF83E65E3F8A08FE3DA3E8F2FF83EDEE3F8F18FE3BB3E8F80F83E14E3F85A8FE3963E8F78F83E6CE3C2E2D3E3D13EFCC19D3E96E38B44D3E3633EFA2B9A3EC9E39150ECE39C3EECF4CC3E05E3C1E3EAE3723EB826CB3E4AE38E75DCE3283EE945813E57E3A4A78FE3123EE502C83E8FE3AB16C4E36A3EBB76C83EA5E3D6EDEAE3803EEAF5F83E79E3F8198FE39D3E8FB1F83EE7E3F8578FE3463E8FECF83E70E3F8C68FE3273E8F57F83E41E3F84A8FE39A3E8F0DF83EC3E3F8F58FE3E43E8FF7F83E90E3F8938FE3423E8F8FF83E2DE3F8CE8FE3903E8FCAF83EE7E3F8238FE3D63E8F28F83E22E3F88B8FE3303E8F0AF83E62E3F8258FE3D13E8F35F83ECEE3F8B08FE3B63E8FE4F83EC5E3F8918FE3B83E8F3DF83E92E3F8748FE33C3E8FBFF83E78E3F8C28FE3D83E8F88F83E73E3F8F18FE3843E8F18F83EA3E3F8458FE3623E8F2BF83E6FE3F8A58FE3DF3E8FFDF83E0AE3F8EB8FE3003E8F3CF83EDFE3F8F78FE3C23E8F40F83E12E3F8058FE3B73E8FDEF83ED0E3F82E8FE3373E8FC1F83E15E3F8A98FE3A43E8F67F83E0DE3F8AD8FE30F3E8FCBF83E4BE3F8728FE3903E8F78F83E20E3F89D8FE39B3E8F49F83E13E3F8F68FE3C83E8FD6F83EECE3F8928FE3853E8F6FF83E33E3F8EF8FE3B43E8F3CF83E0EE3F8318FE3F83E8F19F83E7AE3F8178FE38D3E8FABF83E98E3F88B8FE3223E8FCEF83E3AE3F8258FE3E13E8FAAF83E74E3F88C8FE3C23E8FBBF83E94E3F8658FE3D83E8FA6F83EB2E3F8658FE3BD3E8FB9F83EF4E3F8248FE3613EB77EBB3EF5E3CD9CC9E3E43ECCC4D53EBFE3C94FBEE3513EA28FCC3EAAE3CD86BBE3943EB64FCD3E05E3CDA9A2E3813EB7F8C03E77E3BA1CCCE3443EB9CFC93EADE3BD38B7E3BD3E8FB0F83E91E3F8468FE3853E8F54F83E21E3F85E8FE3F33E8FADF83E8FE3F85E8FE3063E8F2CF83E34E3F8038FE3203E8F0FF83EB5E3F8F78FE37B3EFC6F8D3E6AE38AB2EBE33A3EDF79BD3E0AE3F8D98FE3FC3E8F57F83E27E3F85F8FE3BD3E8F43F83E21E3C2B4D3E32A3EFC7C9D3E65E38B68D3E3DF3EFA889A3EA1E39158ECE3D63EEC53CC3EB2E3C173EAE3EC3EB880CB3E0EE38E01DCE3543EE94B813E3BE3A4CBEAE30F3EC752D63E63E39408E3E3853E8F16F83E6FE3F8448FE3183E8F55F83E49E3F8A38FE3D23E8F2CF83E40E3F8528FE3153E8F3CF83EFFE3F8818FE3973E8F28F83EF6E3F8118FE3B93E8FD0F83E56E3F8D08FE3533E8F71F83E31E3F8E68FE3D03E8FDFF83E47E3F87F8FE3393E8F9BF83EEEE3F8A48FE3F63E8F41F83ECEE3F8F48FE3833E8FFCF83E78E3F8908FE3D63E8F0DF83E24E3F8B38FE34F3E8F4CF83E80E3F8588FE33D3E8F7CF83EB5E3F8728FE3AA3E8FCBF83EDEE3F88B8FE37D3E8F2CF83E12E3F8278FE3B43E8F8CF83EA5E3F8C98FE3A13E8F80F83E64E3F89E8FE35A3E8F79F83E5FE3F88E8FE3373E8F0CF83E53E3F8878FE3EF3E8F22F83E97E3F8C68FE3773E8F3BF83E18E3F84E8FE33F3E8F18F83EEAE3F8B88FE3E33E8F84F83E59E3F8858FE3973E8FAAF83EE5E3F8558FE3BA3E8FCEF83E01E3F8A28FE30A3E8F72F83EC5E3F81C8FE32D3E8FA6F83EEDE3F8988FE3C63E8F3FF83EC2E3F8578FE3EE3E8FFEF83EF5E3F8EF8FE3073E8FF5F83EB2E3F8BC8FE3CB3E8FE9F83E48E3F8F98FE3093E8F95F83E4AE3F8AB8FE3373E8F2AF83EBFE3F8DB8FE3613E8FC7F83EDAE3F8338FE3433E8FA0F83EFFE3F8578FE3A73E8F3CF83E43E3F8898FE3153E8FBDF83EE3E3F8ED8FE3AD3E8FBAF83E36E3F8238FE3983E8FECF83EC2E3F8168FE3ED3E8F39F83E48E3F8608FE3083E8F25F83E54E3F83F8FE3653E8FF8F83EAAE3F8B58FE3D73E8FE0F83E05E3F84E8FE3ED3E8FC7F83E97E3F8EE8FE3D53E8F0AF83E00E3F8138FE3C33E8F19F83EF2E3F8F78FE3FE3E8FCBF83E74E3F81A8FE3F83E8F09F83E9EE3F8F38FE3B53E8F85F83EFAE3F8B68FE30F3E8F45F83E26E3F8178FE34C3E8F6CF83E10E3F8658FE3DE3E8FDAF83E4BE3F8EB8FE3883E8F4AF83E94E3F8968FE3FF3E8FDBF83EDAE3F82C8FE31C3E8F45F83E1CE3F89E8FE3AA3E8F38F83EF4E3F8D98FE3683E8FB3F83E86E3F8C28FE3A13E8F7BF83E71E3F85E8FE3D43E8FA0F83EA3E3F8A78FE3703E8F60F83EB3E3F81F8FE3B23E8F66F83E73E3F80D8FE3FD3E8FD9F83E82E3F8AD8FE3F83E8F21F83E8BE3F8798FE3A83E8F1AF83E53E3F81E8FE3703E8FEBF83E24E3F8128FE3183E8FB4F83E23E3F8518FE3903E8FB7F83EBFE3F8EC8FE3A53E8F3DF83ED3E3F8F08FE3B53E8F74F83E5FE3F8208FE3623E8F4BF83ED6E3F8158FE31E3E8FA5F83EB9E3F82C8FE3383E8FAAF83EA7E3F88C8FE39B3E8FA9F83EBBE3F8CF8FE3A83E8F4FF83E35E3F82D8FE3D23E8FF8F83EDAE3F8658FE3303E8FEDF83E77E3F8D28FE34A3E8F78F83EA4E3F8758FE3D73E8F78F83EEAE3F8BF8FE3933E8FCFF83EDFE3F8108FE3533E8F74F83E64E3C2BFD3E3A53EFC369D3E90E38B10D3E3A93EFAA89A3E33E39185ECE39B3EECF6CC3E88E3C15CEAE3283EB8F4CB3EFFE38E90DCE33D3EE9F8813E66E3A4A58FE3C33EC7C0D63EFEE39408E3E3853E8FA2F83EC7E3F8588FE3863E8F95F83EC7E3F8138FE3993E8F97F83E85E3F85B8FE3D83E8FB8F83E79E3F81F8FE3363E8FB0F83E19E3F8FC8FE36E3E8F43F83EF4E3F82E8FE3FE3E8F03F83EFCE3F8DA8FE3D33E8FDCF83ED3E3F8378FE3DC3E8FB4F83EF0E3F8018FE3DC3E8F3EF83E3CE3F8148FE35A3E8F82F83E3DE3F8E38FE3A83E8F7FF83E5AE3F80D8FE3BC3E8FAEF83E07E3F8748FE3B93E8FB9F83E11E3F85A8FE3CC3E8F4DF83EAAE3F83D8FE3413E8F49F83E04E3F8EF8FE3843E8F3AF83E0FE3F8028FE3803E8FFFF83ECEE3F8378FE3AD3E8F96F83ED8E3F8CE8FE3E83E8FF7F83E9EE3F8158FE3703E8F67F83EA1E3F8EC8FE3EB3E8F02F83E35E3F8648FE3613E8F85F83EDEE3F87C8FE3C03E8F9EF83E80E3F8E18FE3433E8F86F83E29E3F8A38FE3A93E8FA5F83E5DE3F8C58FE30F3E8F45F83E48E3F8838FE32C3E8FF6F83EE1E3F8B88FE3963E8FAFF83E49E3F81B8FE3433E8F09F83EF4E3F8878FE3593E8F6AF83ECFE3F8808FE35E3E8F66F83EBFE3F8F18FE36B3E8F13F83E4DE3F8C28FE33A3E8FC8F83EC5E3F8F28FE3A53E8FD7F83E3CE3F84A8FE39E3E8F46F83E77E3F8768FE3A93E8FC2F83EE4E3F8FA8FE3C23E
(PID) Process:	(6876) WmiApSrv.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance
Operation:	write	Name:	Performance Refreshed
Value: 0
(PID) Process:	(6876) WmiApSrv.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Operation:	write	Name:	3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Value: 8FE3FC3E8E25F83EFFE3F85A8EE3C63E8D9DF83ED1E3F8E68FE3873E8F0AF83EA9E3C28BD3E37C3EFC779D3E69E38BC7D3E3613EFA669A3ED6E39176ECE36A3EEC97CC3E1AE3C1A0EAE3FC3EB880CB3E0CE38E7FDCE31A3EE946813E84E3A4BCC9E3813EE5EAC83E3CE3AB59C4E31A3EBBF0C83E02E3D6B4EAE3E33EEAF0F83E79E3F8778FE30E3E8F62F83E5DE3F86D8FE3A23E8FD0F83EC6E3F8048FE3153E8F51F83E4EE3F85D8FE39A3E8FD4F83E94E3F8C78FE3EC3E8F8CF83E74E3F8FA8FE37E3E8F6AF83E04E3F8AF8FE34C3E8F04F83EB2E3F8408FE31D3E8FEAF83EAFE3F8F88FE3D53E8FCCF83E1BE3F8258FE3383E8FFFF83E80E3F8C28FE3FD3E8FC8F83E5CE3F8E38FE38A3E8F1FF83ECBE3F8208FE39A3E8FB8F83E8AE3F8638FE3263E8F18F83EB2E3F85B8FE3933E8F53F83E27E3F82A8FE3583E8F41F83EA6E3F8B58FE3963E8F54F83E48E3F8D58FE33C3E8F7AF83E96E3F8A48FE36C3E8F86F83E2CE3F8878FE30C3E8F83F83EDDE3F8588FE33A3E8FC2F83E01E3F8B98FE3FB3E8FCFF83E11E3F8A78FE34C3E8F1CF83E9FE3F85C8FE3863E8F7BF83E32E3F80B8FE32C3E8F22F83E06E3F8F18FE3653E8F70F83E81E3F8308FE3C33E8FF9F83E00E3F8D48FE35B3E8FABF83E53E3F8B18FE3D43E8F16F83E88E3F8948FE3763E8FCCF83EC9E3F8AA8FE33A3E8F2BF83E72E3F8E18FE3F93E8FE8F83EAEE3F8828FE36F3E8F73F83E4BE3F86C8FE3383E8FB1F83E01E3F8A48FE37A3E8F6EF83E73E3F8B78FE3293EBFEB923E5AE3AA50DCE36A3EDF32CC3E31E3BB66A1E3B13EF7479D3ED4E3F8008FE3633E8FACF83E4FE3F8468FE32F3E8FEAF83E16E3F8BF8FE3153E8F6EF83E3AE3F8668FE3903E8F5EF83EF1E3F8488FE38C3E8FE1F83E35E3F8738FE3893E8FDAF83E92E3F82E8FE3143E8F5BF83EF8E3F8CE8FE37B3E8F73F83E06E3F8198FE3073E8FCCF83E1CE3F8D28FE3FD3E8F22F83E9EE3F88B8FE32D3E8F20F83EBEE3F8AE8FE3023E8F58F83E2EE3F8588FE3BB3E8FCCF83EE7E3F8368FE3263E8F2FF83EAEE3F8B28FE34A3E8FD0F83E35E3F8098FE30D3E8FC0F83E81E3F80B8FE3A83E8FB2F83E56E3F8228FE3643E8FCFF83E7AE3F8328FE3F73E8F0DF83E3FE3F8DA8FE3D23E8FA9F83E38E3F8658FE34E3E8F78F83E21E3F8408FE3A73E8F1FF83E02E3F87D8FE3753E8FD0F83E61E3F8318FE30A3E8FFAF83EDDE3F8AA8FE35A3E8FF8F83E2CE3F8DD8FE3F03E8FFEF83E89E3F89A8FE3213E8F89F83E25E3F8268FE3333E8F73F83E17E3F8538FE3193E8FE1F83E9DE3F8008FE35A3E8FF8F83E5BE3F8898FE3D93E8F8CF83E2EE3F8898FE3283E8F59F83E65E3F86B8FE3B83E8FB8F83E6DE3F8788FE33A3E8FB8F83ED8E3F8178FE36C3E8FC9F83EDDE3F8BB8FE3223E8FEEF83E6FE3F8208FE3FD3E8F40F83EDFE3F8348FE3373E8FDCF83E65E3F8A08FE3DA3E8F2FF83EDEE3F8F18FE3BB3E8F80F83E14E3F85A8FE3963E8F78F83E6CE3C2E2D3E3D13EFCC19D3E96E38B44D3E3633EFA2B9A3EC9E39150ECE39C3EECF4CC3E05E3C1E3EAE3723EB826CB3E4AE38E75DCE3283EE945813E57E3A4A78FE3123EE502C83E8FE3AB16C4E36A3EBB76C83EA5E3D6EDEAE3803EEAF5F83E79E3F8198FE39D3E8FB1F83EE7E3F8578FE3463E8FECF83E70E3F8C68FE3273E8F57F83E41E3F84A8FE39A3E8F0DF83EC3E3F8F58FE3E43E8FF7F83E90E3F8938FE3423E8F8FF83E2DE3F8CE8FE3903E8FCAF83EE7E3F8238FE3D63E8F28F83E22E3F88B8FE3303E8F0AF83E62E3F8258FE3D13E8F35F83ECEE3F8B08FE3B63E8FE4F83EC5E3F8918FE3B83E8F3DF83E92E3F8748FE33C3E8FBFF83E78E3F8C28FE3D83E8F88F83E73E3F8F18FE3843E8F18F83EA3E3F8458FE3623E8F2BF83E6FE3F8A58FE3DF3E8FFDF83E0AE3F8EB8FE3003E8F3CF83EDFE3F8F78FE3C23E8F40F83E12E3F8058FE3B73E8FDEF83ED0E3F82E8FE3373E8FC1F83E15E3F8A98FE3A43E8F67F83E0DE3F8AD8FE30F3E8FCBF83E4BE3F8728FE3903E8F78F83E20E3F89D8FE39B3E8F49F83E13E3F8F68FE3C83E8FD6F83EECE3F8928FE3853E8F6FF83E33E3F8EF8FE3B43E8F3CF83E0EE3F8318FE3F83E8F19F83E7AE3F8178FE38D3E8FABF83E98E3F88B8FE3223E8FCEF83E3AE3F8258FE3E13E8FAAF83E74E3F88C8FE3C23E8FBBF83E94E3F8658FE3D83E8FA6F83EB2E3F8658FE3BD3E8FB9F83EF4E3F8248FE3613EB77EBB3EF5E3CD9CC9E3E43ECCC4D53EBFE3C94FBEE3513EA28FCC3EAAE3CD86BBE3943EB64FCD3E05E3CDA9A2E3813EB7F8C03E77E3BA1CCCE3443EB9CFC93EADE3BD38B7E3BD3E8FB0F83E91E3F8468FE3853E8F54F83E21E3F85E8FE3F33E8FADF83E8FE3F85E8FE3063E8F2CF83E34E3F8038FE3203E8F0FF83EB5E3F8F78FE37B3EFC6F8D3E6AE38AB2EBE33A3EDF79BD3E0AE3F8D98FE3FC3E8F57F83E27E3F85F8FE3BD3E8F43F83E21E3C2B4D3E32A3EFC7C9D3E65E38B68D3E3DF3EFA889A3EA1E39158ECE3D63EEC53CC3EB2E3C173EAE3EC3EB880CB3E0EE38E01DCE3543EE94B813E3BE3A4CBEAE30F3EC752D63E63E39408E3E3853E8F16F83E6FE3F8448FE3183E8F55F83E49E3F8A38FE3D23E8F2CF83E40E3F8528FE3153E8F3CF83EFFE3F8818FE3973E8F28F83EF6E3F8118FE3B93E8FD0F83E56E3F8D08FE3533E8F71F83E31E3F8E68FE3D03E8FDFF83E47E3F87F8FE3393E8F9BF83EEEE3F8A48FE3F63E8F41F83ECEE3F8F48FE3833E8FFCF83E78E3F8908FE3D63E8F0DF83E24E3F8B38FE34F3E8F4CF83E80E3F8588FE33D3E8F7CF83EB5E3F8728FE3AA3E8FCBF83EDEE3F88B8FE37D3E8F2CF83E12E3F8278FE3B43E8F8CF83EA5E3F8C98FE3A13E8F80F83E64E3F89E8FE35A3E8F79F83E5FE3F88E8FE3373E8F0CF83E53E3F8878FE3EF3E8F22F83E97E3F8C68FE3773E8F3BF83E18E3F84E8FE33F3E8F18F83EEAE3F8B88FE3E33E8F84F83E59E3F8858FE3973E8FAAF83EE5E3F8558FE3BA3E8FCEF83E01E3F8A28FE30A3E8F72F83EC5E3F81C8FE32D3E8FA6F83EEDE3F8988FE3C63E8F3FF83EC2E3F8578FE3EE3E8FFEF83EF5E3F8EF8FE3073E8FF5F83EB2E3F8BC8FE3CB3E8FE9F83E48E3F8F98FE3093E8F95F83E4AE3F8AB8FE3373E8F2AF83EBFE3F8DB8FE3613E8FC7F83EDAE3F8338FE3433E8FA0F83EFFE3F8578FE3A73E8F3CF83E43E3F8898FE3153E8FBDF83EE3E3F8ED8FE3AD3E8FBAF83E36E3F8238FE3983E8FECF83EC2E3F8168FE3ED3E8F39F83E48E3F8608FE3083E8F25F83E54E3F83F8FE3653E8FF8F83EAAE3F8B58FE3D73E8FE0F83E05E3F84E8FE3ED3E8FC7F83E97E3F8EE8FE3D53E8F0AF83E00E3F8138FE3C33E8F19F83EF2E3F8F78FE3FE3E8FCBF83E74E3F81A8FE3F83E8F09F83E9EE3F8F38FE3B53E8F85F83EFAE3F8B68FE30F3E8F45F83E26E3F8178FE34C3E8F6CF83E10E3F8658FE3DE3E8FDAF83E4BE3F8EB8FE3883E8F4AF83E94E3F8968FE3FF3E8FDBF83EDAE3F82C8FE31C3E8F45F83E1CE3F89E8FE3AA3E8F38F83EF4E3F8D98FE3683E8FB3F83E86E3F8C28FE3A13E8F7BF83E71E3F85E8FE3D43E8FA0F83EA3E3F8A78FE3703E8F60F83EB3E3F81F8FE3B23E8F66F83E73E3F80D8FE3FD3E8FD9F83E82E3F8AD8FE3F83E8F21F83E8BE3F8798FE3A83E8F1AF83E53E3F81E8FE3703E8FEBF83E24E3F8128FE3183E8FB4F83E23E3F8518FE3903E8FB7F83EBFE3F8EC8FE3A53E8F3DF83ED3E3F8F08FE3B53E8F74F83E5FE3F8208FE3623E8F4BF83ED6E3F8158FE31E3E8FA5F83EB9E3F82C8FE3383E8FAAF83EA7E3F88C8FE39B3E8FA9F83EBBE3F8CF8FE3A83E8F4FF83E35E3F82D8FE3D23E8FF8F83EDAE3F8658FE3303E8FEDF83E77E3F8D28FE34A3E8F78F83EA4E3F8758FE3D73E8F78F83EEAE3F8BF8FE3933E8FCFF83EDFE3F8108FE3533E8F74F83E64E3C2BFD3E3A53EFC369D3E90E38B10D3E3A93EFAA89A3E33E39185ECE39B3EECF6CC3E88E3C15CEAE3283EB8F4CB3EFFE38E90DCE33D3EE9F8813E66E3A4A58FE3C33EC7C0D63EFEE39408E3E3853E8FA2F83EC7E3F8588FE3863E8F95F83EC7E3F8138FE3993E8F97F83E85E3F85B8FE3D83E8FB8F83E79E3F81F8FE3363E8FB0F83E19E3F8FC8FE36E3E8F43F83EF4E3F82E8FE3FE3E8F03F83EFCE3F8DA8FE3D33E8FDCF83ED3E3F8378FE3DC3E8FB4F83EF0E3F8018FE3DC3E8F3EF83E3CE3F8148FE35A3E8F82F83E3DE3F8E38FE3A83E8F7FF83E5AE3F80D8FE3BC3E8FAEF83E07E3F8748FE3B93E8FB9F83E11E3F85A8FE3CC3E8F4DF83EAAE3F83D8FE3413E8F49F83E04E3F8EF8FE3843E8F3AF83E0FE3F8028FE3803E8FFFF83ECEE3F8378FE3AD3E8F96F83ED8E3F8CE8FE3E83E8FF7F83E9EE3F8158FE3703E8F67F83EA1E3F8EC8FE3EB3E8F02F83E35E3F8648FE3613E8F85F83EDEE3F87C8FE3C03E8F9EF83E80E3F8E18FE3433E8F86F83E29E3F8A38FE3A93E8FA5F83E5DE3F8C58FE30F3E8F45F83E48E3F8838FE32C3E8FF6F83EE1E3F8B88FE3963E8FAFF83E49E3F81B8FE3433E8F09F83EF4E3F8878FE3593E8F6AF83ECFE3F8808FE35E3E8F66F83EBFE3F8F18FE36B3E8F13F83E4DE3F8C28FE33A3E8FC8F83EC5E3F8F28FE3A53E8FD7F83E3CE3F84A8FE39E3E8F46F83E77E3F8768FE3A93E8FC2F83EE4E3F8FA8FE3C23E
(PID) Process:	(6876) WmiApSrv.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Operation:	write	Name:	3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Value: 8FE3FC3E8F25F83EFEE3F85A8EE3C63E8D9DF83ED1E3F8E68DE3873E8F0AF83EA9E3C28BD3E37C3EFC779D3E69E38BC7D3E3613EFA669A3ED6E39176ECE36A3EEC97CC3E1AE3C1A0EAE3FC3EB880CB3E0CE38E7FDCE31A3EE946813E84E3A4BCC9E3813EE5EAC83E3CE3AB59C4E31A3EBBF0C83E02E3D6B4EAE3E33EEAF0F83E79E3F8778FE30E3E8F62F83E5DE3F86D8FE3A23E8FD0F83EC6E3F8048FE3153E8F51F83E4EE3F85D8FE39A3E8FD4F83E94E3F8C78FE3EC3E8F8CF83E74E3F8FA8FE37E3E8F6AF83E04E3F8AF8FE34C3E8F04F83EB2E3F8408FE31D3E8FEAF83EAFE3F8F88FE3D53E8FCCF83E1BE3F8258FE3383E8FFFF83E80E3F8C28FE3FD3E8FC8F83E5CE3F8E38FE38A3E8F1FF83ECBE3F8208FE39A3E8FB8F83E8AE3F8638FE3263E8F18F83EB2E3F85B8FE3933E8F53F83E27E3F82A8FE3583E8F41F83EA6E3F8B58FE3963E8F54F83E48E3F8D58FE33C3E8F7AF83E96E3F8A48FE36C3E8F86F83E2CE3F8878FE30C3E8F83F83EDDE3F8588FE33A3E8FC2F83E01E3F8B98FE3FB3E8FCFF83E11E3F8A78FE34C3E8F1CF83E9FE3F85C8FE3863E8F7BF83E32E3F80B8FE32C3E8F22F83E06E3F8F18FE3653E8F70F83E81E3F8308FE3C33E8FF9F83E00E3F8D48FE35B3E8FABF83E53E3F8B18FE3D43E8F16F83E88E3F8948FE3763E8FCCF83EC9E3F8AA8FE33A3E8F2BF83E72E3F8E18FE3F93E8FE8F83EAEE3F8828FE36F3E8F73F83E4BE3F86C8FE3383E8FB1F83E01E3F8A48FE37A3E8F6EF83E73E3F8B78FE3293EBFEB923E5AE3AA50DCE36A3EDF32CC3E31E3BB66A1E3B13EF7479D3ED4E3F8008FE3633E8FACF83E4FE3F8468FE32F3E8FEAF83E16E3F8BF8FE3153E8F6EF83E3AE3F8668FE3903E8F5EF83EF1E3F8488FE38C3E8FE1F83E35E3F8738FE3893E8FDAF83E92E3F82E8FE3143E8F5BF83EF8E3F8CE8FE37B3E8F73F83E06E3F8198FE3073E8FCCF83E1CE3F8D28FE3FD3E8F22F83E9EE3F88B8FE32D3E8F20F83EBEE3F8AE8FE3023E8F58F83E2EE3F8588FE3BB3E8FCCF83EE7E3F8368FE3263E8F2FF83EAEE3F8B28FE34A3E8FD0F83E35E3F8098FE30D3E8FC0F83E81E3F80B8FE3A83E8FB2F83E56E3F8228FE3643E8FCFF83E7AE3F8328FE3F73E8F0DF83E3FE3F8DA8FE3D23E8FA9F83E38E3F8658FE34E3E8F78F83E21E3F8408FE3A73E8F1FF83E02E3F87D8FE3753E8FD0F83E61E3F8318FE30A3E8FFAF83EDDE3F8AA8FE35A3E8FF8F83E2CE3F8DD8FE3F03E8FFEF83E89E3F89A8FE3213E8F89F83E25E3F8268FE3333E8F73F83E17E3F8538FE3193E8FE1F83E9DE3F8008FE35A3E8FF8F83E5BE3F8898FE3D93E8F8CF83E2EE3F8898FE3283E8F59F83E65E3F86B8FE3B83E8FB8F83E6DE3F8788FE33A3E8FB8F83ED8E3F8178FE36C3E8FC9F83EDDE3F8BB8FE3223E8FEEF83E6FE3F8208FE3FD3E8F40F83EDFE3F8348FE3373E8FDCF83E65E3F8A08FE3DA3E8F2FF83EDEE3F8F18FE3BB3E8F80F83E14E3F85A8FE3963E8F78F83E6CE3C2E2D3E3D13EFCC19D3E96E38B44D3E3633EFA2B9A3EC9E39150ECE39C3EECF4CC3E05E3C1E3EAE3723EB826CB3E4AE38E75DCE3283EE945813E57E3A4A78FE3123EE502C83E8FE3AB16C4E36A3EBB76C83EA5E3D6EDEAE3803EEAF5F83E79E3F8198FE39D3E8FB1F83EE7E3F8578FE3463E8FECF83E70E3F8C68FE3273E8F57F83E41E3F84A8FE39A3E8F0DF83EC3E3F8F58FE3E43E8FF7F83E90E3F8938FE3423E8F8FF83E2DE3F8CE8FE3903E8FCAF83EE7E3F8238FE3D63E8F28F83E22E3F88B8FE3303E8F0AF83E62E3F8258FE3D13E8F35F83ECEE3F8B08FE3B63E8FE4F83EC5E3F8918FE3B83E8F3DF83E92E3F8748FE33C3E8FBFF83E78E3F8C28FE3D83E8F88F83E73E3F8F18FE3843E8F18F83EA3E3F8458FE3623E8F2BF83E6FE3F8A58FE3DF3E8FFDF83E0AE3F8EB8FE3003E8F3CF83EDFE3F8F78FE3C23E8F40F83E12E3F8058FE3B73E8FDEF83ED0E3F82E8FE3373E8FC1F83E15E3F8A98FE3A43E8F67F83E0DE3F8AD8FE30F3E8FCBF83E4BE3F8728FE3903E8F78F83E20E3F89D8FE39B3E8F49F83E13E3F8F68FE3C83E8FD6F83EECE3F8928FE3853E8F6FF83E33E3F8EF8FE3B43E8F3CF83E0EE3F8318FE3F83E8F19F83E7AE3F8178FE38D3E8FABF83E98E3F88B8FE3223E8FCEF83E3AE3F8258FE3E13E8FAAF83E74E3F88C8FE3C23E8FBBF83E94E3F8658FE3D83E8FA6F83EB2E3F8658FE3BD3E8FB9F83EF4E3F8248FE3613EB77EBB3EF5E3CD9CC9E3E43ECCC4D53EBFE3C94FBEE3513EA28FCC3EAAE3CD86BBE3943EB64FCD3E05E3CDA9A2E3813EB7F8C03E77E3BA1CCCE3443EB9CFC93EADE3BD38B7E3BD3E8FB0F83E91E3F8468FE3853E8F54F83E21E3F85E8FE3F33E8FADF83E8FE3F85E8FE3063E8F2CF83E34E3F8038FE3203E8F0FF83EB5E3F8F78FE37B3EFC6F8D3E6AE38AB2EBE33A3EDF79BD3E0AE3F8D98FE3FC3E8F57F83E27E3F85F8FE3BD3E8F43F83E21E3C2B4D3E32A3EFC7C9D3E65E38B68D3E3DF3EFA889A3EA1E39158ECE3D63EEC53CC3EB2E3C173EAE3EC3EB880CB3E0EE38E01DCE3543EE94B813E3BE3A4CBEAE30F3EC752D63E63E39408E3E3853E8F16F83E6FE3F8448FE3183E8F55F83E49E3F8A38FE3D23E8F2CF83E40E3F8528FE3153E8F3CF83EFFE3F8818FE3973E8F28F83EF6E3F8118FE3B93E8FD0F83E56E3F8D08FE3533E8F71F83E31E3F8E68FE3D03E8FDFF83E47E3F87F8FE3393E8F9BF83EEEE3F8A48FE3F63E8F41F83ECEE3F8F48FE3833E8FFCF83E78E3F8908FE3D63E8F0DF83E24E3F8B38FE34F3E8F4CF83E80E3F8588FE33D3E8F7CF83EB5E3F8728FE3AA3E8FCBF83EDEE3F88B8FE37D3E8F2CF83E12E3F8278FE3B43E8F8CF83EA5E3F8C98FE3A13E8F80F83E64E3F89E8FE35A3E8F79F83E5FE3F88E8FE3373E8F0CF83E53E3F8878FE3EF3E8F22F83E97E3F8C68FE3773E8F3BF83E18E3F84E8FE33F3E8F18F83EEAE3F8B88FE3E33E8F84F83E59E3F8858FE3973E8FAAF83EE5E3F8558FE3BA3E8FCEF83E01E3F8A28FE30A3E8F72F83EC5E3F81C8FE32D3E8FA6F83EEDE3F8988FE3C63E8F3FF83EC2E3F8578FE3EE3E8FFEF83EF5E3F8EF8FE3073E8FF5F83EB2E3F8BC8FE3CB3E8FE9F83E48E3F8F98FE3093E8F95F83E4AE3F8AB8FE3373E8F2AF83EBFE3F8DB8FE3613E8FC7F83EDAE3F8338FE3433E8FA0F83EFFE3F8578FE3A73E8F3CF83E43E3F8898FE3153E8FBDF83EE3E3F8ED8FE3AD3E8FBAF83E36E3F8238FE3983E8FECF83EC2E3F8168FE3ED3E8F39F83E48E3F8608FE3083E8F25F83E54E3F83F8FE3653E8FF8F83EAAE3F8B58FE3D73E8FE0F83E05E3F84E8FE3ED3E8FC7F83E97E3F8EE8FE3D53E8F0AF83E00E3F8138FE3C33E8F19F83EF2E3F8F78FE3FE3E8FCBF83E74E3F81A8FE3F83E8F09F83E9EE3F8F38FE3B53E8F85F83EFAE3F8B68FE30F3E8F45F83E26E3F8178FE34C3E8F6CF83E10E3F8658FE3DE3E8FDAF83E4BE3F8EB8FE3883E8F4AF83E94E3F8968FE3FF3E8FDBF83EDAE3F82C8FE31C3E8F45F83E1CE3F89E8FE3AA3E8F38F83EF4E3F8D98FE3683E8FB3F83E86E3F8C28FE3A13E8F7BF83E71E3F85E8FE3D43E8FA0F83EA3E3F8A78FE3703E8F60F83EB3E3F81F8FE3B23E8F66F83E73E3F80D8FE3FD3E8FD9F83E82E3F8AD8FE3F83E8F21F83E8BE3F8798FE3A83E8F1AF83E53E3F81E8FE3703E8FEBF83E24E3F8128FE3183E8FB4F83E23E3F8518FE3903E8FB7F83EBFE3F8EC8FE3A53E8F3DF83ED3E3F8F08FE3B53E8F74F83E5FE3F8208FE3623E8F4BF83ED6E3F8158FE31E3E8FA5F83EB9E3F82C8FE3383E8FAAF83EA7E3F88C8FE39B3E8FA9F83EBBE3F8CF8FE3A83E8F4FF83E35E3F82D8FE3D23E8FF8F83EDAE3F8658FE3303E8FEDF83E77E3F8D28FE34A3E8F78F83EA4E3F8758FE3D73E8F78F83EEAE3F8BF8FE3933E8FCFF83EDFE3F8108FE3533E8F74F83E64E3C2BFD3E3A53EFC369D3E90E38B10D3E3A93EFAA89A3E33E39185ECE39B3EECF6CC3E88E3C15CEAE3283EB8F4CB3EFFE38E90DCE33D3EE9F8813E66E3A4A58FE3C33EC7C0D63EFEE39408E3E3853E8FA2F83EC7E3F8588FE3863E8F95F83EC7E3F8138FE3993E8F97F83E85E3F85B8FE3D83E8FB8F83E79E3F81F8FE3363E8FB0F83E19E3F8FC8FE36E3E8F43F83EF4E3F82E8FE3FE3E8F03F83EFCE3F8DA8FE3D33E8FDCF83ED3E3F8378FE3DC3E8FB4F83EF0E3F8018FE3DC3E8F3EF83E3CE3F8148FE35A3E8F82F83E3DE3F8E38FE3A83E8F7FF83E5AE3F80D8FE3BC3E8FAEF83E07E3F8748FE3B93E8FB9F83E11E3F85A8FE3CC3E8F4DF83EAAE3F83D8FE3413E8F49F83E04E3F8EF8FE3843E8F3AF83E0FE3F8028FE3803E8FFFF83ECEE3F8378FE3AD3E8F96F83ED8E3F8CE8FE3E83E8FF7F83E9EE3F8158FE3703E8F67F83EA1E3F8EC8FE3EB3E8F02F83E35E3F8648FE3613E8F85F83EDEE3F87C8FE3C03E8F9EF83E80E3F8E18FE3433E8F86F83E29E3F8A38FE3A93E8FA5F83E5DE3F8C58FE30F3E8F45F83E48E3F8838FE32C3E8FF6F83EE1E3F8B88FE3963E8FAFF83E49E3F81B8FE3433E8F09F83EF4E3F8878FE3593E8F6AF83ECFE3F8808FE35E3E8F66F83EBFE3F8F18FE36B3E8F13F83E4DE3F8C28FE33A3E8FC8F83EC5E3F8F28FE3A53E8FD7F83E3CE3F84A8FE39E3E8F46F83E77E3F8768FE3A93E8FC2F83EE4E3F8FA8FE3C23E
(PID) Process:	(6876) WmiApSrv.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Operation:	write	Name:	3D14C6A2-BD9B-4B1C-A8EA-DD0E7CD0C968
Value: 8FE3FC3E8F25F83EFEE3F85A8EE3C63E8D9DF83ED1E3F8E68FE3873E8F0AF83EA9E3C28BD3E37C3EFC779D3E69E38BC7D3E3613EFA669A3ED6E39176ECE36A3EEC97CC3E1AE3C1A0EAE3FC3EB880CB3E0CE38E7FDCE31A3EE946813E84E3A4BCC9E3813EE5EAC83E3CE3AB59C4E31A3EBBF0C83E02E3D6B4EAE3E33EEAF0F83E79E3F8778FE30E3E8F62F83E5DE3F86D8FE3A23E8FD0F83EC6E3F8048FE3153E8F51F83E4EE3F85D8FE39A3E8FD4F83E94E3F8C78FE3EC3E8F8CF83E74E3F8FA8FE37E3E8F6AF83E04E3F8AF8FE34C3E8F04F83EB2E3F8408FE31D3E8FEAF83EAFE3F8F88FE3D53E8FCCF83E1BE3F8258FE3383E8FFFF83E80E3F8C28FE3FD3E8FC8F83E5CE3F8E38FE38A3E8F1FF83ECBE3F8208FE39A3E8FB8F83E8AE3F8638FE3263E8F18F83EB2E3F85B8FE3933E8F53F83E27E3F82A8FE3583E8F41F83EA6E3F8B58FE3963E8F54F83E48E3F8D58FE33C3E8F7AF83E96E3F8A48FE36C3E8F86F83E2CE3F8878FE30C3E8F83F83EDDE3F8588FE33A3E8FC2F83E01E3F8B98FE3FB3E8FCFF83E11E3F8A78FE34C3E8F1CF83E9FE3F85C8FE3863E8F7BF83E32E3F80B8FE32C3E8F22F83E06E3F8F18FE3653E8F70F83E81E3F8308FE3C33E8FF9F83E00E3F8D48FE35B3E8FABF83E53E3F8B18FE3D43E8F16F83E88E3F8948FE3763E8FCCF83EC9E3F8AA8FE33A3E8F2BF83E72E3F8E18FE3F93E8FE8F83EAEE3F8828FE36F3E8F73F83E4BE3F86C8FE3383E8FB1F83E01E3F8A48FE37A3E8F6EF83E73E3F8B78FE3293EBFEB923E5AE3AA50DCE36A3EDF32CC3E31E3BB66A1E3B13EF7479D3ED4E3F8008FE3633E8FACF83E4FE3F8468FE32F3E8FEAF83E16E3F8BF8FE3153E8F6EF83E3AE3F8668FE3903E8F5EF83EF1E3F8488FE38C3E8FE1F83E35E3F8738FE3893E8FDAF83E92E3F82E8FE3143E8F5BF83EF8E3F8CE8FE37B3E8F73F83E06E3F8198FE3073E8FCCF83E1CE3F8D28FE3FD3E8F22F83E9EE3F88B8FE32D3E8F20F83EBEE3F8AE8FE3023E8F58F83E2EE3F8588FE3BB3E8FCCF83EE7E3F8368FE3263E8F2FF83EAEE3F8B28FE34A3E8FD0F83E35E3F8098FE30D3E8FC0F83E81E3F80B8FE3A83E8FB2F83E56E3F8228FE3643E8FCFF83E7AE3F8328FE3F73E8F0DF83E3FE3F8DA8FE3D23E8FA9F83E38E3F8658FE34E3E8F78F83E21E3F8408FE3A73E8F1FF83E02E3F87D8FE3753E8FD0F83E61E3F8318FE30A3E8FFAF83EDDE3F8AA8FE35A3E8FF8F83E2CE3F8DD8FE3F03E8FFEF83E89E3F89A8FE3213E8F89F83E25E3F8268FE3333E8F73F83E17E3F8538FE3193E8FE1F83E9DE3F8008FE35A3E8FF8F83E5BE3F8898FE3D93E8F8CF83E2EE3F8898FE3283E8F59F83E65E3F86B8FE3B83E8FB8F83E6DE3F8788FE33A3E8FB8F83ED8E3F8178FE36C3E8FC9F83EDDE3F8BB8FE3223E8FEEF83E6FE3F8208FE3FD3E8F40F83EDFE3F8348FE3373E8FDCF83E65E3F8A08FE3DA3E8F2FF83EDEE3F8F18FE3BB3E8F80F83E14E3F85A8FE3963E8F78F83E6CE3C2E2D3E3D13EFCC19D3E96E38B44D3E3633EFA2B9A3EC9E39150ECE39C3EECF4CC3E05E3C1E3EAE3723EB826CB3E4AE38E75DCE3283EE945813E57E3A4A78FE3123EE502C83E8FE3AB16C4E36A3EBB76C83EA5E3D6EDEAE3803EEAF5F83E79E3F8198FE39D3E8FB1F83EE7E3F8578FE3463E8FECF83E70E3F8C68FE3273E8F57F83E41E3F84A8FE39A3E8F0DF83EC3E3F8F58FE3E43E8FF7F83E90E3F8938FE3423E8F8FF83E2DE3F8CE8FE3903E8FCAF83EE7E3F8238FE3D63E8F28F83E22E3F88B8FE3303E8F0AF83E62E3F8258FE3D13E8F35F83ECEE3F8B08FE3B63E8FE4F83EC5E3F8918FE3B83E8F3DF83E92E3F8748FE33C3E8FBFF83E78E3F8C28FE3D83E8F88F83E73E3F8F18FE3843E8F18F83EA3E3F8458FE3623E8F2BF83E6FE3F8A58FE3DF3E8FFDF83E0AE3F8EB8FE3003E8F3CF83EDFE3F8F78FE3C23E8F40F83E12E3F8058FE3B73E8FDEF83ED0E3F82E8FE3373E8FC1F83E15E3F8A98FE3A43E8F67F83E0DE3F8AD8FE30F3E8FCBF83E4BE3F8728FE3903E8F78F83E20E3F89D8FE39B3E8F49F83E13E3F8F68FE3C83E8FD6F83EECE3F8928FE3853E8F6FF83E33E3F8EF8FE3B43E8F3CF83E0EE3F8318FE3F83E8F19F83E7AE3F8178FE38D3E8FABF83E98E3F88B8FE3223E8FCEF83E3AE3F8258FE3E13E8FAAF83E74E3F88C8FE3C23E8FBBF83E94E3F8658FE3D83E8FA6F83EB2E3F8658FE3BD3E8FB9F83EF4E3F8248FE3613EB77EBB3EF5E3CD9CC9E3E43ECCC4D53EBFE3C94FBEE3513EA28FCC3EAAE3CD86BBE3943EB64FCD3E05E3CDA9A2E3813EB7F8C03E77E3BA1CCCE3443EB9CFC93EADE3BD38B7E3BD3E8FB0F83E91E3F8468FE3853E8F54F83E21E3F85E8FE3F33E8FADF83E8FE3F85E8FE3063E8F2CF83E34E3F8038FE3203E8F0FF83EB5E3F8F78FE37B3EFC6F8D3E6AE38AB2EBE33A3EDF79BD3E0AE3F8D98FE3FC3E8F57F83E27E3F85F8FE3BD3E8F43F83E21E3C2B4D3E32A3EFC7C9D3E65E38B68D3E3DF3EFA889A3EA1E39158ECE3D63EEC53CC3EB2E3C173EAE3EC3EB880CB3E0EE38E01DCE3543EE94B813E3BE3A4CBEAE30F3EC752D63E63E39408E3E3853E8F16F83E6FE3F8448FE3183E8F55F83E49E3F8A38FE3D23E8F2CF83E40E3F8528FE3153E8F3CF83EFFE3F8818FE3973E8F28F83EF6E3F8118FE3B93E8FD0F83E56E3F8D08FE3533E8F71F83E31E3F8E68FE3D03E8FDFF83E47E3F87F8FE3393E8F9BF83EEEE3F8A48FE3F63E8F41F83ECEE3F8F48FE3833E8FFCF83E78E3F8908FE3D63E8F0DF83E24E3F8B38FE34F3E8F4CF83E80E3F8588FE33D3E8F7CF83EB5E3F8728FE3AA3E8FCBF83EDEE3F88B8FE37D3E8F2CF83E12E3F8278FE3B43E8F8CF83EA5E3F8C98FE3A13E8F80F83E64E3F89E8FE35A3E8F79F83E5FE3F88E8FE3373E8F0CF83E53E3F8878FE3EF3E8F22F83E97E3F8C68FE3773E8F3BF83E18E3F84E8FE33F3E8F18F83EEAE3F8B88FE3E33E8F84F83E59E3F8858FE3973E8FAAF83EE5E3F8558FE3BA3E8FCEF83E01E3F8A28FE30A3E8F72F83EC5E3F81C8FE32D3E8FA6F83EEDE3F8988FE3C63E8F3FF83EC2E3F8578FE3EE3E8FFEF83EF5E3F8EF8FE3073E8FF5F83EB2E3F8BC8FE3CB3E8FE9F83E48E3F8F98FE3093E8F95F83E4AE3F8AB8FE3373E8F2AF83EBFE3F8DB8FE3613E8FC7F83EDAE3F8338FE3433E8FA0F83EFFE3F8578FE3A73E8F3CF83E43E3F8898FE3153E8FBDF83EE3E3F8ED8FE3AD3E8FBAF83E36E3F8238FE3983E8FECF83EC2E3F8168FE3ED3E8F39F83E48E3F8608FE3083E8F25F83E54E3F83F8FE3653E8FF8F83EAAE3F8B58FE3D73E8FE0F83E05E3F84E8FE3ED3E8FC7F83E97E3F8EE8FE3D53E8F0AF83E00E3F8138FE3C33E8F19F83EF2E3F8F78FE3FE3E8FCBF83E74E3F81A8FE3F83E8F09F83E9EE3F8F38FE3B53E8F85F83EFAE3F8B68FE30F3E8F45F83E26E3F8178FE34C3E8F6CF83E10E3F8658FE3DE3E8FDAF83E4BE3F8EB8FE3883E8F4AF83E94E3F8968FE3FF3E8FDBF83EDAE3F82C8FE31C3E8F45F83E1CE3F89E8FE3AA3E8F38F83EF4E3F8D98FE3683E8FB3F83E86E3F8C28FE3A13E8F7BF83E71E3F85E8FE3D43E8FA0F83EA3E3F8A78FE3703E8F60F83EB3E3F81F8FE3B23E8F66F83E73E3F80D8FE3FD3E8FD9F83E82E3F8AD8FE3F83E8F21F83E8BE3F8798FE3A83E8F1AF83E53E3F81E8FE3703E8FEBF83E24E3F8128FE3183E8FB4F83E23E3F8518FE3903E8FB7F83EBFE3F8EC8FE3A53E8F3DF83ED3E3F8F08FE3B53E8F74F83E5FE3F8208FE3623E8F4BF83ED6E3F8158FE31E3E8FA5F83EB9E3F82C8FE3383E8FAAF83EA7E3F88C8FE39B3E8FA9F83EBBE3F8CF8FE3A83E8F4FF83E35E3F82D8FE3D23E8FF8F83EDAE3F8658FE3303E8FEDF83E77E3F8D28FE34A3E8F78F83EA4E3F8758FE3D73E8F78F83EEAE3F8BF8FE3933E8FCFF83EDFE3F8108FE3533E8F74F83E64E3C2BFD3E3A53EFC369D3E90E38B10D3E3A93EFAA89A3E33E39185ECE39B3EECF6CC3E88E3C15CEAE3283EB8F4CB3EFFE38E90DCE33D3EE9F8813E66E3A4A58FE3C33EC7C0D63EFEE39408E3E3853E8FA2F83EC7E3F8588FE3863E8F95F83EC7E3F8138FE3993E8F97F83E85E3F85B8FE3D83E8FB8F83E79E3F81F8FE3363E8FB0F83E19E3F8FC8FE36E3E8F43F83EF4E3F82E8FE3FE3E8F03F83EFCE3F8DA8FE3D33E8FDCF83ED3E3F8378FE3DC3E8FB4F83EF0E3F8018FE3DC3E8F3EF83E3CE3F8148FE35A3E8F82F83E3DE3F8E38FE3A83E8F7FF83E5AE3F80D8FE3BC3E8FAEF83E07E3F8748FE3B93E8FB9F83E11E3F85A8FE3CC3E8F4DF83EAAE3F83D8FE3413E8F49F83E04E3F8EF8FE3843E8F3AF83E0FE3F8028FE3803E8FFFF83ECEE3F8378FE3AD3E8F96F83ED8E3F8CE8FE3E83E8FF7F83E9EE3F8158FE3703E8F67F83EA1E3F8EC8FE3EB3E8F02F83E35E3F8648FE3613E8F85F83EDEE3F87C8FE3C03E8F9EF83E80E3F8E18FE3433E8F86F83E29E3F8A38FE3A93E8FA5F83E5DE3F8C58FE30F3E8F45F83E48E3F8838FE32C3E8FF6F83EE1E3F8B88FE3963E8FAFF83E49E3F81B8FE3433E8F09F83EF4E3F8878FE3593E8F6AF83ECFE3F8808FE35E3E8F66F83EBFE3F8F18FE36B3E8F13F83E4DE3F8C28FE33A3E8FC8F83EC5E3F8F28FE3A53E8FD7F83E3CE3F84A8FE39E3E8F46F83E77E3F8768FE3A93E8FC2F83EE4E3F8FA8FE3C23E
(PID) Process:	(2196) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\Probe\{3803e1fc-4a38-4cb5-b418-ee53d9123e4b}
Operation:	write	Name:	LastProbeTime
Value:
(PID) Process:	(2196) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\Probe\{3803e1fc-4a38-4cb5-b418-ee53d9123e4b}
Operation:	write	Name:	NetworkPerformsHijacking
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\vSvfyw\is-H7VI2.tmp		—
		MD5:—	SHA256:—
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\vSvfyw\UslcLO.sk		—
		MD5:—	SHA256:—
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\57f273d287.ico		image
		MD5:913E79E1843B3E82AFE92229E060426D	SHA256:A68B915E3759DC0012ED51AB3E409CB566EDBCABC36F09ECC4CF1417F1579404
7940	ww_uu_gool_uu_yy.exe	C:\Users\admin\AppData\Local\Temp\is-C06MU.tmp\ww_uu_gool_uu_yy.tmp		executable
		MD5:B1D6A290D1B0B5D1B112CB6060968CF7	SHA256:73563D98BCB6C6848CEDAA512A6A5201F47310ACB3BCBDA3B4C042C63A09F876
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\vSvfyw\erH.dll		executable
		MD5:D77027AFFEC34AE515E5F703ACA5BEFB	SHA256:8E663A1881FBF4FAAA9D5E5B7A8A131620CA9E71A6C7D14F88292EC6400CC0A3
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\vSvfyw\is-UAJB4.tmp		executable
		MD5:D77027AFFEC34AE515E5F703ACA5BEFB	SHA256:8E663A1881FBF4FAAA9D5E5B7A8A131620CA9E71A6C7D14F88292EC6400CC0A3
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\vSvfyw\aKo\is-GAU37.tmp		binary
		MD5:A06B9A1854C39E79C532FC622AE229A0	SHA256:AC547CCE83D62D8217337EB8A4951A3F18661C0AD0B2EE16DCDAC4B5C14DD387
7960	ww_uu_gool_uu_yy.tmp	C:\Users\admin\AppData\Local\Temp\is-21JRP.tmp\_isetup\_setup64.tmp		executable
		MD5:E4211D6D009757C078A9FAC7FF4F03D4	SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\is-7U7V9.tmp		image
		MD5:913E79E1843B3E82AFE92229E060426D	SHA256:A68B915E3759DC0012ED51AB3E409CB566EDBCABC36F09ECC4CF1417F1579404
7960	ww_uu_gool_uu_yy.tmp	C:\Users\Public\c4c9ec73\vSvfyw\is-FSM9I.tmp		executable
		MD5:3298D9B4FDF556C0840920454295BCF9	SHA256:49F605526F23C511E7E27C26E9AFF057A3D0816F0246FE5A72ED875CAB182BF6

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
8164	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
8164	SIHClient.exe	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	51.124.78.146:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	172.211.123.248:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
8164	SIHClient.exe	20.109.210.53:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
8164	SIHClient.exe	2.23.246.101:80	www.microsoft.com	Ooredoo Q.S.C.	QA	whitelisted
8164	SIHClient.exe	13.95.31.18:443	fe3cr.delivery.mp.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4984	sihost.exe	154.91.82.107:45	lu.dssiss.icu	TERAEXCH	HK	malicious
5116	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7172	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
client.wns.windows.com	172.211.123.248	whitelisted
slscr.update.microsoft.com	20.109.210.53	whitelisted
www.microsoft.com	2.23.246.101	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
login.live.com	20.190.160.14 40.126.32.140 40.126.32.133 20.190.160.131 20.190.160.128 20.190.160.2 20.190.160.17 40.126.32.72	whitelisted
www.tm.v4.a.prd.aadg.akadns.net	40.126.32.72 20.190.160.14 40.126.32.140 40.126.32.133 20.190.160.131 20.190.160.128 20.190.160.2 20.190.160.17	whitelisted
zhllds.mlcrosoft.cyou	114.114.114.114	unknown
lu.dssiss.icu	154.91.82.107	unknown
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
nexusrules.officeapps.live.com	52.111.243.29	whitelisted

Threats

PID	Process	Class	Message
2196	svchost.exe	Possible Social Engineering Attempted	PHISHING [ANY.RUN] Suspected Phishing domain (mlcrosoft)
2196	svchost.exe	Possible Social Engineering Attempted	PHISHING [ANY.RUN] Suspected Phishing domain (mlcrosoft)
2196	svchost.exe	Potentially Bad Traffic	ET INFO DNS Query for Suspicious .icu Domain
4984	sihost.exe	Malware Command and Control Activity Detected	ET MALWARE [ANY.RUN] Gh0stRAT.Gen Server Response (SweetSpecter)
4984	sihost.exe	Malware Command and Control Activity Detected	ET MALWARE [ANY.RUN] Gh0stRAT.Gen Server Response (SweetSpecter)

Add for printing

No debug info

General Info

ww_uu_gool_uu_yy.exe

B272A04E9C1B350CB771E69C77192CCA

12D8BF03F1123E085AD0973522EB9F46F326F69D

A4B0F381813EFD51A931C3ECD7F9D004AD416AE2B5DF70D5278A73682AE2332E

393216:ttWdq6LqnsiSrX5+Y3OsRVvO1RSRwV3HBI5qASUYfv9O5tFDPNFAblWH4:L1n5m+3sKVXfUnFD1abZ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

PHISHING has been detected (SURICATA)

Adds path to the Windows Defender exclusion list

Changes Windows Defender settings

SUSPICIOUS

Reads the Windows owner or organization settings

Executable content was dropped or overwritten

Likely accesses (executes) a file from the Public directory

Deletes scheduled task without confirmation

Contacting a server suspected of hosting an CnC

Connects to unusual port

Starts POWERSHELL.EXE for commands execution

Script adds exclusion path to Windows Defender

Executes as Windows Service

INFO

Checks supported languages

Reads the computer name

Create files in a temporary directory

The sample compiled with english language support

Reads the machine GUID from the registry

Checks if a key exists in the options dictionary (POWERSHELL)

Script raised an exception (POWERSHELL)

The process uses Lua

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings