Malware Analysis Report

2025-08-11 06:23

Sample ID 240403-mmjeyacf42
Target 2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk
SHA256 fe863bcd7f37e6249fa5c496c6a9533df70f26f0f8e59c5100cc51dab31d8857
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fe863bcd7f37e6249fa5c496c6a9533df70f26f0f8e59c5100cc51dab31d8857

Threat Level: Shows suspicious behavior

The file 2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 10:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 10:34

Reported

2024-04-03 10:39

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe"

Network

N/A

Files

memory/2936-1-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2936-0-0x00000000001D0000-0x0000000000230000-memory.dmp

memory/2936-7-0x00000000001D0000-0x0000000000230000-memory.dmp

memory/2936-8-0x00000000001D0000-0x0000000000230000-memory.dmp

memory/2936-11-0x00000000001D0000-0x0000000000230000-memory.dmp

memory/2936-13-0x0000000140000000-0x000000014022B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 10:34

Reported

2024-04-03 10:37

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8dedc597822cf6b9.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_75875\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{69188FC9-DE03-4F31-9660-69825F846706}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000907e5dc2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf67a7c2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078fc5ec3b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053e07ec2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efc8c8c2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf67a7c2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efc8c8c2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c06a5c2b285da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_f645ddf8932198a06bc15f1e426b739f_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 udp

Files

memory/3680-0-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3680-2-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3680-8-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3680-7-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Windows\System32\alg.exe

MD5 df9fe68fe92358fdcaad5eb608c68942
SHA1 5b964b9d8b37e28f6b623b2ffef83537f0f37af7
SHA256 1f7a632b7eff019c8337d171f9190b5c8156c832c47d3e3fdc15fb48f352c2a7
SHA512 5a4d21cd2e81fc9b5e7f88766b04e19e2a7cc5f4e7304d454c0135bf256ba4ba2f3eb478443d231c7d04dbd59b964c7068a265ed539faf7a9371a6576a793eb9

memory/4324-15-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3680-13-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3680-19-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4324-14-0x0000000000500000-0x0000000000560000-memory.dmp

memory/4324-23-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d10800f518a6a99599bf3bab788577d4
SHA1 e80388dae70d5124a09a7a31bb7491756ed16dae
SHA256 5f12e820998f9deb41691e67584e1a389efbff2f5b821b896a3e73132f4fa434
SHA512 ee37ad08c7904e9767e24c04ee31a6085fef34aedc3e84dd7e78409e9da55b8b92bbfec8deb89ff0c583be8e81777095fd02dfa66cbfc3aa07ef18c7099e008e

memory/2604-28-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/2604-29-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2604-35-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 6a34a67db774dce0ea9e453d0c4fd8db
SHA1 3c2e70dd7c70c6e41e75e6539cadcdd1ae3215f7
SHA256 4e7baeab6f2e2c261bddd460f38522dde68ce811c8ec41e4d74b7e33a3dafe1e
SHA512 c51d55a3e3e6bd4246e9a766968b926160e5b710b4061e0134e11c2e4b7d1925edd6c547f7f1891d15045991c8c3c4978e3b6e50f273e0d87e4ef05f7e23d19f

memory/2988-39-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2988-47-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 5d766d2035d18a97c62b7e91b09d3227
SHA1 c7dbb0c2668c6b53ea5c46a6fc5e6d3baf5068e8
SHA256 ee04b002059068ca9ca3552d8f46ef6565ecc13ef970c1f3ebeb48ffeaa2c503
SHA512 b36c116cfc4b40b1b3143368c137c0347559da748e772819564b9000e21e542e766b91447e62e15af582e262a4f69fe3a2109bcf6dfc4eaff66174d1d0f16932

memory/5028-51-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/5028-53-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/5028-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/5028-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/5028-64-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2516-67-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2516-66-0x0000000000840000-0x00000000008A0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 52a37d2885bddab19d892919d93eaae2
SHA1 88edc88a346ef3aa2e0b0345d684cbb1605d22f2
SHA256 cdb7e228ab86a68aa94051217b5b393886097ff0e46d96db861b657da7584b2d
SHA512 13b137bf3d2bc0fb7699c0f9255b04be3e4811e6e73f3fae9e040fbbcb2e4895dc3f1897f93dec5cce54cd51a16312b6db36875d4c43f29b5501d729b8b12758

memory/2516-73-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/4324-233-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/2604-235-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2988-236-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2516-239-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 ae7e416a95ed80e31bf38f0d88c3b99e
SHA1 77c95a5b604e211a58cd028cb1b495e2a483348a
SHA256 09d7a2ada21bf8c607df1e84644eb22e6f8c4b40e7e579b4a76db64962eda256
SHA512 e8d5acb985f41f539a34ad375162a3e5947693a07403c0c74942f808350945fcf99c93f6752aae53d7dbca14d4cd06db1ded289aa8f4298a982e89898d8bfd99

memory/1324-244-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1324-245-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/1324-251-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 518ef44578d70f88d4e22f57363305cf
SHA1 913dc124a7f231fade51121bf12f1ed0d974cfda
SHA256 b4834dc9392e7db5386edbff9c95600d3715a0049f0c583550b1b2868f1a6341
SHA512 af7b02248ec0b3d65152dad1b6928ce133508af067250542ad8fc06165aa59476a64280d1fd6f89773e4ed61405793a544d0a47c42755b2d6d474bdf3f618aa3

memory/2632-256-0x0000000000530000-0x0000000000590000-memory.dmp

memory/2632-255-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2632-264-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 697026670dd9cecc3c25146308936832
SHA1 aa35db042ac495ec6423ecdc3fdaf772414296a7
SHA256 293f6f5ca9965b4d2483b71107a121feb652bc5ca8a4d0e9b2a0f70d851e4550
SHA512 0aeb6a6c5d8eb2599b061359a6505ecfeaf39628fa419e8caa44323088b1cc0916145d04005cf061ea84e82972544eb99e5d7756b50c005cb8cadb24d67e3573

memory/1088-268-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/2632-273-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2632-275-0x0000000000530000-0x0000000000590000-memory.dmp

memory/1088-280-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 099a86e9727276f271cd183f7139e122
SHA1 3c8c6eaf089487fbd6c0ddeaa21bcee74a6e430f
SHA256 5dc037091883356a6b625b6efc1192e740d4d14bdd0286c8d948d6380efb5c51
SHA512 9bf847e5e7579a3bd1b1900ee7bda0639e7901a23f42bd4a77aaecb4eb719c8b1d585879fa87f33254afca9fdf17f64d7f0c16a1c216448890acb420168bc834

memory/3312-286-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3312-296-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 c1122f7cb06b5082d94afed4746bde33
SHA1 6ea9febae0a2cee0b4421fcea4798c3ed1824e7e
SHA256 ea299ace7b1a4f6a6465efe14d5ecf7713d135ddfe30ccfbfd76aeff93cca50c
SHA512 1b8c9334f674b2f5a6eaf52b054cc8ce8c2c4cc8caedb097903a7bd1ed18ee619cb974aaf6c3d36c5b5d468f0ea41d40d8cb5e537daed11f5d571410e4f37497

memory/2884-300-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2884-308-0x0000000000790000-0x00000000007F7000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 921c6e5f6a954b4af4026fa1fa9aaacc
SHA1 2b49cd05a5920896cf230cc238cddad1ecb0f7f2
SHA256 d8eb0143a9a489c51e39b6269829f5ee0920d8b3f76cd05003146400ec956f46
SHA512 76c0cb33b6ae22a7acfdb3bedb07a97a54efab8c5429aa99091a25aa42e08dfe7cf01c84259e0cc8ac7bd2eeb46b61d0cb5982db1a4a77199901f9b1a5dfab70

memory/1324-311-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3272-313-0x0000000140000000-0x0000000140095000-memory.dmp

memory/3272-321-0x00000000006F0000-0x0000000000750000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 1e99e69c149bb6808484514cc57b05e8
SHA1 cb3534bf903a6632f43dde7012000b02b49d8ebb
SHA256 e796e117ffc87176152ce7843cc8a7b2e33618cbaee3411fb278e6711a16896d
SHA512 f7a8fbde75ed6e4bd9cf5f903cd2dfde7f42c54e93d24b4b6c950cb32d7851aa73e993f20365b7c07c1907040d18fc3da635c46b16eae0601401c3f72cad6b12

memory/1312-324-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1312-333-0x00000000004F0000-0x0000000000550000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 96bd3d7bba39fe581dbef6197faa49fa
SHA1 3fcef92b1514b5a0b9a9595e1248ef1128063f5b
SHA256 21127b2e8c5f286ff2faedc4785394df204cac0fa4b018c99b8a1aab0d730368
SHA512 36441a59ed435bd99dd27d1d3d4dc8585fc8502a5c0d991af36588f4ca52706d12a79d3f5fe44e64e6b058c78546f1e2c2c399c51fc16b8a403687b9ecfeb956

memory/2496-340-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1088-337-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/2496-346-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 caf2226f14bd76b3a581480fc2bc1969
SHA1 0ca9583bea7573b607c447407cf9b40b98252805
SHA256 480b668fc1f70d3735d67a8a40b445eca61a9653602b21370a66530dd9aa97fa
SHA512 ecb53f5ad4fe3b2e6d7709adfd706e7b7edcf261464421f2676522ccbf818c8171d655c73b202c2930d79d1c00ce6d9642e9a72ccab3d50eecb56e7c08b01a3c

memory/3312-350-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3668-352-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3668-359-0x0000000000610000-0x0000000000670000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 f6a3e89f7ab627a44b9f7fddb55e8156
SHA1 38cb0ae3d6335d7c38ead7d7f950a65fdbd2741d
SHA256 7fc2a2231f3b64559a6c3ec74a518f7ff1c65cdbbcfc79f9b961f1fce651ee8d
SHA512 51e0462e89861fb8e10b1aa834236d47b763749eeeffc3ef55bfb3489230f8f63523445826a8a61774efaa4f34af3358416d051aa40480fb34581e631c94af0b

memory/2884-364-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2908-367-0x0000000140000000-0x0000000140102000-memory.dmp

memory/2908-373-0x0000000000DB0000-0x0000000000E10000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 b4180588607b710ccb31ce3e87cd8153
SHA1 057146f86d4c7deb98b89731d87b0c63bac66f06
SHA256 6691198010c8c30302105ea58715345b8bfe0ed5eccfa647bdc1a183a9fef25d
SHA512 edeaff9009d0326dcf491d15f442366e23fcf73feb70184d65c5e527421d372c1c35bb931d72539a8833e54ea706ad1343841f6882c78b01de2c78629043f236

memory/3272-377-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4876-379-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4876-387-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 2a04f1a1959a21ef445ecaf9fe6af5ed
SHA1 b5a11eea14fd7a4d62966a078ef2d0f35591dad2
SHA256 135b75c37f36227027be612a261d844e4204a737689b56a816a0efb9821fb1b9
SHA512 6c1e4564d8a48691332171118c95f5f0f24566770d72746bb7593156fab2d48b2bc288692f11cee2185ed448cc021c5dcec028e49a5dfd10401a1d1ead343369

memory/1312-390-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3576-393-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3576-399-0x0000000000B40000-0x0000000000BA0000-memory.dmp

memory/3576-404-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3576-405-0x0000000000B40000-0x0000000000BA0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 d9dd25fd746b745764d3bbbaec0b3d05
SHA1 3e67edd2b6fd7dce8a83d521cb748d26682ac065
SHA256 01398f1650496ac125c37cf2e53a98e472414296eb0f5b158b9124994a38fc1c
SHA512 28e194d17181a153c87804a44a6289b372b5f85422e0ab2bd5fc346a8b820885d00d0055eae20269212f82649282b37eeebcb58650364dc698d8612673526af1

memory/1700-408-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2496-407-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1700-416-0x0000000000BD0000-0x0000000000C30000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 9cddcaa186f4266989e39a3c4dd84826
SHA1 cbd47349f265dbf4cf0e72237d508874d2f2a529
SHA256 1989d83deda1ac4f416484a9f58d4f1e3dcb19fcce0eb8686f364b37007b008c
SHA512 10c726189f8b3e8970d0974fbc10f537e3a0412b09598931d2e9fca86b6691152379def0fd3ba297d1e971bf684ab5080c248443750694273510277d72def4fc

memory/3668-420-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1656-421-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1656-429-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 bc848fc1b6dbc0c393f553cafa5e2d3c
SHA1 997205074e5882aa8898a5db4fd690f98fae50d4
SHA256 dfc6d79cc3fcbc36a97fda1b9542fda5113f8e652192afb53200e3b9bb9294d6
SHA512 1b3684f582be51c45922663d9fc963ab534f0b4f161696a75674416abee83b10bf836c0b1716ebb813ca14de250776d6da8cc53ab66477f2722b4d8e7c64f746

memory/2908-433-0x0000000140000000-0x0000000140102000-memory.dmp

memory/3036-435-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3036-443-0x0000000000C20000-0x0000000000C80000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 c941953347aa274971a3aa359b8b81b5
SHA1 babf8770576a3eddccac99ac2508df6a6af780bc
SHA256 378b5e46d94420d934736aaa9e02afc36ba6b5c44161fb816227525388259d5e
SHA512 610c1b87aa5254ddee2340e36ef5309b24f105874ad6145fdc028501fc7ec77cd44b2c3dad7a40753186fafb40368a739a950403ee4f6e5f9f54fc6dcbceced9

memory/4876-446-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/1960-447-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/1960-455-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 9a99a824694a1701957084f8cf9c662f
SHA1 3aabbdef199686765c83856f3f8ebfc182939506
SHA256 ab5dfb96f2e568b9eb1524472b3789ed2ab1e108cd384b0fd8cb61519f75fca0
SHA512 265cb36fb2b39b6b3a6983c758741a5c0c7f597d8b2ca0af539a4ff4bd28cb1bfd07d5f2842d8f72be171768eb38f168330d2b1a36e40b82099a2d4ac3ad195d

memory/760-460-0x0000000140000000-0x0000000140179000-memory.dmp

memory/760-469-0x00000000007D0000-0x0000000000830000-memory.dmp

C:\odt\office2016setup.exe

MD5 000a2e36d350534a4cf6493ccfc77370
SHA1 cd677257f8a83073d98e09af3b2f1a76affae3dc
SHA256 4e59fa433250bbccd7eb1f818b499b7c9a65ca1e6e7364a3aeceebfcb33fa1dd
SHA512 4f091bb41675882ebe3e5ba301233c3f9f40ab3e6f239b89a502edbe415cc8e8b3eea2dbc3446f06c06e17ee7788fc3b06acbdd08fc88828bbf8835aae00e38a

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 97a04281cb57b87b26702104175da404
SHA1 e7cac51ad51d14d2f42e89c5ae8611ecfb1a01e4
SHA256 a7ac9dd1e0eacb1d6e6e7a08a58f67ea0e3d4ec61f8612c3891cc49270ed4f54
SHA512 8f09ade7d10fa9de414b3af056f88d7611a784ff48b5af33acf4597231824015477e30d4166420a07b0241b289c236062bd13828b4d9931634f048e2db6bea21

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 a9b013fbbb9e000d33b869474a55fd98
SHA1 7f8a59f18ff573197e81d74a6b02eddda7b63073
SHA256 00de716354f41a10e30505209f67f308b51ee428d20e4f1961a7091abe8c020c
SHA512 3f2c9c9ab7e3985cf469dbd81ff1ec96d6ea8d70e6b765735276d8d0cb063e3f344b688e23decb4c3133eb7e42aee61fb1ef566222415693dffe7d81a5e8265b

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 ac476ca1be457c3570ddbb719bd851cc
SHA1 bd940e97c56034f15de33b568a97361ff0f874d0
SHA256 09dfbe9745e356b62aed81bceed8570f43d2f12a1c9aca3928c64719ea15e0af
SHA512 df6375178ae88ecfbf59d51cbd337d2095e734fdf8a72d2b67c5dc370e74250e64f19a96a6a30dd3aff458f2b1daf456dc65683c5cb7b107226be51f6572f56a

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 385a7dac8c2181a69d40eb10b958a3e7
SHA1 472a71c089f8a7347be104bf0f5b0821c9363cc0
SHA256 f8e7701603d3c42ea3a979aa1e412a7d162e73dc50668f75a755577655051feb
SHA512 92087c38ad10430b47085fa208fffb498f867bf9257fff3af76fbc96c18d3cfb43dc80048d1f8c5f73783bbbbd7bce3962ba84e02393f71be677cff2cb095924

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 006ec775191ac1b0266809376bd74968
SHA1 74e8c198c405f9b1a27cd1d3a1917dde2f742461
SHA256 d2e4f17537d8c2e6f87bc8520ed7d6ad26d3ebbd7688723d77bbfafd8fa8a5cc
SHA512 50eadb58463d4a3839f307605584946198448c7ce2e1b1fa718a6681e9a5c95e25a25e7fa594e91d4bed15c1b73b41aba0c4a4cbdcd814616997a116847396d3

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 dd45b2a5d2fd8987d06478ca1e8e92c2
SHA1 0c772e4371f88649e31643d75501a388635c757a
SHA256 765cfac5f9149e0a8b2761f4111de0fae043c394cff36f86cd9a8fbf6b723bd8
SHA512 ddbbcd221d718fafd58ec69da792357a4ea62d7f6a9d154ba16dbf12d6b43790d1fd9efe45a531a687bd9ce4d117e94a6448e88fd9e49164fc0f0fe9cb5741c7

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 de59382955b41422bc740b8383d8e4e5
SHA1 339b1de421fc6291b6149ebb6764f421fd92538c
SHA256 9b1fb2d3a72eb2b3fba4f80ba05b533ae0326773b22624520530c05fa286bb0b
SHA512 57413f07f9e39da9a393ef915498cbdae53b7dbc4dcb95aad1ba47e12f43aee43b39f4569df8a751c9d5a24bc46deb57cc3a832a228dbf195a7b7482d1d9d7a2

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 55393aa7769e1a05033b74cf379dbfc6
SHA1 e3514e8baebc5e9d50a43dca14355e01ab9f46a0
SHA256 56357f513db3b166dc2ae38b229a2b34ea15928e8357d7933fcad8d7b297c0b5
SHA512 f85a29c2ca23fd91613639ad5cae715e0762616dab3251c76d0365350816fee088e4654141687af7f83fba6148b419a7223a9ae75c561de484e7d9e66443e9e9

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 25904c88d4d368d12ab7a7a7764420d5
SHA1 2eaca7acb5d99750fe2c5dd18cd414374e2aa98e
SHA256 7ced285fe538848713679d339650cbdd649ffc833ba17bf28beffc772b5c8379
SHA512 da7f566e5cf4c4ee886b709b8d17136b990f4d2d34c2c93e1a78acb2b52f687a38a5fad8ec791a8c83f1c3b050b126ebc2918fbd9ed070443719fd7e3ccc2dd4

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 12fed45b738a13abea68d9dde9754a73
SHA1 0462dab6afb44fe44f1c1ff61e675581a540c284
SHA256 c3383299bad7fdab47525a07f8c223ab0a2d585356322b49e54c7ef88399cad5
SHA512 946457bfdf81a2954c87e213ff65588354f498da67b39922c7c1c7cfaf61ea2068edb880f523c028676795fb994e092b01cfc3221e5dccefff8eb12475cf49dd

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 c3d5fe9c9d7afb34d1c63f0915fc3c74
SHA1 29bd2ca9f1532d94cb234f7b50e64204e9882c02
SHA256 f6fc0819ee4d6530b4a408f25efe6e730a23297ef2c7bba11b8946e45bff5cda
SHA512 2b642e7f4bdaaf095b7dbaa8de84caef88beb872a8e6b18e6c3e10c4354fecc7e94d5e8a2d5163db129c0d92c8ccf08a5f66104737e62dcb76c32e291442b1ab

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 ee490e7936ab57f24c08697a6b7e000c
SHA1 3601f2ffb7dffb2d7809933dc080cf330672645a
SHA256 24a5d1a97bc0bccfad9a18961c2bf650f84ad8c73594e844c3df3ac3de241591
SHA512 3c57968b072a22a85bd45f835c1d08264bdf2ba5ea04fe7137b3594f88f434a1bdc1a5f48d4a5a91b51ef8403ec9e3060dc3cd03f837ff532c2c84fdcf05f47f

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 1a544004c3810dc5e97d28192cd47954
SHA1 4eac8cb5aba422fba060eb6c7500f2eb4df7783b
SHA256 034b8e92e22f83ebc4ff7b662b0d537cc3843b8c425f56e091a4cabfa8462595
SHA512 5ea1070f3e31032beb0c0cd5e4be4cc126b42d5df1dc0c33dd6984c9d68a708e4b2257c7161f89ad85ea95d818d67282f149e5f739bf5f8ddac4e5ddc12f1e46

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 a304e58e62c08daa3bb0146cdc9624ae
SHA1 95e8bbc2507c961c53f255920413fc2806ed0fe1
SHA256 865c9c6b58dc7da4ddccfc9e3779bbd1e0da5ce83b659df84b985986ae939fb2
SHA512 b59e25540afa92acaa9306ae04822fe6649c9d5fcb211fb26b661d5aef144b3abcd6e523863c6e9e5ecb17cf79e6ef33ba96c7f9b553321cedd54c219816fc30

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 5e47029353caf48ebd04d33bbbe52029
SHA1 3dba9bb4094e9b185d96bfbd7fd184d9e0e993e2
SHA256 097bb5f72f90333177bba9616e204bf99cc87f8fb3aee6fff74ae6163b4a7167
SHA512 fcb40c7c191000e345f5762d5053b99e1a13be6019b677f415ce52db7ade28af24e0c2629057b4c7d6e55aa20008d95015b7ddabf78e39cbea079d0c1f3e94bb

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 137ce9b2a71dd9dff7a6e3ce9faae1ac
SHA1 6c21698f5388a509e35cb1926e38dbafa205a565
SHA256 9e984830fabf8d08c736cbce7c74a311a2801325ed562a4141618b2a611219b1
SHA512 f9c292d09769b295238be4f3904b00ceeb4ae10354b8a3ee77904a5303c5ea059813cc3ca5fba4803b794ba89236c460b0e8809bc2e689475dd36c8de021fa61

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 4b88fe7e1bb05eaccfe95b2c21266dc6
SHA1 5b6c562e556ceb6da9c7c0b493e22907b83c6202
SHA256 314807be2019d526795c2202c81d0a88490e1c3adf60ce9194ba75a50022f8e7
SHA512 95e31790002c671f5c0a3707febe02969e56dcaa161890a92e2e5449938d8e673fd076a8beba83bcab0ed8eb001a481cb5aa0a446bc7cb7f9eebf6a31a8cca11

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 5ad44e1fa757a0c26d030d25bae43b93
SHA1 ac039893a49d339a27f6f3d6de6f7dd0a847e69f
SHA256 bc1b1e7b7ca523efd9ab077cc95cb02a85f1c93b4a55795e5f2d0ff2c4d4ab63
SHA512 5f91a95c1b62aa6cf58a5adc42459f3520aeefb4092c80c90261d0a387a2375636c57b95af0a0c5c06ee39254512a25cece8cda3533aacf2e66630c0c814070f

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 d14e5d62ba49c2d75291c95fc8b53ca0
SHA1 0d36e203d07b49aa977f882338a6a45f11791072
SHA256 a1fc061b14ba647b1d21fc75e2a390bf6f5cfb87d0b5309196ffae2263cb6477
SHA512 3575266603c151b93a572f734b447f224e77938d69cc0251b727201ec15e52cf33270cbb74e95d931e5550b739defb261bcdb2cc4555520cc795a88725bbc0a6

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 3e96a394af67c7affb8b8e0c28f21c07
SHA1 a38dd0c6e7c28dacb9d1e8ec6e99d2e743cd8647
SHA256 0a85c8ea51ade96ef050fecd55842ec83c27840e11a088d6f5aaa888089c6e42
SHA512 abd08dcedd5264bf92147fa825442769f0b08c8ae98920327539e584cf747b623b4c6fa21d2a337642268a6ce5861d689fa51cc45376ed27a73305fa40d4fa79

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 dab0307ecc2dde7e8b52d38f08328ecb
SHA1 62cbeee12f7dc375fd0891fa010bba61eb72a91c
SHA256 0f42dd1ef2b730d0a16bb995d77aaa58a4f1aded2da4bdc38ed0e8e92bf2e43e
SHA512 53f5dda5d3d5013a986cca7dd80d2f927bff4c6733959c8fff35f96a74c02e9c93ae724a6ec5881bd5430424fceb8f7b7534218e4ce7899f09ef51b1ed05d266

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 f10d52e7c659aea7afcb9b666f498605
SHA1 39e42948c6863e8d37c273cd0e49b8647cba13d0
SHA256 d8ed9916c13660ab5228a3bbeec5068c020d427db711ed839bac192e1b103772
SHA512 f00675622a36448d70fb04d6bd57b91d43e01799576925a7f4ee24b4cf1d3d234154225713eaff61adee2f8b41779bf248af186a6892c6a540f6e6c385b1b1eb

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 06d2172bf924808b126bd212cedf19ea
SHA1 475f106c87e56c6528f62f8d17ecb2cdba3a930c
SHA256 d2025810067c9265b6f4cbe8d2fd44a88a442bd113c0bf43f0c544674c80853b
SHA512 86293b35c4f9cdb0cccfdd82320411092740f987c5b508fde356b13e6dd0881ee9e9b7e51f8f37fabfc79ffa8d6bedc874c6b9dde9f26d09699afc9a0a057d6b

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 e68402cbb69621b4653805d036eabb8f
SHA1 345a69b35accd5fa5b30eedd73a41114331690e8
SHA256 313bb478a19e1fb0bd41395dccdc7a05a9053b3ebd1e05f84f075b1f2e065487
SHA512 ba7fbd69111d47601936047179cef0a7abcdfdaf07bf358efa8c631d3734c052c70b9852651b2d466b1b1fe5388f8d2a1f3428719415a36ab7545a75c39bbb94

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 79ae355d93654f0170071634ac633ad6
SHA1 b72c8b8cc00f56a5dc83cd2b8f38f85955beb36b
SHA256 8f88e0500b3cd19fa96a3bdd135f357a8ae6d4a3c7d79a13f67c6dbb24527167
SHA512 3ee56704f540b2ab0c0d3a1a531ebb43edd97bf115eb29855b557bcb1cc35a8f8efec3aac84d0689893c7bee0e9c7678a82ff19db988d66c14fc3dd15b56c3ef

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 a18dbf4f8c8d8b338ef44a0a9b6b9f9a
SHA1 df5142e3e1a8212b8081d6c705e19decb014b154
SHA256 37801221290fddbb6a40d175f16f6aa06cb14aa6a17e38aac0261cb065579555
SHA512 61cc59ec84ffadfeff3630b45d29dd697eeb44a30b95e6898d01dfd7c4fe82faf568684227362637606eae019da464f8033b18a4f460bed7dd90a460af6a9e04

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 67e0518a2e59f0aecf194b76fa1895fb
SHA1 7cee296e5b75bc62f389b8b3663df103f4a32890
SHA256 23e328bfe351678489b194f1968bb2dbc81e7c91df79cb71600b56e04752dfcf
SHA512 028f2cf70784817409afe455ec1b4c3dd61935198c3cd67842e62af969636a994148ee6d64ae3aad5802d99c677643a1aa68aba80648caca92ee15f53d11dfec

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 44304cdb597fe7bbbdec086aa522e95e
SHA1 9d4c3383df5e308cbec6a479a01df4fa98e69787
SHA256 291ed3eff64e0b48c1144cf82db9a5b9f2e699f13b0928210dc8589d2e61a80d
SHA512 41f4739d253a9ac1711756fcc26b6a2a8e1d7f8e9fe00848626493a7f8b9e75f5cf738fdb6c5f5c105a95a18d844d8e13b5bde415f60e84ab13632b43f77ce03

C:\Program Files\dotnet\dotnet.exe

MD5 df795199bef40adede4c7700c43a02e3
SHA1 0a001e6b1ebf6135d48049f6b682d474ab16a6e0
SHA256 ef13c8cf5c1744a5caa734cd0f0b5e46a6c685a7f466ba1f45285192d04a3a43
SHA512 80dca76edbf9a061576c5b165e1a9a7ea582e1668982857a1cce41a0c8fba059b5c89cd64d0a99b781c43bc18203b2b9c5d6f00f26cc44f3a72c3b3f6c46a626

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 a20a9b124801e435a608e9e58ec2affe
SHA1 1d0d06bfe2f4ee42cf23965a2fc642d786df6f4e
SHA256 ef636a97300c0f43fe22166f12a92c8a842789bbff77d5797b42c3d8523c219d
SHA512 f6becf503804ed5a2ee8f20c5a812a8acb5da6ee1ffc77ed539f5b7e27c499f8626be6c6af3c1672445f768aecc87cbc961c2459d917e0013ed5e994ad8935b4

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 166a8c454fff038597455e0dc20e2042
SHA1 1afc251d303f589a6aeddafde5c825e4f44a2ae8
SHA256 878e1c768d7f51098405d114f2d083201033e2bf760fe8ecd53ab87391fe424a
SHA512 a0c75736b59be413411302f1e1df317df003e051d643bf995cb0f096f0b5d9c23eac8a43712d84057ce87aeb2e7b62bee5dc2e76274dbf163403ea8311b2ab5e

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 26dc583cfaaf9d27755233caad308f21
SHA1 73ea3ee48d00459359e37aa90c44f052f241bc6a
SHA256 6176e6f0f193be148cc92aaf733d293b498decf28b6f5b2a85186aaa230ce123
SHA512 8477561a9dff71d2baac2de8c08419429dc738e31efa1caa86763a71147a983c8c2c4d155fba04afc9a603b4c879e5f7c44a598252d9a967a3c8c8ab8ecc5222

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 433e82ab1004172b94a2c2315a69f980
SHA1 80342b02d476fd1734842b2cc76d728cbf470801
SHA256 52a5a656ca62b2d6fed2f38723c18111f109b3570fa9f110073c4b13db545f6c
SHA512 f8ab5f031550b5ff7b16a2a3415349491b33568358176d4e3dc775fdcfb19643cec369c60039d99220e391a667f38a96d68ece7d916fe2fcb57e450efc9482f8

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ef20307bf799361523ad2b49560129e6
SHA1 8671cb9ab543099dd55ba9912a71152e5bc5b3a6
SHA256 c855541f326f60b5baae4f6bb688945964e932ed613f1733abce04528f2d924b
SHA512 f61873c430c3da424f53516c1604fa3342eec2bdd1694f10816165925a42d10298520b3404fc48020dc9b28613fdbd51df1a4c0e933fec55faedf259ca190c4a

C:\Program Files\7-Zip\Uninstall.exe

MD5 947ce44f1c78832fb51f07c8ee3f5f8d
SHA1 24883e9d4602f87ea5a6f312c3155d0fa576178f
SHA256 a560516491959e4dc10f4f4c4d072e12de8e6b4e5ab59811c7f4dccc7c2f4901
SHA512 ef0151152ae19b3efb23857bff704d63d0031319508045c5c379c8102eb998bdcbaf71c9953dcf868b44794c14ce67855ab2c8d411aa8366282c28d3a6804bcd

C:\Program Files\7-Zip\7zG.exe

MD5 ddeaac27c91934fe2bdf0dd86b1891e6
SHA1 5e5979423ed91b39372f4d1ba44f602f1dda970a
SHA256 b33ba2aa01590b8fe84f163d4962c59b7316ba8fdfa3f6c0c8f6888692a52b2a
SHA512 d9a2d95d1f25eaedfc92bb067b555e6f3a6a10ee924239387f9dd1e68e49c6934b2fc6ece4c111f719172f22a578555deb782db57b9cbe0a612b6864a0ca1055

C:\Program Files\7-Zip\7zFM.exe

MD5 90b3f78a7842c838cbc3ff264807c085
SHA1 0ae11b2d976b7dcad699b81a98164a23d0fb0a38
SHA256 d72417d5c065fa3b314962f4ba93aa80fba61dcc48b469fd2c5cd4f17f53e4c2
SHA512 b330bcd663724ea7024a0a4b15170d90e2976974c6126b5a72faa6f3290bb3437ae908032d17a60d9ab63a4eb397b8fd6d72c84dac560477395c8e4c7cef6540

C:\Program Files\7-Zip\7z.exe

MD5 ed1d8a12365de08ed0287e7e364da124
SHA1 14b1ba68e06028d8570d5933518ad9830d0561f2
SHA256 bed4b61165a6d0f5e441f7fc06fc3e92d9b89f6c96899d04ece98bef6824bf1f
SHA512 c8e9323ed67794fbc1a12f7ee586db54d5744fdee21102ecdfb1361ff14628ec11208708703e52642823e51f9fac9d83ba05dbb1ca466dd9ef7747e02824a2b0

memory/1700-552-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2316-553-0x0000029BC7FF0000-0x0000029BC8000000-memory.dmp

memory/2316-554-0x0000029BC8010000-0x0000029BC8011000-memory.dmp