Malware Analysis Report

2025-08-11 06:22

Sample ID 240403-mh8h9sce93
Target 2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk
SHA256 2ed5b80c398769acb861b6b70b3d24b2cecf8d0689412e710f1e2b4fd30e6d8e
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2ed5b80c398769acb861b6b70b3d24b2cecf8d0689412e710f1e2b4fd30e6d8e

Threat Level: Shows suspicious behavior

The file 2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 10:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 10:29

Reported

2024-04-03 10:31

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe"

Network

N/A

Files

memory/2760-0-0x0000000140000000-0x0000000140235000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 10:29

Reported

2024-04-03 10:31

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\68095b4d46f975ab.bin C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{6A1BB60F-884E-44C2-837C-FAE44753B873}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{6A1BB60F-884E-44C2-837C-FAE44753B873}\chrome_installer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003521c4f3b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070a80bf4b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b34d7f3b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013bcfff3b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7fb9df3b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d732f6f3b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053f9dbf3b185da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_ea27a9156c97e178301c0ecfa1b2cc0b_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 23.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 ywffr.biz udp

Files

memory/3984-1-0x0000000140000000-0x0000000140235000-memory.dmp

memory/3984-0-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/3984-7-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/3984-10-0x00000000020B0000-0x0000000002110000-memory.dmp

C:\Windows\System32\alg.exe

MD5 e5131df34ffc4412a9f559c713edbff0
SHA1 0000f96cdbe47cfc384c3be8971b7927114e336e
SHA256 06a63b6b40821ace2028c1f8de0f12dc5c86a286133d360d86835cf7545a218e
SHA512 35fed7d1f109d6f9b52aa9fddd851526b71aeb5cd23a303a6ddffe04a86973e58a0b0b43ce8d58044d06a0284c9b64d13438484858d51463bf6c7206916dff3b

memory/3984-14-0x0000000140000000-0x0000000140235000-memory.dmp

memory/1348-15-0x0000000140000000-0x000000014014A000-memory.dmp

memory/1348-13-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/1348-21-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 f9888e55c5dfdb2a704704725098d2bd
SHA1 a8e04afe5acd4c3fb8d3c77fee48250a2b3b4cc7
SHA256 c4c9cc504ef5c75a4c9c031d882223c722cafc2d21e6ba326f4c0c97788712e2
SHA512 cd895113cb7703a0861a12afe475e07c21f6d6a4900845c49152ca6405a0d2233bf8b1ee2b0e91c48090be6864c2b68208855ef6ddf6e0d2cd5bd3cbd59af11c

memory/3796-27-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3796-26-0x0000000000C60000-0x0000000000CC0000-memory.dmp

memory/3796-33-0x0000000000C60000-0x0000000000CC0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 9181b2d78d0c1de669707363f3aec9f6
SHA1 6f9427096dd32d82e21b3d143b962c7237d7ace3
SHA256 aeb5d28bac5d533aadbc4bd042c1bf46d5cb816e69a301112d43aa92c877b5ee
SHA512 8c9781e977bd3bc4b5d02f6bd793788718b8e6ebe4778e62ccdc5de2ff117d36b6c3c9c101c208610bb438077efe0e66a3a84b8e97efe8fe08de02a61214e210

memory/2608-38-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2608-37-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2608-44-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 55760ff2f6f1133c78d52018e300acfc
SHA1 22be5576268d0e0ad61ee255d7baf0472875662a
SHA256 1e68b5ccd6659090a23c86e2b646140e482357a97f60d82cd81a2ba77a7d4720
SHA512 f671a79f615d211c14585f83e1610f64176d8a23971b092bb6aa50bb3d84220652c80fefd0afa6890e9a0772e24d329fdbe5239b1950a8ccef245997d19b077d

memory/396-48-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/396-50-0x0000000140000000-0x000000014016B000-memory.dmp

memory/396-56-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/396-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/396-62-0x0000000140000000-0x000000014016B000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 770d49d7fb4f5b820d0296e63704d4bb
SHA1 00bfe80e090e515e146957acabbecf75a79cbcea
SHA256 e83f651dc609bd0b6f6e7dae7bcf9e7873dda78ddcb208404d5720a8d2dd93ea
SHA512 4a07a7866186579a90e92cce45b89163e31c908d82d8bbba985648b9655180de544ab3a1771bf12a2832e550cce1f1f4d4c86f1678f84815ebf4550fda6ca5d1

memory/2988-64-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/2988-66-0x0000000140000000-0x0000000140170000-memory.dmp

memory/2988-72-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/1348-229-0x0000000140000000-0x000000014014A000-memory.dmp

memory/3796-234-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2608-235-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2988-238-0x0000000140000000-0x0000000140170000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 3279df4e1f46d2f4e9425cde222ef031
SHA1 c467ea8207e6b91710e2ae33630ccaad9ae5af5d
SHA256 d6c94e1ad55e54f22158e9d61e70f82712801b46c267d66e18b8184ce236d540
SHA512 0673779d65c6eeafd3d5a3457484355c1bb1ae6877e3e741a0122fd2ebf15791504ed7479e2826d8c3b0f351d6923803f930e72c6a5aaed3f86167ebfbf426e0

memory/4840-243-0x0000000140000000-0x0000000140149000-memory.dmp

memory/4840-244-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/1792-264-0x0000000000E80000-0x0000000000EE0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 50aad64735e7cbf6b7f17b2e3943fc15
SHA1 e4d59f8f24369496b5f6069daecefc8648cff2af
SHA256 078767c72b04dad6cfd1613e384ba57944d0617f123ed3efcfa375cfa770732e
SHA512 f99bf194bc7d24260eca2c9834b65803833329b336e12590d723d03dbef41095775da1069b16b67b370b072aff6c4321296303ac7a5d770d29fd8fbefba7b194

memory/1792-270-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1792-272-0x0000000000E80000-0x0000000000EE0000-memory.dmp

memory/3756-269-0x0000000140000000-0x0000000140159000-memory.dmp

memory/1792-255-0x0000000000E80000-0x0000000000EE0000-memory.dmp

memory/1792-254-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 1db28c2c79fe5d2422f47a6dd2e70573
SHA1 87f123ba0696c418192409290c956a0cb4b1d3cd
SHA256 1f469fdb346ea9eabfef1098c7787623eae6473526a7c7b0771beda253fda5c3
SHA512 30f33e38a62e3598edcc4c6a8c2bb74a188fb3ffc99735bb95b59624864c6bcfdfa3eb3526dec608319becb18cd4942e136eb9ce45b277a0d8f434de333cbd1e

memory/4840-250-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/736-284-0x0000000140000000-0x000000014014B000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 629567ff66c5c78b3ec159a787227ce7
SHA1 9f982324bcce44c5bb1cd49aa96a4f3d797aff7a
SHA256 2a20513726512601ef1b04e461a8c7a357fd7d5259334f48681bef102c5af472
SHA512 a6f002141f6a88a80ac14aee05c98b21ed7edc45802fb9ba46dbb7d28182c63c43b39fd3fa3d9caa513c8589dcbd4aaa6ce906e0195a849fffcdabc09a61379e

memory/3756-280-0x0000000000630000-0x0000000000690000-memory.dmp

memory/736-296-0x0000000000BF0000-0x0000000000C50000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 08225804914eab19a412fd8b4f924e0f
SHA1 366e55eb6f4ec08656051e578873f798ec661e75
SHA256 d29e0d48fcbc4dc9a95bb364ec842d6ef7dd8db7daee1d40e1a89067bb9a5d5f
SHA512 3d1c75e095edb5524dcbd794d902f7d03c820ac1f2a94881c9e0aec51eb82479ff7fde9af8b787618af70fb77cc2afb5b5b4de65aa2f7dfc0711b1806937df2b

memory/4756-299-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 41e24287f0d33404508f6b1853b49a69
SHA1 585f9f5cc4733531aaf211e3c44d7e6ca55187be
SHA256 28b49d6f710fe76ced68729a985485f57a74484f898a25e5892d1219f335db49
SHA512 48f0f00c390857820c089380ebfc8105f5cb6d3bcdb924548b5704511af0d483bc0b70744ed31cc11ce37afda631b3f9e7f4ccda2dccc52f7c14f4eeb39702b1

memory/3180-303-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4840-311-0x0000000140000000-0x0000000140149000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 c42d999e936621676bbc54db2753e667
SHA1 add7c2c34bf628512057510c62cd8145d76b2cbc
SHA256 86a9c0d5c97c35642fa23b8dd01bb33ba6bff1bc1d9502d25d3f500738f3037f
SHA512 0bed3a2753b13606fcff071a7fc9b8f0a9ccefe3310564ca1565840c956e1afde087d9096f65dfcc0dc9b79072792176357f1fbce34edcb7a8513b762ed8f40b

memory/3232-318-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3180-313-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 fced93ad16e0af617d616295afa8f2e6
SHA1 c14fe96994daf237fadd6e37701d27adf0d96a94
SHA256 23069e8fec3c476c78bb2a4cf35d521000346404d47deb92a2dc45333ca802b4
SHA512 5431f5d7579da98d5fb7e96ce23687631be0b102dd24ce92411ae0f7eb0145d1f5c1f4bb320b62eb62e2cde1fa35afdf8eaf7dc367faa559eaff7de8b3d38f54

memory/368-329-0x0000000140000000-0x0000000140136000-memory.dmp

memory/3232-325-0x0000000000770000-0x00000000007D0000-memory.dmp

memory/3756-338-0x0000000140000000-0x0000000140159000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 0aa23b4eac22ba07a0c3fd28226f7896
SHA1 cc3e1450e1b6b3e53cfb2e51328f8afa2eb65b15
SHA256 a44c68b457a9c971d65dc3aba7badefd5e36539415caba328d5477d59abcf50c
SHA512 1b76ab7b1ac67345a01bab27ebfe319025aee9fe67dcabb5eff04e049663fff514a8f9d7e7411d4103b812dd01086f137bbb5dc874e6bef7f312b93afb0e94ab

memory/2404-341-0x0000000140000000-0x0000000140169000-memory.dmp

memory/368-339-0x0000000000710000-0x0000000000770000-memory.dmp

memory/736-349-0x0000000140000000-0x000000014014B000-memory.dmp

memory/2404-351-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 35d6b1984be7c947746f239f37aa337a
SHA1 900a70b073318fab5532401e60c351602b5f6f5f
SHA256 671d628befbec714b97542da1e42af795f65f619cfcefcf42cb90782c47c5e6d
SHA512 e38591718b14ed278fd980112e0680913e4e717c9763f13be423ae208f3d79462f1e4c9ae879923c15ba2d664c67a3918118a4802da079cbfbf5fa603d530bb9

memory/1644-356-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/4756-364-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 2db8d55247c64d2c10cb05d76af0e730
SHA1 98e6e37679a70e0edc653d06d09e3467b21cad6a
SHA256 c12ce6f3e316f5f3f710bacb9eb7d660037d79d4008063164108d7365b7b01c5
SHA512 92809dd083e4f6a4fcbd51b1ced3707d9710572677e1403f9085f02270ffd8a9f853fabfe0c1bfbe3f8dad7458a63a228cb2806ac25a7c8ade5b19408341bbb8

memory/3180-368-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3136-371-0x0000000140000000-0x0000000140182000-memory.dmp

memory/1644-366-0x0000000000E80000-0x0000000000EE0000-memory.dmp

memory/3136-378-0x0000000000710000-0x0000000000770000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 fc1b5e1925875a3d5684456aa9d9546b
SHA1 109f147422a3e2ceccdbafd104c5e699a7e306ca
SHA256 555cf60d7476d97d8dca93658676de846c93bce2a2c0ccb2ef644210cd7c5277
SHA512 4ce797ec4ba1345d6cab138ed76760facd339ed91f49fcb1fdfe8322224e70e614babcb79ac0934bbd1f95f6edf5cd072bd264bdde4f6bf7bb81f3861a2fbbf9

memory/3232-381-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4612-383-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4612-393-0x0000000000C20000-0x0000000000C80000-memory.dmp

memory/5012-398-0x0000000140000000-0x0000000140147000-memory.dmp

memory/368-397-0x0000000140000000-0x0000000140136000-memory.dmp

memory/5012-406-0x0000000000C90000-0x0000000000CF0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 c4bfce0bb80058d6e52394d271da00ec
SHA1 8731600d8cc28c279030833aa1ac234abe7d6a34
SHA256 c58dae0dea38f2f4a4f78b1374eed77911b2cc439ab158b1adf49aac6c597e00
SHA512 6db9629787f76d4ad84d89ee4004966324370401ca35dc83facd901849350ed7c033dfbb52d3903ea058725bb642b443dd404be90cb8a183ed4a0c51bcef07d3

memory/4612-395-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2404-410-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 c83e2edc197c6ed25731edcd848dd452
SHA1 1b8cca1f4b568f13f22e6d66ec4d59b03cbba860
SHA256 effacccc828d0b884bff7757daf224475400f2221f6630c609eff9295adbd0b9
SHA512 c8ece335720dbec1278e9bc7703fab66b37417aa76c0e63f3514bf7a566e66a99c822e1d69d3c903ef30f1dd44262a9224539b955aad30063adb4880bc5e0ee7

memory/4244-411-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4244-420-0x0000000000780000-0x00000000007E0000-memory.dmp

memory/1644-423-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/5060-432-0x0000000000690000-0x00000000006F0000-memory.dmp

memory/5060-424-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 ad524a2c12f36439d7ef25379d704064
SHA1 aa6a24cb8243236bf98aa5111a04e36d552bf4b6
SHA256 25efd6d5406ff5d7a6bf853c7b74dabeac3a50b696312e008a7b1e7cadb8bf49
SHA512 12bff194bec6983658aaffe0e17406591abdea67a681d55f853b25416fc31a14974ffd00d3175bccebedda7b9609b2c0a89657d86c91d1191a2f634dbd418744

memory/3136-436-0x0000000140000000-0x0000000140182000-memory.dmp

memory/2692-440-0x0000000140000000-0x0000000140166000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 d5e49a83c9e1244c14981f6b3300f81b
SHA1 8e361d674e4f24b02dc600b846c55adc5e8a1bfe
SHA256 6deacd7e680e0d3b906c31b5b795c2f7387dbcf11dc4fbe9d0daf9bd12f027f8
SHA512 42c61439c09b1479111a3a4b605daabe251538c78b40cffb48715765d22098385701d182269536d92032e7dad38785ce8cd3e51434af51b7afe0326440a2f8ec

C:\Windows\System32\SearchIndexer.exe

MD5 ce81ec05ce0020e8dd4fd7432a648a62
SHA1 a36fd1365d939248372279610e29b17be052e51f
SHA256 97f4ad991c4b7f010eee0bea522c2a6552665a2338103b1dbcb0c652b514e3da
SHA512 f98cc6aa33872acdff24425ba8c5e3568db7523b60765f6afde2bf0daaf86f5d3ec71784e3df673e9be46a41ec4e7d28e3f5e95cae5f727f9b1cfa037d2fc718

memory/3192-451-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2692-446-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/3192-458-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 0310c226542633924d9d5e7ff78a99cc
SHA1 444b3a3ccb904d01681715f1b13bb78ef96d22e1
SHA256 35a3ab3e45771884b1a04b033675af9f738b11edee8fc0c34359a330630bf2ca
SHA512 390a549305c193422c1957d4e65714bc8d4e3f48628020e2241f4c84baf3ebbf0030111c39b3c22d478c632ed02abf8cde79b7139c1dd165885d88a69dad017a

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 1cf23b0e09832a64ac19e5de573a6920
SHA1 ca7f6f9cb758ec43d985a2aa050e9950b41770b9
SHA256 9456da2945a5994b1b51e2fb3da5a8702396e765b013ed59b4b954b9052fee5f
SHA512 bb6f107176dad0719b619a4f5be448e1b413d84bbd9b70f006e519834add5fd9f0943bfa43691d208635eeb18ee35343b57c3a16c8bb5c8212a19eade4279a1f

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 d6dfe72fe19647d50a29126ec1f3e106
SHA1 82235c93973d3b853187c257ea72afb45642cf53
SHA256 d5cfbb6244f7de39e5fff5276648533495ed4fffb931ab9252d0e33490edf9a3
SHA512 c583db2f29e9ac8fb12cfccb5058b970f93789dca6b3d4681b1f8a07f6d26e79127f304b50d70fa32a88dcec09bf30799abff4c777f9e92ba6c6a318eb1027a6

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 7db01c54b506fcfe3775f5962db850da
SHA1 4f4fb140a5b3618e662de42ac3189f6458908492
SHA256 62f5babf9f6a2d6e7328731aa58ea308bb0f2dc7014df4899ee16c753c63c37c
SHA512 865419d3bbc50828d4166bec321cd7a9db5a2b2aafa70d51e8448e98261a5135d1a10000e5ff7ffbbc079176e00acffa561dad11bc309a47be7282069c23745e

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 6a4823ca22d0a3b75d0391c60fe3ab39
SHA1 13dab20bbbb8b6a3798abd4bc8d3d7ece9a75ff0
SHA256 458039952b8bb7f94dc94abe9530bfcd0e769785c90c942578b39601728ddeb0
SHA512 55aa442bf7ef0e4ccc2e01d34ff8b213d385ece249a00ed382fc29b5ebc30ba04e79da6d1314af8282950c6aacbfd1dc21c28b59e9d53da26f914623ea0ab775

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 f3c339d0a70cf42374b83dbdd0d85754
SHA1 38672fbcbdcb95685f2a27adc5332d62ea7412ab
SHA256 247ec4ac43855eac0f93a4a160bce049624432056c4f85842c8bdedd1e245921
SHA512 a01354dc72c7c3bd2f6cca9251850c46b5411390d45660d91c6c7aa5a7ffa970354967135097fd729b7b6b2b2230e1f5f5a5a0119c4d9f674334e103d6035b58

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 9643aeb21f48970a73496e35c4b78f33
SHA1 12972369423cbd1a15e678c464b4364c829ab728
SHA256 ebed7404b5eedf0105f26dccb01b13ca37d68aac6078026dec12f8a47cfbbbfc
SHA512 ecbf171e577f20be961f31883ba6c98ef2417ebe274982254bc98fb958162cf62cc619cfd0b647a58bd81d4fe7cf44f96332bd82885ba178fddb83d6f4c3d2d9

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 9de92c22b4a08bb2877099d6844501b4
SHA1 a483409bfa4c5f543a01961b030931ee4d05e697
SHA256 f98905a47a36b1d9b242729ac9405b84d2b88fef5afa4b093e03c6fac244435b
SHA512 c2753aff2744a483e75687c04b00abb979c5762e92a053ceb3e0876ceb64d4cd20b111ec0887cc2f2847e6ced435ebae9e068ad871e06e3f8c8e5fc6dfdd7391

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 55afba925ec4d003ff8448b4a6a37b0b
SHA1 4c19bf5244dd7bebcd01ed1e8db61e160a72d2c3
SHA256 6d3e47822b562e845a84e3d6539a970d97850384c27bd077c0461884596a8bbd
SHA512 24e6cdd94a7c24b6d8f117c1f9f05cf8fd55da9eacc26e0a40b35acde089a4c42a500d0c5e22b1e9060db60c70017bf68846f4db6b2ba600ad5d9c3c97eb3b37

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 49a40e4f9401236b79b1c3500b2e2d1b
SHA1 5ac61a902f62d37be18a4b12bd988de46e01ff11
SHA256 2c14efe03d249f4f9e28361e6e67692f338d39275b2dde97ff9cf20f45c59e79
SHA512 245204db579332bcdfa04c7abd1c487a0fe89db596620263110577b1b87c6564f88d82cc830bc74d0a64f3adba24f9ac7fd695393fb0e62d9a688db3e88f2042

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 3d02d4fbe9df2d6a06851cdba52df0d5
SHA1 7c201cd14eef3839622276f92c8c98422c691306
SHA256 a060eff1483a336661caa3010545094a721f50cfabaa3f24fa1ab16aa064a3b3
SHA512 6fff61ba48a569cd7df741f4dedaaa04ad630a43eadb44c94ed45ce4563d3fe639e7f82e79a6fb73737ce2ad9baa3806fdb26ddde5529df76f73c7cb8b0c227e

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 f25f32bc0f14c5351e0351e7a74fc7a9
SHA1 1e1cd2702ff4697b48679c6a937d03b61b2b64fc
SHA256 4cf23d886f4e8f88dfb3b86029731979c5573835f45df382cb967dc350c24d3c
SHA512 ad138da0d0f6190f07626ac2cbc57073d1dfd83e8ab38fab031985d789dfca4e3ec491f8ad5130013d1f9027a37f9f697a74a4f9401b9dd5c32aa288caf84ba4

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 5b1a6e2e0b3bebefaaaf4438f030b113
SHA1 b449364c6246c5ecb3169a189998212cecf37fe3
SHA256 3c1adb63600231d6fa853e691b2c7cc7e68f03b1b4cf0c44687a8b80044ac648
SHA512 16ddeb0b36089997b7183171e541885ad48e0a357321ad06608abea0c07e2353efb128b6f09a39fc7aa47bf95e1cd71725a1770674e84cb40f92eb89ea0228f3

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 412d85839fcdf5a11fa4228352869bac
SHA1 238442e469dbb112bb57b21f52d5e4fdb4b22e50
SHA256 56e0bdfb0af1ee1c15501528f1741b183a269d63918376226786b8bc5536cb48
SHA512 9973bd1a06ba93c5d33d1bff4eaf8e060face20a4fdb490efb66f5381351304cc5a050bbc3a2256f711ae3b433ceefc5fbb5cb2580d89de9b2f4be0e29937ef5

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 4e29132172d253e2d521972492484745
SHA1 19bfe86a6c592ebf4cf52bac60895abfbe54ae27
SHA256 ea46b6162c7d53b0177d09bf02e2e5b4bf8dd8bf5b87d241b3ac877bd4f02850
SHA512 bc3f2f07931a3309bd9fd334037da179d263cfc65a91ebf28208bdb74a11a9963d63cace749c101ee800074246453c240b2e0b6c5994ac77b1e4a00701e96324

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 6b6975557062c1d478b2d683644c0ab1
SHA1 86dd1fab7dc3d0767a4709e61fb865c564d161f0
SHA256 4617eb37808d9cf225920152d944a4778197f3035145c6e2c62f88d40b576416
SHA512 aad3d6c049a3c13de930ac7972885a29bdfa903c54eaea20bfddcea1be1892974de8a093c89925ef24bbabe899a1d6200cdbbb681faf1ffa410d71244eb1c9eb

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 6786ca3cfc3184b58cd8ae2074b31b71
SHA1 97dc5a110816758218712e6e2cec514abe2d379d
SHA256 4b1dfc129bb56e79645a34f6ba29b46e5fd15f6663f1ca77601c4659401daa7e
SHA512 694141bf793683a232c7bb1aec682d073ec71138b5383efee8fe84e26b8611549675c03b68f2c591b10853213cda15e1fb52fc3e76b6edc21345d932b749ea55

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 fe923372ee2a3e12652883f2faf928bb
SHA1 87c2df94ee2f124952a55c2d4c954bd1741f16f3
SHA256 6b22e4a1b0f4b1fe30949a96ec73e1b102a72a324246afcf7806232be87b3b45
SHA512 bffd7627b876920d6217bd1eba2edf10864ee690227b83343a28ec08e12e797dd6d79b0fdd438fe071e3135549a040a3534f6257138e43283d956aea115018ab

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 484e7726d12d448e42500ef86cc7a578
SHA1 3a97021bc78e30ef34483b9a82865afc48a7eb2a
SHA256 4bc4670cb7a721c9bd7678af367f8b73b3cb751364a294418b4b654908fbc25b
SHA512 a996922e6efe51c4d8d83e9497d2838db5ae98d17aefdfa70f2436d92a371e244e5611819881d709ff6aae62eee7fd63b927c916231735fc09c1bca97fb0f0d0

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 b0b2b3f194b4fcdad816d73346bcb356
SHA1 3c532dd1c96cc4869abe6b76de6166eff0681cbb
SHA256 0654441ca7ee63bea341d2cd18abff0b1cd1fa63a25447222fc263b8990fd042
SHA512 4186e14aa5041de09255da72a83f29b0072082665510d6af2a1fe4eecc5f286700f6490bf6d0612edbbb1b7668ae994b38a991b70a17d4a58d8bc574621e71cc

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 e565c24d92202924a71d29f7c7bd135c
SHA1 40c88a5e3ec5e6958f9f978639dead103cdc7d4c
SHA256 2180437d3d09969981eca0004b8d47f71f7e2460473d0faf27dc7f3aef8101af
SHA512 cdbb7451b4bbc0d1a3b3b4faf7ea3715fac0c1060ccde6277fe97a88102b4093dd2c7bf6b5abf5800fc669418092720e7de227365750a4830aa38a8347a16ff6

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 5d43db53c0bd745fc7c91d5fbbfb7313
SHA1 0f67b9bfb71b7b5c5c0dc375e710f485294bfcde
SHA256 7b19f84f6abfb6a7eeea90b73d3f7579cc93ae82208ad7fb1ae21b83b60e2787
SHA512 e2b885e348b4bf68822945238494989362445f396268af846905a5ebfc2c2c7be03697ad3355c2436fc103004be3d25d4035ab237cace676bb8fb4c396c16e4a

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 020be04f41167806e28e7f8e129ecdf4
SHA1 9cb1102ea4907f49a746d88c5d3bf2c5952c6509
SHA256 2a67e4fdcf840103d6efdc0fa901afaff4970f1630b5c4735e6b12f04fa77592
SHA512 aef482f86a82eb814434679cbf742573bfcdcca0890202bb67c8a86742cfabe4a19fe4b30e977e2c25c610803b84653e2f56d87d72a60b2d2b2a8620c86da0c0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 047b8135a60ddd40b707d82de66f9fd6
SHA1 05cc7356c56e2f0383943bd52af64aaa6357f4d3
SHA256 767b69cc94447127ac41b47c4fd7000968bf2a2654ca0a42fef714922767a3d6
SHA512 c5ef0ff17553cdcb0aed2ca720558436058cdfe07979ad48691f9721a4ae6eff517ff63f06e660a3108505ef0130149a37977d331ae8ca000f4c313d07cfc406

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 d8e64a5c13f38b8403396f900c7f380d
SHA1 8325b1f069d8c91350b63e306bcbebf321aceccb
SHA256 45d27fe94da8aaa7cc20b904e4a15cef941e46440f3ac6db4f1d16e6911f7ccd
SHA512 d46cf96950c059f8f44e3a01a1cc23dd88cfac1036219cb8d64e28b1c0e351793c6edcdae5e7697bd8747d9eb31b5a061d0c2f3aa151ba87e4934b1303648caa

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 390668d30f0a6766afe06ed444bdfae1
SHA1 8ecfbf435c5258aa37996057dcb65ae048433f37
SHA256 909d6eb884913737d88edfb8b0ae34bda33c67489e47809f322999480e941047
SHA512 7c6addb49ad8a500181b20d88b9c028b9156e8483c2bda72efc3929a2ff9d72fee7cbf1f9048895509ac8fbf8fa9da4a2c2d1053f5fecd5afb339aa5519aae5b

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 787df45e449dc1d4db2a328908415483
SHA1 a914ed9bab3d933682d224eed725ce58d44ef672
SHA256 fa69cbd5c8baefa28b5ffb56bbc426979be3a8b059e458c9ba3a07ae07a6283c
SHA512 6bb5f33681fcd933e5bc992f1181b6dadd3f7e49320723f8c4b1ea9667e65d884afa795d51dfa81131a69877da1a766eea7a0755266e055b018ff611bc90de97

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 4ad8b2e41cfe22a37db384c6efad278b
SHA1 f662c1c2db66d5b93b84c1559dcb4a75ac29cb56
SHA256 68e701ec76f5af709e9433858ea9fc3499b0b80d5b0bee40c1da26890e43e254
SHA512 852096ef13d29763900f9ede7419abf9a154b0b89cc1ea28c96853fa9becc4acf88bd3d4e51342939a1eb2f9cdcadb8df185e084efa73a6066bd17659bf122f2

C:\Program Files\dotnet\dotnet.exe

MD5 f3c668953d105306b77f3080e6419f28
SHA1 f97c136187ca8049c193bdc26b26bd73692eb5cb
SHA256 2043a76324c3e8c01bf274ac26f9c33890773e84b76e6a90a27ad4e6ed87dbb8
SHA512 4cccc97caed225fc79c3425c8424837dffe735972a1d59d2fccceb04964597e4b3edb5b59519167e280dfe946a85619e0dafdf1bca6cbed28bcb1523b56d50dc

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 5cce51752feb4250c0cbfabcea5792f3
SHA1 4bb1440ea796c8684d4445e858f06e5b80435bde
SHA256 4fa1190ecc6940d69d60be38f6f19ca4155f9b5abe93a6067528d1362f0e0d93
SHA512 fbdd14028fd893fe2a3a94eb6a3097903c65d92e4119a1167a812e3543d297876c9f9d641218382175a157954d3ad661628ae08de678afb1417f2b3e5d5a38dd

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 fb11a5c10de3068749f97c44d5014a02
SHA1 4d44603c59820f46c898317a521f75d21dab0bbd
SHA256 fca1b9a768a3e92abd6c7cff081173fb8431f1337c2e9cbfe926f72f65b6fe64
SHA512 d5bb47133d34278599c11b44d0dbcfd3a45362ebd37be70e84b7cf608a1d1ec6307ba70c8fab7c8751a2bd42f6403b90358c8eb65bd362b5fdaad9d5443e98ce

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 eca7974380f0de20bb481e5af775a89e
SHA1 b9acccc4afaf0cad8595f3ecfddfb6914f3abd44
SHA256 66c07e610540386fa1dfa8722a82c755053ef7d33c2b1fcb93bf1b3ab28c4653
SHA512 666a4abe1beb8eaeaddf3f1305bde17ac86c5292f14464a2560f600752d25d8d6e0a14e9378547cb554ce0687b72ce49dadb5eada14c670d8537a605a4a4c787

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 8367bf7b272955e1c7fb52be1c49d2fe
SHA1 fa8edbc51400855e928eae8eed26ca4a21a6612d
SHA256 5525852d66ae570c7b6f9e7cdc543daaf06fae8f36d481f3cffaaaa77105324b
SHA512 00b85af1ee8f2733d6dc313269b25d38a050259640bdb7c16dc2a6b0730c761882986401a3fb3ca76905a20401f34def54b5c92a25a45f230a084cad6b839fcb

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 eb5e37312c37dfc129c24341789ee12e
SHA1 d0210cb0c1f081efd1704a5828451c0eb0c099ad
SHA256 863e8b8b0cb755bdb9ece667657d92a013bc238c76a3bfb948d770719055b7fa
SHA512 0b5ff18034921bee7d0e1f2527363721ddb0d072ce47035d5a85bce8f44c1128308d0f206b726896f28317a7196f303fd7eed63cd517b027977332518ea42d8b

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 072ac2c0114982434cbaa9346356275f
SHA1 19b5bc0259a863a5deeb96804bc0b3682b06404b
SHA256 ed99c74d58c2d1628a2e6348b11a7a8d51db5797afd8cb9d6b7bc6bd3ffd340b
SHA512 a909e2bc2a41963355f78820a0bb0a591acdcc17a59f31d8227a818c51d648a0d28cce941832e1c4ee1f28d37dc43dfaeda06ccf6149cdac39e9bd3aee3d3cf6

C:\Program Files\7-Zip\Uninstall.exe

MD5 dcad831f63a5827dd21e19e12db9522d
SHA1 b3e7fc3bd8ce3c3dda4e4510127e65b54685e7b7
SHA256 214b8949dc3a26ded57515d9e43a78a06635d75e0ea5206a85e0ec6f5af5dd91
SHA512 31eb40ae4897885b1897f40bc5f94dcd8c98dc1c4370f25d7a714d02c9a4e32dbbce9a3af1d582bfdbc55065ed8144ff3590da9d95152846ff2702f8d4919ecd

C:\Program Files\7-Zip\7zG.exe

MD5 1d1ac18f3ea4c2099b2db5963c36b4fe
SHA1 5cf8adb40669b0bfff214666b5914d3032d4bca3
SHA256 a5a18fb98a85f752b0c853ce281fa21f0615a84e9696e2e20e2b135e584674d3
SHA512 7e8e4f90a15d7e257b3987f3e22502c1d202de6a39462f676665f309b84965ca761467b3f9c6c8dffc96c80520c6e9ecb3c7e448d76f8e262cf410f496e653b3

C:\Program Files\7-Zip\7zFM.exe

MD5 8ec461f9b39c4e494da3e67e2fdb3dc8
SHA1 2435774b2a3d56cf705e1e36bca2f74ab9667276
SHA256 c2238d219e02ee42554b41c12983e9890a97cf93aaf278cb45dbad474b9f27a1
SHA512 cbc4a54790a3dab2335808649efa92e8b2a9e644022945dae8d7e2b036a81cced7154cd72351b9ef44fedd914f94004ac4688b32c0d6d079080f6f0ddd9ba7a5

C:\Program Files\7-Zip\7z.exe

MD5 7bb6bcb885f45abd973fd5b60f1e94cf
SHA1 673d0837db941a81976cb2d02b1d6712303edb71
SHA256 9d81d5d7fb3cf19f9aa3217f31ca21218deac905a203e663d8811eeb6a2f4e6f
SHA512 db3d01ecf37a7cc2b38248b4f2f0cc3524a471c6aa861ba149f3963a3d743823e25592c849bac5bc426afe907a16036bbb5add9cd9c97efaec045f3810b14ecf

C:\odt\office2016setup.exe

MD5 eee74de443c872601b7a4abd85aab493
SHA1 098805908e9ff4cd92cbc00685cfbab9860061fa
SHA256 54ac890a769d85be8759c5bb64b32ab742951c957740daa4e573b70309fd9952
SHA512 4d39a4451899c09be54c60ab7b8e57e68eb3b458581c49ff7feb26e97e4eb9e926082656ac8fd85270f938f3a4b3b01b70cbb93d1e77188a91b8f90d125c0d56

memory/912-545-0x0000019212810000-0x0000019212811000-memory.dmp

memory/912-544-0x00000192127F0000-0x0000019212800000-memory.dmp

memory/4244-556-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/912-543-0x00000192127E0000-0x00000192127F0000-memory.dmp

memory/5012-542-0x0000000140000000-0x0000000140147000-memory.dmp