Malware Analysis Report

2025-08-11 06:22

Sample ID 240403-mge6bsca9x
Target 2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk
SHA256 254588a24faf74e0208074d3fcd2ed7d42096db295ad409919861fa10e6ad257
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

254588a24faf74e0208074d3fcd2ed7d42096db295ad409919861fa10e6ad257

Threat Level: Shows suspicious behavior

The file 2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 10:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 10:25

Reported

2024-04-03 10:28

Platform

win7-20231129-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe"

Network

N/A

Files

memory/2968-0-0x0000000140000000-0x0000000140235000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 10:25

Reported

2024-04-03 10:28

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\280f9d498ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4531284b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d3f1e84b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe040484b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e2c0b84b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008793884b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016dd1b84b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f32dec83b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daf00f84b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1cbe983b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_dcdc870206c1f2ccbdfd7bc0ca709ec3_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 249.110.86.104.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp

Files

memory/4888-0-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/4888-1-0x0000000140000000-0x0000000140235000-memory.dmp

memory/4888-7-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/4888-8-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/4888-11-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/4888-13-0x0000000140000000-0x0000000140235000-memory.dmp

C:\Windows\System32\alg.exe

MD5 1dcefc225ec797da41151d966ad6edbf
SHA1 a03763a537edd72c939f0922e914886292036965
SHA256 2f96b27d1f520fbc3343d2eacdd17165ac6cafc7a103cb7f851a70ff5a92c554
SHA512 b45fc1c52eea9f637fbabb5542329699673a95a1c4cf8ea7d39e816aefd9112d665579296f560d0049ec854ef8ba8c3df335a59b20a00f94c627905a09e9188f

memory/4328-16-0x0000000000700000-0x0000000000760000-memory.dmp

memory/4328-15-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/4328-22-0x0000000000700000-0x0000000000760000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 00e393b950e14bc71f5378ad41f43cdd
SHA1 b60617e1679e50a96680c573749045fd260af5b0
SHA256 8ffb241b2039792c5bc5742eafe2f13c43e0be0469f1fc4e3d6ec9cb49f32cfa
SHA512 71eb55602115b7cdcd49f122ef9da6dbe96fe3adf19ff5aa4aedec1a68a9332563534d8e85c8a76c603eb31f9378adb8c2b910f8c66d897971b4fc2db1617cc7

memory/2904-28-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2904-27-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/2904-35-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/2904-34-0x0000000000CA0000-0x0000000000D00000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 107df978b4ddc8667509274d5635c2e1
SHA1 eea64755def889ffc5e54d5f75b9914aed2ea882
SHA256 6f36853c9b06068d9316104266c3e2174d43bb1ce797324437d478663c4985e8
SHA512 70f8005dd6dde4c91e824e5c537144ed4736253119ded42237466e896aff29cdfaef40bd40ad4accde159c9847c0a871f72ef3c06be439c1944bcbe5e8493c87

memory/1468-39-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1468-40-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1468-47-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 045e09af7eb6d252ab8db35b05ee2329
SHA1 830fb3e3e7bbd872fe003873f779fa7334a4104d
SHA256 b030f81540a0e7e2bfff72c245ad91a250b20750bb6fc6fe140f3d3aeca0a95a
SHA512 abb0635ed5671723207f4045cd48d5f258340826221b69cd2e3b0de17bf5211a60319e4ccb76b2fe863a2f0039db6f0f50e846dc165e3095828bb19c09d1ff1d

memory/3340-52-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/3340-51-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/3340-58-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/3340-61-0x0000000001A60000-0x0000000001AC0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 69288be9772980fdc63fc8db81c38900
SHA1 3c7548e7808bc1f32ca02220a22ac3940ed67746
SHA256 226301801b1f484fe56dd848dffb54e1cf19025650b59053f75ad87754323f32
SHA512 76aa093c79029b1f6c545e33e4fbc634c073c9991bce887c6388807f4c2859d83d623147ac83e46c3f1fb861d2d33ef090565e41830780c45ff51dd33c6ee428

memory/1032-66-0x0000000000420000-0x0000000000480000-memory.dmp

memory/1032-67-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3340-65-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1032-73-0x0000000000420000-0x0000000000480000-memory.dmp

memory/4328-231-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/2904-235-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1468-236-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1032-239-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 c761db0bbcf389eef36a756a432044ea
SHA1 8f258a42d3e29587e29d89484e6db303263d476d
SHA256 b5b09c3f5f9cd5af94e0f585b16c5a46587daabc2837f9e3c7ea15be0a526746
SHA512 c52ec3e74b1d47f2633cce99228c0d5c36a993d49ee2c2a6492c865d78b3e0a888e93117edf7f4a85d880423b905cbb63dd3007928e4721ab613e5053bc389bd

memory/1012-245-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1012-244-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/1012-251-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 06cd1a708444aa6c1cb5a6a325cb7a6d
SHA1 daf4bf65b68fdcf068951a6a1d462efb70789b13
SHA256 54c51801614a3fd1ef015edaafe8bfed5a7fecd58317c408d413721e136be2c7
SHA512 e2540b686316b8223fe32d7fd897d74dbd556777860c9864218e61f5153517639a489c6359e210bccc483c517965363059622d83e83baea4fc6fb9783d6cc339

memory/3176-255-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3176-256-0x0000000000530000-0x0000000000590000-memory.dmp

memory/3176-265-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 0679030110f06e40ef81672591e68dde
SHA1 120e386c5410e07c3273fefe6b56fea3389f709a
SHA256 3444caf973f0d7cdecad581e91729e3892368cee8cf3fc557d6cf6a64ab54567
SHA512 86a2f5a6a4ab703eb9e054474c41c9fda6967a1ef86d408797b2bd90b5d303ceb955e7bf8ea16062856ad7d5a049c9cf2e976f59597e157f77f775afa59bbddc

memory/3176-272-0x0000000000530000-0x0000000000590000-memory.dmp

memory/3000-271-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/3176-270-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3000-281-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 db8fc30c219127fc4f99ae20008bc589
SHA1 665b4bdc4dc4ef5568dc3a60f19bca0e82a96be0
SHA256 68062153e04a512cc7a1025b7a454b211b5c9aec4fae2ede65752f50e89fb869
SHA512 9005b2598e020b44b06181e0c30ce6d69fe92f1e805d6004ff92eea2fab24dd369a15b28ca9e3bbe76deedaf4833a5a0a6c3e9fa74ae20d5c8f54696f14ae0b4

memory/4904-285-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4904-293-0x0000000000BF0000-0x0000000000C50000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 767ae203fa99f551f51f1049310257ca
SHA1 cffc94d71af784a82c3bbb8fd251aa172a2ee496
SHA256 2c287d9161f4704cbefcb00ae7e547d7f7765fc14062ed395d11c3a20dde2d07
SHA512 b51a1e98d2e5018ab9422e1373d30fc4a085e7bce648f011a7e958652fc989094e4f05485e561df955fbd7e1091be4bf783cb6baa65ae2eba368a0ead4b127c8

memory/4848-300-0x0000000000400000-0x0000000000497000-memory.dmp

memory/4848-308-0x0000000000520000-0x0000000000587000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b2f5bb3ff2768e6d211f8696eaa24ebe
SHA1 7b00ada0ed1e25e6a05c04a0ebfda3ed4a37b169
SHA256 3bd190d63b5f6311f78849cced0d07cc3f5a80c526aa8f274e2fb51f0c82f5e4
SHA512 979c6a252cd7c35e5341d993213754b8c10dc71219a369725b2f6b59675ca199a1a4bd7d0b986db445df7f9610d7c5a56ffba42df20ff28d02622e70e7e065eb

memory/3572-314-0x0000000140000000-0x0000000140095000-memory.dmp

memory/1012-312-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3572-321-0x0000000000700000-0x0000000000760000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 573a408e5aae9115ca48f8bd427b867b
SHA1 068f5a2a1975c10556cbb3f1397538e6dc3e2241
SHA256 5e9c0524ffb4a33918a677f94b908a94c57365e3cba6889bc8eb3d9af3088096
SHA512 d412cf8002354b689e68f9dd1ee89d17b265a6e9f0e7f2d7254ebfec3ff6ccdb89f92b340183851a22778750afc2d8c672b17f2788ab0b7b114adc1fc751fd0c

memory/2692-324-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2692-332-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 32cb3cf709bdad7bd789b3e98b91a127
SHA1 c6ad656292839d3100dc8ad1d5ab83e295b63989
SHA256 588b9f060e46950c41625f4c1ae33ce86242854c8064a1feb3382f1181b9b9c5
SHA512 413cee220bfd37d3defd31166d0c72df68be74883d2edee0c15d7a8edd3c2b471e831c770ab68d14a359603c63c1a16f6c3cf01d3413b93462d41f118dc6d01e

memory/3000-338-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/3548-341-0x0000000140000000-0x0000000140096000-memory.dmp

memory/3548-346-0x0000000000770000-0x00000000007D0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 6b66ce555b568671f6ee1e63e63b2556
SHA1 44fb4d469b9b63e87d491c76b113da2a598ef82e
SHA256 395eea27cd5142312d95bf8ae6c2e8bb2b3d4c40df3118fb06f3cc91e74634b2
SHA512 cc47d5150b659101bd3190ee84aca448af3424219a7ae216d17b965154bc4c9967eda12561302ef5ed4e35c33e876560da6ebba6f0b5489eff89ce1b1e85c5c9

memory/4904-350-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/772-353-0x0000000140000000-0x0000000140169000-memory.dmp

memory/772-360-0x00000000004E0000-0x0000000000540000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 e5d0e4527707785baaead2184599fa75
SHA1 ca362e7cb6608f5c672c629151d28cf377bb55b5
SHA256 c061259d21e81706058f35f0d0ef3a48030562055111b3d35478175f89736fd2
SHA512 00bb2800ab4333e2505c11ad04761518df492faeb82b84db062a98abaff57c8710ec929909f4d95fba750701f9cd73c4f49e5cd704b0548226372988ed3b1215

memory/4848-364-0x0000000000400000-0x0000000000497000-memory.dmp

memory/4268-366-0x0000000140000000-0x0000000140102000-memory.dmp

memory/4268-373-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 4e7d51b444311d2a613ca813fdf42328
SHA1 953ec99057eb595326218217d41d6c93b0e55cd7
SHA256 361c1b2d1d3e5252deb2c4282b5693fc19e966c16927d6e47ccade1cc2fceb65
SHA512 36992763a87c4dd8d3abf73d45f5b21d7f4d11295524ff8879a3b1c83aad18eb49c37e77b4aa13ddb98443faeea025d61983bc5dc89738f5fc2b93b552aa817b

memory/3572-377-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4924-379-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4924-386-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 4b7eb5f9009336e68e1f5f9425cc3533
SHA1 d10ff55ee6ecbdccfe60fc2070bb575d9a19fc7e
SHA256 7944501449b3d86af0b42db7cced76e8267d536de6e4a319c18605eecaf698c2
SHA512 8ef39ee28f8cf7eb97c3254770105842687298e0372d1c20bd4698751670b7e69a4d360b3e4f0a15994e043195c78d4e2c36b990e8a0c4a4a776286b0c4515a3

memory/2692-390-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4888-393-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2692-398-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/4888-401-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/4888-405-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4888-406-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\vds.exe

MD5 569f12ed25805c0ae4eff78ec0fd936f
SHA1 bffae170c05f77d6d9c0b4ce3aa018a52abaa020
SHA256 5614809c99a3356c724618eed0e9d0da016d75db082f558a2d4c4c2fe8f822ef
SHA512 4b9316ed497129bffac52418f8e65f17260ef73b61097fe3cada2f882353a3402740284e8c2443495acf353d07a0c62d21aba27c26572cb5b5fe96df88f6fb35

memory/3548-410-0x0000000140000000-0x0000000140096000-memory.dmp

memory/640-413-0x0000000140000000-0x0000000140147000-memory.dmp

memory/640-417-0x0000000000B00000-0x0000000000B60000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 e0286f4d9dd80de3e88c1366f02cff80
SHA1 3e31d1b9b4042e16169f356d60cda11d98907410
SHA256 03af08f56fff2f5a1016d0c58b67df5eae159c8b1df3c8adc766214d5387bd30
SHA512 cf290eeff6789ad88452ad645a26708aa357ef84e0602e90d709bba33a941226e38dd7639716d27dddce7b2cc34635f852c05d4c52eb09e5316a58993fa496f2

memory/772-421-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1500-422-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1500-430-0x00000000007F0000-0x0000000000850000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 ccb9468bf6ce82c0011ee483037457c9
SHA1 3a8228d94429a6ab5ab6c4763c8d8cd520f4f7bc
SHA256 b38a586da4ae790275bbe411f5b99680b87b6a94d4431acbae02b95158c6e297
SHA512 3c73398ba9d8f69255e7e61aaed4941ee4e5a523bf186fff32468f05e2b18975e8cb8c125267d5b68e48159a05374135099380720749d9f7cf15f3068d204afd

memory/4268-434-0x0000000140000000-0x0000000140102000-memory.dmp

memory/664-435-0x0000000140000000-0x0000000140216000-memory.dmp

memory/664-444-0x0000000000CC0000-0x0000000000D20000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 ab75d3ff7016c34987b9cd1a25a744d0
SHA1 c9a13a322815d0c730b6c2a3142ba3ce5daa144a
SHA256 fbc8e17c3a7e1cfef17fb8c4b6dde7673f6b03f172e485a1e992e95fe15816a4
SHA512 2a373da95fecc96c7ec675955390152645f1e22e39f8a06d5e65e735d6c009415c59bc04993265629fffb8505d84c9626c5a262361ad379299bbb76ad24d41a6

memory/4924-447-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/3004-450-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/3004-456-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 86d243be9c7995fda21b09e477c65f84
SHA1 1562d0de171f1eee2b4f1faafeb7502677fdd242
SHA256 c1d5fb7fb6089fc534e0b841a1cc2c22b7dfebb2a20f33214e3e3d4a214ec7c7
SHA512 c23c584f588b441e03c0ac06a71f794fdd8c8cd5dd3b9c9420f072b855add6c436e92c6b66a9219188d6ad91d174dc9f6ec2a2db8dbc88da8fc1a444a7b8e7e4

memory/3472-461-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3472-469-0x0000000000650000-0x00000000006B0000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 f2642ba47440b49b5010ca24d5ce0df5
SHA1 37adaf16b2dd853e43b7f186953988db97c29135
SHA256 b41442887f743bdf05bb6a244e9f3075090c322699a1a5e771fdac681bc55256
SHA512 d8e9a807557b32f6f5b2262e917d3337d1df4708478a82a80cab28b2ca46c0d6cd7cdd5fb265bffb9abac4fec42a5d989574fba1504c119065322f41f2a815e0

C:\Program Files\7-Zip\7zG.exe

MD5 c7fa564fbeb93e9cfa4ebdbac491900c
SHA1 245ba9412553b28ff38062cc763fd0a5cb7744e4
SHA256 f4b426025d169a3e73e5361b85aadb07fc15072dab12a4ecf260764ff894f79b
SHA512 78b9b5ecbacc732c1e4ddf8f73b706ee0209cc9ca234b11e171013d2847fb883ad89a0413ce69d2679a21ddcb5f809d7fd092d5dbaf6f06c4ee08497c9dd3c17

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 3fab7151899b17457ef4402c97ea33f5
SHA1 5017e9122d5a27264c40dc54c0f341a04110a965
SHA256 fe345a3bc1d3bd5e03bea07d313234d4bc4504080ea51ce2d325f6320c076a52
SHA512 ae06de3481bbccc521c0d618977ddf01f27ca7cf1cac8e6878df6b4c0b40f1457662c223fdfbbf7a785f11b772a2c8fad2ef66414b4f183b9656311c7106343c

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 644cd3af5951c078a26a7f97e3f591de
SHA1 6a64c6027b711b6acf26bb4264fe347d7e53594c
SHA256 a544cf8eae3d646e1f538cd13561031408313b54f81af0f57a79b2de0f968650
SHA512 0d5b3e092966938ab9c8c77bf2535feb0e5196677afcb71acbb97a5c29a77eaebdb78719f234ad1acf14c16cdf930768bfc2190401ab51d7e0ab7e15d9e67006

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 6186b5918bd732ac5976d656aa2065a8
SHA1 7b238d938f853db47f8d35f5b9ac0fba5ad04887
SHA256 d2e8f625a6e5ec32005000baec58b30c66b12f52457dec8240f3d43ee11c85ac
SHA512 9ef17e5f3d4f72b12d352c4602e22ce8c85b851e8e8a0e66fc94b52ec912e1dd476b12b1e27a28384b869a761fde3a5680d3fb4a98b355273caab6ee665ca99c

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 5ee7e71fa3e295eb078280e950d07671
SHA1 17bb1727bbd0ed1e1fcae1bd504365cf3c18c732
SHA256 6cb45c416cba71012f753dfb8a3168343fa61b48a48daf33521fdc4df20a8d3e
SHA512 d3bdc547be38bbead9e5d2ce5b21d60e5f6a593b133ca1b06600a4fc10cedd59c5cafc400cd67c98622d3589aac50ab425f4658b4877f7b0913baac6dde445c7

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 68b643d603235ea3ec23f67793625719
SHA1 5dd6c72b58c51714dc61dc78e59fbc19fd6341ff
SHA256 08c52a02d1c102c086ecf62e639365b6ca2d8504b0680c2274898efb50591eef
SHA512 39ecb505e45cc759b95dd0b415525187508d14e8f42eb1ac5b67865c5d7523fdb6f25225047944181751a8583f3287e268698006ac1338f15fd6feca73fb0f6f

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 144db10c87f000abade3b6e025cefa4b
SHA1 403bbd7d6722b185a8d8832073387f1390968ac2
SHA256 5f6d2ab195117a7ec865b0e6fa392c32487edc79d17a89fef3f75890046839a5
SHA512 3b4c2ff5060dd4a05241aa0068e5b7b2ced8b3795ec96a2ea8558c4f17425e072adb79ede35f0487c21a3d9b9bb565cb7442b8e7728c631e957680523537528e

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 b1f66d6160fde8a3334a1eb98bc08d67
SHA1 f5f5e0ead9af227d20055ca15b5f969692fe8098
SHA256 918c8bfa19455922913f5c0bf88546dd6981127f8abc093c1453c04d280dca20
SHA512 766c8a3af260f491f351058232c8e2d6bacf818d555c6c752ab8fe2f23b36b51a55a832befe3eb3d1108b4b64bdf1d48264d8cbfd431d38e88d02acf6f881989

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 1c0f5685ac9f0206e30ff0a71f6f7233
SHA1 0cab2eb877b81d86300d42672c95094a150abf20
SHA256 38727f5d80c393d602c2e6d079ec3180f2344a496f4bff9386c0439db333a6c0
SHA512 c2f7b467ccde034e1698b611e268687252fa10e9f8825b26d54393ea4eb76d781e9f35725e449390ddc3a318cb8699dee6cc037fc438ccf11abc9f7de4aadb49

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 289462863d572619bc58bcec919c46ad
SHA1 a791e08554fd570752d903d3eafa4ffff013eb1f
SHA256 43bd47a56c4e1cdaf5e52a18250f9941b7c306ce4bff27621f90e41d192c4691
SHA512 cd7830c5c5d2b8237e60e0af86d9d9e89dbe5ea323e1d63e4472e995a86d15425bb2c0a6451bcbde2dc6cf36fac32d8eb762bffe811b21cc887a0c3a34a9a64d

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 88de1620c4e0599750ec6d380cc18149
SHA1 58164b7f625230670c9a594d78cc5880840c42c9
SHA256 c46fdf7c32d44663cdd7a306f6b9b52584cbad15fd197df2c22ea19174efc438
SHA512 847d167df04f4c6dfd2f5de85a5d1d7b49d715ff418c895480f183017db53ef9c5bab8998ffbc699b252c97113f04ada1272c1ca892f873b5012f05227d39456

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 f9138a948a02d516698c54120addada9
SHA1 9d7ccc5facfc0a1e8a7cf76b9c8bcb82f99c1b72
SHA256 3001855e6a50877c2776ca39585011f207566daf5aee970b4876595ad3e90630
SHA512 cef00e66b1f4aab036ae78f46a768fac242bea2d4f3f09360a039b3ea5fc94f1b30e4fbfca4fc86f7447a8ca1b404089d9283db3c445c3fc2142d11a15aafe67

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 8eae02b6877d3841a3c7924d3594774e
SHA1 46e6438aefd3056ba2827ea170eae66b00c46756
SHA256 ed47e869dfd042992600812099728129c311aea3954e16faba6184604a82c1cb
SHA512 f92a3d7b5d17244928b15c70612656784c0159545d231c04833bdb51238319238b0cc9de15ce12178758d4ba0022accce285e45d2493135fa3fad7485e88944a

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 6c13ae9a49db58c2ae59c086ec226e9e
SHA1 00cb73bf913f5fa48e59e2b45a0913bcbe4b2f31
SHA256 ded564a4b4dac2da568c5435b4fc7e207611fd323fb79c4382e6fe145f2ee04a
SHA512 f5d8a0b1adcd7c9800ccd5ba53803610bc7d928d1ef66807eda36d0bd89f6d2ec010058364fd5008cc9dbe782eab913e3a326ef404b2e0dcd9d36bff15d45df9

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 77eace867eb47f63e7de0f6ae88e9104
SHA1 0c8bfa2c9c2901e7a8e0c00ddf1fc04b400c6a7c
SHA256 8b4aecfff368a8df1d64e783306662dec4905d37677e2edeffcbf3039710159e
SHA512 57925031fce81f462db77782bebede26307cb623e998da311689ecc1b7e24ca6fb4a88ef7877fc1d5007e6fa07f33be2ab0ef562f7f76bc2dbd1367f0bd84e1d

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 01a134f4288fc82eee1d1ec7c8d67105
SHA1 75ea8a31e57b523c5f521e6b563dfdbd774923ec
SHA256 407aaf8a22f07ad91025230685ebeea336b9163251ad89cfc4b7445ce2b6c9b1
SHA512 e91f81bc5a319e7dacecafd0135f0a110e248ab0c6a5fd42340e3e24dae7365b9409238928622a1859f485551514bac17257dbac0eea8f530e87c5c68caf5809

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 5aa95089d052e2853e38997f7d7a59c5
SHA1 38137d063110357d16599e9623ef524e53835528
SHA256 c7e56e5bd12084afd45f46c817c321b542f9cf889ab7f7753ee7e71cfe718239
SHA512 bf86a244893ba33c7601ef6e823a392718c44b489af57d8f95e3e2270d8f15230e053c45e94feade9a044c7ae964506ebdbbcd0f4ff5d2a7b2bbfb91fa4d3a35

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 032bfb962fb4180d59ff1766beb3469e
SHA1 55a8b616d584267f9cc05b76f9ad8b6061b62bc8
SHA256 8ba6f907aec02333af04740cda9e83afdf9e01962520da9f35f8b0d3d38600c3
SHA512 4995d2bd50ce868c2524ed7474faecb984b5ab6659e62980454683d211ddb0b3c66e54d31d16e948715c8cd8ae844dcda7d938d3076bd9abb7db59d32ffe1817

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 dfdee6b512e11215b697f073b31a066d
SHA1 2e709a7c9a12c8b2d2e2a7d7b9f4ca46d2368396
SHA256 2d3fbe5882b7b403de2cc529c1f4954d71483ba262b8cf45bd6f2584c702a3ac
SHA512 37812269d08a8cc0dd940873390ec53ff158d3307bab44674f15246e3785872f0f687b59ed326037b1d5e1a336c1e5cf76cfa05a6fc801d4b83a7be7300c905a

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 b422d58a3450fe496b88fed94f7fa45c
SHA1 60f3969502f01826a9968677c3cad68f2c555147
SHA256 1684ed6042510c257eb8c7c0ced778c0cef09bede580d055109544d14de7b6a4
SHA512 6a51cc836456e1586341774fdea4820d6ff9b64e9402f3721b5d237cc249fb59abfae2bf2e93e5fabb7688caf0507b055dffca26a86d7b4c75b596fc78b6a312

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 302043f645d97b289a45ff25baaf66e8
SHA1 db8e586bb2c8b536b4c61ad98cacd5e5a1627465
SHA256 45437cf7c1a83c1eac4f3711446d1f3e37c6f41fbfc1d291f485c63ebaf23794
SHA512 e3a346462b1a49a7c044179cda5ee3fb96fd19612fd09e27785c3e92e597e09af7cbcf2a4e0c3dc1c49c8b1afd5721248eede81c4ee9ef4a53ad488ff6bfee22

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 2c2891469b445c03a1e61a7734151447
SHA1 808cb1fc2a2ba9c224c409b7d695bcfc2d513c49
SHA256 ee10b4b798ee8464623576cf8b71089329d55b15829b3c06bf12d2bba0181d82
SHA512 6261c8d9cf7c47c1541f12ca11e0a43aaa63df1f91de095314889885f7aa884ea1102e2656fbcaa21f5356dded3d20c483eaca1d66e9f798c647665eb1c337d0

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 61ca87b6f24a336052d684013d6808c3
SHA1 57fcfd767d234c6796304867e2319c91bd406f43
SHA256 4caabb623739631a90a9824a5a9d671287e474d669cb840b178c1ac5ac2b48ef
SHA512 08d6ee16779d58d47cdbae68094f1176b77896fa4fd7d50aa09ee086c3c155292fbed7da24bc44ec9d944d383dab2685a950f122c7be725e1bdf87710f12a801

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 922e9a281b481870ebf1c0a3c07d6ed9
SHA1 739645bd29512ed77d87e2fec7148fd91d7d0cf9
SHA256 7f35dcff26269d28d99b2a971b3a667152aa93f416cea0f4e439fd9c1183aeea
SHA512 3e17475256b7085c81bef6c9038a39f654a2208d5acc4517cf943e8d43911a6d0cc6e9d2dd22a8531f263f12eff96bc29e5a07166a3e189fa28c5b02567cfb40

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 232c6531847aa71102e97c6137af3f36
SHA1 4aa6a72e639a4ffd5eeb89d9c605f28398fd270c
SHA256 6d68f29744d77a8dfc6baefcec64ee39e0ba7cae1cee371aced2bd9d76140b43
SHA512 49e0664fc3a18a2c58491afc1e3cbc8ed6c55d460e42731a3268173e7c7c0c1d677ad3467f66594203af4784c3b630f5e1230ea69baa729228806b19340e990d

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 f2e3c278345a555b6c055336fd92709b
SHA1 444fa986c27876089183bdae2f4107876bd98e51
SHA256 1e5e68502204c0ea19e6de7b377be44782b004d5c7c8809972f51fa589795c1c
SHA512 90fe32414f50f507c44558678298f98f2990ead173f39c868dd75eafbdbf4fadf3ff8a3283c9390293871dd539b4049e0ba34b38a8f53ce7eec08ab0f6d14ef6

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 401fd6fa6f57f8524046bada45eaaa50
SHA1 1c55b21a46c6be5e186ea594275c850ac86ec38f
SHA256 9992ce024f7a575ab86849dca74f7c9c88c9db36f02a89507fe684fc22de536e
SHA512 9b5255958829ba0f03382ab59b400b9c7a106237badf1715336a12603f718fc6125a8ad66c685b3e15505a667f1b830feb50db37126a8c4d66c0f8f605712d29

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 20100e98488c284b2f4da8ed96d0ec8c
SHA1 3df40e469e3785e9d775300f0d13b31c3e9d6390
SHA256 fb44fb27529a39aa168cd85e87f2babce5f6856f7c7d37037c115d3b135c9cb7
SHA512 41b691d5a5ecba1fdd38b14e534a4095b135f8a831b7be57a1a4f1c944ffa7fbd80cc32c8a2654abd7cfd0aa372b0787b5f9fe1c13ed0b87f36c62baf1e39a56

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 f115f27acf4c28b26a6b350a9d89f3cc
SHA1 bbd42ea64f8929b0c6169284d3c72b41497198ac
SHA256 adf82acd6fb0471e8e899debb9f69cdacc90648383a56fd9d19b73e825a41c43
SHA512 d08eada52ee4b7e6d419261c00a8ef7619b207d792bfd2de13226ea90546a6deb2a31b60bf381a39314d407f802c9747f19474cbb114fdc89834e94fb17e0346

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 a00b3ec3ad70eda2455b4dc098c27e0d
SHA1 f58b6ccf575e9b3a40a7108e4a943c07674d41d3
SHA256 f9c2e2eb1128822ad163bb0bf67c86254827293feef1ddaa3adfe353ebc60e44
SHA512 b7138161a695950c069160267d3a4be803da075c0cbe79029f18b1e44244973b1a9e12783cf2ea643ba508ceb8219039a87c1a3c5794133c78b4d5161cd8e928

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 c99b9dfa36a3019475f8537ac8f9acb4
SHA1 6d990fd12063be0b93cc2e73926fb5e451937fba
SHA256 f1c9a82396f3f301885bae4783e6c697030be3eec83e2401c0ceb9a8dfe3688b
SHA512 7def2e7efe3cab8b868e947c842e29053015175035f1c15a18ff376f0522a8e98f71273d5976bff1ea7edeb43170cbcc70c8b30cba081bf415f55350ce7e5d45

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 fa7fbba898cdb70cfae2325f0959158b
SHA1 1a734d16a2af1470ab9efc099a75c2294eef671c
SHA256 1f2dd575cff2766958c872f3edda208dd856707871ffa41e610863e6b52f8831
SHA512 799216fe67b7e523c4ed4bcf0063404db96f3fe3a8e1e43cc57840d0bb0b7be7421bcc8839b4c2bc36091a4b00fca784a6e0f71e8f4bec97be238ce088fad9a1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 11b9f987b1ce1b6d43678c796bef510e
SHA1 a54e9a40630d30d90de94f9a1f10104746b3116a
SHA256 f592696f0ec503d37c1b201e3c7d9f6639af3044591cd3e38e75569a5e5fc208
SHA512 874063d5dd13737f344bf9d2463a5989d749b1b721d3a61892e76c1345645c7b2e31d68e72fa29a3291d985591637508bdb065f16bcc7fe54b8578fe9450084f

C:\Program Files\dotnet\dotnet.exe

MD5 53460dbb1790d86472ed6efb94e94934
SHA1 278150a01f68152a195181399c73b7ac125c15ac
SHA256 6d2d4e83ecaf2d42da82a31cf74273423ec3a35fd8073dc6d5826e884f751280
SHA512 8a3ac0c43a37eb579ac4f7a309e08cdc703da9ed30cc517adb4df9fe2135ca33e65353947007e97d6873c80bd7ad7826a588829f9f815eeed79095c89f9ab90b

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 508ac53a84be0d1b548a63ae973101a0
SHA1 8c962f17cd9bdded6a7049f2c534cd332eb77a10
SHA256 ebdd3be8708e308b0a3c44522bf7e96967d65dcabe0176b905b554fb3dfa01f1
SHA512 b59301da5b14db72c3f1fcd8e0ee1457e9f2737eaa1b4ac09d3166da8246d7275afdb5bba4e774c768bb448723fa156d381dbbb77c0eececdf9cff9a8804240a

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 b3d5aa31f8ac7e750a3d528c314360b7
SHA1 8c5f4072883b7451042796cde82e56ff08cde82a
SHA256 f2603ca17e8d292aeb6906934da86a5525e5d5066c876847058299b175bd841d
SHA512 1169c2595d7019c7d07ad9389e9d006a2af45464f6e1a66469ecf5ced50992cf020131ea1adb6dded031ced1c4a0675737de6012f45097a59d7dbb737cb493ab

C:\Program Files\7-Zip\Uninstall.exe

MD5 662f94fc27791e4e57463902171a78f4
SHA1 a4d79112e4898ea985d5733e18b57ce3174be523
SHA256 2968283c6ef04196a64a0b472d4fc46c1afb4375127d6e606ddabfc104a11fcb
SHA512 7ea7d5f4ee030dae3b4855b2f3174d6e74e48c890a8c4e78f60da66140e6fab5393387ab19050a48e3b6fe12ed1619ce9d4981909546d726ed74988241bbb5d6

C:\Program Files\7-Zip\7zFM.exe

MD5 20f1e82fcf7ec49ff6e24c66cfef75fb
SHA1 7f1de6446609e0d2a56bd3d12df6c6ff5899c062
SHA256 85584f8f2fc269404c016ea20b7b1464792f4a17f67ed33f0018ed0f0473dbd8
SHA512 ec98201d6f91149084eb054a7dc56db0fdaae3c86603552e9f8c359da7ce967f3e71a538a56b5089ca87816f6d1d3b636cd6d069a64ddaa0763e4a3c892a4683

C:\odt\office2016setup.exe

MD5 5ea6699efe3d1535e82ddec182841d03
SHA1 b8c2995168e99047a7c20d00615c4497a2d87e00
SHA256 45ef5aae39c268916dbde4d1a2a21c8012d6464435ae01b55e01be041e2edcf5
SHA512 5c8d25932dd72f87e2cb7eb0f2c807a9f6434e9789052b2fb15b8c2d5808a976c79a142a50ecff575206e36cad74606ee603e6e7636e770f2206bf2d9fa4a5d4

memory/640-555-0x0000000140000000-0x0000000140147000-memory.dmp