What is WDContextMenuHandler.dll?

WDContextMenuHandler.dll is part of WDContextMenuHandler.dll and developed by Western Digital Technologies, Inc. according to the WDContextMenuHandler.dll version information.

WDContextMenuHandler.dll's description is "WD ContextMenu Handler"

WDContextMenuHandler.dll is digitally signed by WESTERN DIGITAL TECHNOLOGIES.

WDContextMenuHandler.dll is usually located in the 'C:\Program Files\Western Digital\WD SmartWare\' folder.

None of the anti-virus scanners at VirusTotal reports anything malicious about WDContextMenuHandler.dll.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on WDContextMenuHandler.dll:

Property	Value
Product name	WDContextMenuHandler.dll
Company name	Western Digital Technologies, Inc.
File description	WD ContextMenu Handler
Internal name	WDContextMenuHandler.dll
Original filename	WDContextMenuHandler.dll
Legal copyright	© 2016 Western Digital Technologies, Inc. All rights reserved.
Product version	2.0.0.3
File version	2.0.0.3

Here's a screenshot of the file properties when displayed by Windows Explorer:

Product name	WDContextMenuHandler.dll
Company name	Western Digital Technologies, Inc.
File description	WD ContextMenu Handler
Internal name	WDContextMenuHandler.dll
Original filename	WDContextMenuHandler.dll
Legal copyright	© 2016 Western Digital Technologies..
Product version	2.0.0.3
File version	2.0.0.3

Digital signatures [?]

WDContextMenuHandler.dll has a valid digital signature.

Property	Value
Signer name	WESTERN DIGITAL TECHNOLOGIES
Certificate issuer name	Symantec Class 3 SHA256 Code Signing CA
Certificate serial number	1825380b7b868a7f4f8fd6e306b18139

VirusTotal report

None of the 70 anti-virus programs at VirusTotal detected the WDContextMenuHandler.dll file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "regkey_written": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\PropertySheetHandlers\\WDBackupPropSheetHandler\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\ContextMenuHandlers\\WDBackupMenuHandler\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertySheetHandlers\\WDBackupPropSheetHandler\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\VersionIndependentProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\VersionIndependentProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CurVer\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{C2978DBD-2BDB-48A3-B570-F78498F51791}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\FLAGS\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHand.1\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHand.1\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CLSID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandl.1\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\ContextMenuHandlers\\CWDDriveMenuHandler\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\WDContextMenuHandler.DLL\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CurVer\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0\\win64\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\ContextMenuHandlers\\WDBackupMenuHandler\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\HELPDIR\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\ProgID\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandl.1\\CLSID\\(Default)"
    ],
    "dll_loaded": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll",
        "C:\\Windows\\system32\\dwmapi.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.binLOC.dll",
        "kernel32.dll",
        "KERNEL32.DLL",
        "UxTheme.dll",
        "ADVAPI32.dll",
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.binENU.dll"
    ],
    "file_opened": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
    ],
    "command_line": [
        " C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\WDContextMenuHandler.DLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}",
        "HKEY_CLASSES_ROOT\\Drive",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\Programmable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\PropertySheetHandlers\\WDBackupPropSheetHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertySheetHandlers\\WDBackupPropSheetHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertySheetHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CurVer",
        "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDBackupMenuHandle",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\ContextMenuHandlers\\WDBackupMenuHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{C2978DBD-2BDB-48A3-B570-F78498F51791}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}",
        "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDDriveMenuHandler",
        "HKEY_CLASSES_ROOT\\Folder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32",
        "HKEY_CURRENT_USER\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\ContextMenuHandlers\\WDBackupMenuHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\ContextMenuHandlers\\CWDDriveMenuHandler",
        "HKEY_CLASSES_ROOT\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandl.1\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\FLAGS",
        "HKEY_CLASSES_ROOT\\dllfile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Interface",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\ShellEx",
        "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDBackupMenuHand.1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\HELPDIR",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InProcServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\ProgID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHand.1\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\ProgID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\Programmable",
        "HKEY_CLASSES_ROOT\\.dll",
        "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDDriveMenuHandl.1",
        "HKEY_CLASSES_ROOT\\*",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\VersionIndependentProgID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\PropertySheetHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\ShellEx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\ContextMenuHandlers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\VersionIndependentProgID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0\\win64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CurVer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0",
        "HKEY_CLASSES_ROOT\\CLSID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\TypeLib"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\FLAGS\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0\\win64\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\HELPDIR\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version"
    ]
}

Generic

[
    {
        "process_path": "C:\\Windows\\System32\\regsvr32.exe",
        "process_name": "regsvr32.exe",
        "pid": 2500,
        "summary": {
            "regkey_written": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\PropertySheetHandlers\\WDBackupPropSheetHandler\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\ContextMenuHandlers\\WDBackupMenuHandler\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertySheetHandlers\\WDBackupPropSheetHandler\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\VersionIndependentProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\VersionIndependentProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CurVer\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{C2978DBD-2BDB-48A3-B570-F78498F51791}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\FLAGS\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHand.1\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHand.1\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CLSID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandl.1\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\ContextMenuHandlers\\CWDDriveMenuHandler\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\WDContextMenuHandler.DLL\\AppID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CurVer\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0\\win64\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\ContextMenuHandlers\\WDBackupMenuHandler\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\HELPDIR\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32\\ThreadingModel",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\ProgID\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandl.1\\CLSID\\(Default)"
            ],
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll",
                "C:\\Windows\\system32\\dwmapi.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.binLOC.dll",
                "kernel32.dll",
                "KERNEL32.DLL",
                "UxTheme.dll",
                "ADVAPI32.dll",
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.binENU.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\WDContextMenuHandler.DLL",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}",
                "HKEY_CLASSES_ROOT\\Drive",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\Programmable",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\PropertySheetHandlers\\WDBackupPropSheetHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertySheetHandlers\\WDBackupPropSheetHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertySheetHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHandle\\CurVer",
                "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDBackupMenuHandle",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\ContextMenuHandlers\\WDBackupMenuHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{C2978DBD-2BDB-48A3-B570-F78498F51791}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}",
                "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDDriveMenuHandler",
                "HKEY_CLASSES_ROOT\\Folder",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32",
                "HKEY_CURRENT_USER\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\ContextMenuHandlers\\WDBackupMenuHandler",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\ContextMenuHandlers\\CWDDriveMenuHandler",
                "HKEY_CLASSES_ROOT\\AppID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandl.1\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\FLAGS",
                "HKEY_CLASSES_ROOT\\dllfile",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32",
                "HKEY_CURRENT_USER\\Interface",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\ShellEx",
                "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDBackupMenuHand.1",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\HELPDIR",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InProcServer32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\ProgID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDBackupMenuHand.1\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\ProgID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\Programmable",
                "HKEY_CLASSES_ROOT\\.dll",
                "HKEY_CLASSES_ROOT\\WDContextMenuHandler.WDDriveMenuHandl.1",
                "HKEY_CLASSES_ROOT\\*",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\VersionIndependentProgID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\PropertySheetHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\ShellEx",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\*\\shellex\\ContextMenuHandlers",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\VersionIndependentProgID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0\\win64",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WDContextMenuHandler.WDDriveMenuHandler\\CurVer",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0",
                "HKEY_CLASSES_ROOT\\CLSID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\TypeLib"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\FLAGS\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragMinDist",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\0\\win64\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{AD334A7F-7AAF-42E4-B41E-648B2171F44C}\\1.0\\HELPDIR\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\TypeLib\\Version",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\DragDelay",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\ProxyStubClsid32\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7BECC97E-7078-4B1D-9805-D3D7492D992A}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A089192C-7D46-433B-9BC8-93B02475065B}\\TypeLib\\Version"
            ]
        },
        "first_seen": 1562370785.8438,
        "ppid": 2308
    },
    {
        "process_path": "C:\\Windows\\SysWOW64\\regsvr32.exe",
        "process_name": "regsvr32.exe",
        "pid": 2308,
        "summary": {
            "dll_loaded": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            ],
            "command_line": [
                " C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            ],
            "regkey_opened": [
                "HKEY_CLASSES_ROOT\\.dll",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\dllfile\\AutoRegister",
                "HKEY_CLASSES_ROOT\\dllfile"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)"
            ]
        },
        "first_seen": 1562370785.625,
        "ppid": 2448
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1562370785.375,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "This executable has a PDB path",
        "severity": 1,
        "marks": [
            {
                "category": "pdb_path",
                "ioc": "D:\\jenkins\\workspace\\WDSmartWare-2.4.16\\WDSmartWare\\2.4.16.16\\CreateExe\\Front Parlor\\x64\\Release\\WDContextMenuHandler.pdb",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "has_pdb"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "The executable contains unknown PE section names indicative of a packer (could be a false positive)",
        "severity": 1,
        "marks": [
            {
                "category": "section",
                "ioc": "text",
                "type": "ioc",
                "description": null
            },
            {
                "category": "section",
                "ioc": "data",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_features"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "The file contains an unknown PE resource name possibly indicative of a packer",
        "severity": 1,
        "marks": [
            {
                "category": "resource name",
                "ioc": "PNG",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "REGISTRY",
                "type": "ioc",
                "description": null
            },
            {
                "category": "resource name",
                "ioc": "TYPELIB",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_unknown_resource_name"
    },
    {
        "markcount": 7,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 8192,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feefe60000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 17
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fefe110000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 19
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fef8471000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 21
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007feff8fd000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 23
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fefbfa1000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 25
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fef53a6000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 27
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2500,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 4096,
                        "protection": 64,
                        "process_handle": "0xffffffffffffffff",
                        "base_address": "0x000007fefb6b7000"
                    },
                    "time": 1562370786.0317,
                    "tid": 1676,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2500,
                "type": "call",
                "cid": 29
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Installs itself for autorun at Windows startup",
        "severity": 3,
        "marks": [
            {
                "type": "generic",
                "reg_key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{C752BC82-C19A-4827-9C15-0996BA85C180}\\InprocServer32\\(Default)",
                "reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            },
            {
                "type": "generic",
                "reg_key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{CCEFA845-DCDB-4A2F-8BED-DBE87CD198EC}\\InprocServer32\\(Default)",
                "reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3.bin.dll"
            }
        ],
        "references": [],
        "name": "persistence_autorun"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.2725291252136,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5442,
            "time": 6.1797440052032,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 5770,
            "time": 4.1665251255035,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6098,
            "time": 6.2675471305847,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6426,
            "time": 4.7885160446167,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 6754,
            "time": 3.0349810123444,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 7082,
            "time": 4.7146511077881,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 18028,
            "time": 4.202791929245,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 26412,
            "time": 6.2702569961548,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "ac2753025bf73fd2137f5adc269be5be5a4c203bc0df50943833e58ab31ff54c",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "451336882152db684e67815e8a814f515340a02705f71e63d4793f4374f1dfeb",
    "irc": [],
    "https_ex": []
}

Screenshots

Other files also named WDContextMenuHandler.dll

WDContextMenuHandler.dll (13 votes)

Hashes [?]

Property	Value
MD5	b61bccb6afd0108c7f8843d85b900a1f
SHA256	4020bc0b2d935c587006a1d309350d3d0b84cab762bebcaaf905598b9391e9b3

What will you do with the file?

To help other users, please let us know what you will do with the file:

What did other users do?

The poll result listed below shows what users chose to do with the file. 0% have voted for removal. Based on votes from 1 user.

			Votes
Keep	100 %		1
Remove	0 %		0

Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

Free online surveys

And now some shameless self promotion ;)

Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.

If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.

Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

What is WDContextMenuHandler.dll?

Vendor and version information [?]

Digital signatures [?]

VirusTotal report

Sandbox Report

Summary

Summary

Generic

Signatures

Yara

Network

Screenshots

Other files also named WDContextMenuHandler.dll

Hashes [?]

What will you do with the file?

What did other users do?

Malware or legitimate?

And now some shameless self promotion ;)

Comments

Leave a reply