Malware Analysis Report

2025-08-11 06:22

Sample ID 240403-mnsp1acf59
Target 2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk
SHA256 371d1815cc24c9f26cfc3d457b675bbdc3e7e98fb25ccde17c66ba32cd0ba0eb
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

371d1815cc24c9f26cfc3d457b675bbdc3e7e98fb25ccde17c66ba32cd0ba0eb

Threat Level: Shows suspicious behavior

The file 2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 10:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 10:37

Reported

2024-04-03 10:39

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe"

Network

N/A

Files

memory/1704-0-0x0000000140000000-0x00000001401A3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 10:37

Reported

2024-04-03 10:39

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dcb6c105205991d4.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{AFF521F6-AE33-4DA9-91C8-593A92655606}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a863321cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000603c2b1cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008afbab1cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009302111cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c28371cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004eb1401cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e85aec1cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052db091cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac1ff11cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001079071cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c15f8f1cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006715241cb385da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_fcf8ab6a4db6e358d362e728b733896d_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 202.110.86.104.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
NL 52.111.243.31:443 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 ywffr.biz udp

Files

memory/3640-0-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/3640-1-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/3640-7-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/3640-11-0x00000000020A0000-0x0000000002100000-memory.dmp

memory/3640-13-0x0000000140000000-0x00000001401A3000-memory.dmp

C:\Windows\System32\alg.exe

MD5 f66a1de63cb5401213a3b573929fe544
SHA1 3bdc15f5c7ebbdebb08e14d0cd99e6649b6ae9ea
SHA256 e16bfc888414ffaa7772b8818fa173c578a79adf92802daa74cffc7f4b2ffc2d
SHA512 99c5d229e5292efbdd4becd43dd663d1ea0c3ac944aea51abf8f84c3483f0203d3bcfff9d2eec3522891d452032dd5057a80d8cd44d381bd8e0358c143960ed8

memory/3824-15-0x0000000000500000-0x0000000000560000-memory.dmp

memory/3824-16-0x0000000140000000-0x000000014014A000-memory.dmp

memory/3824-22-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 19a59b022636556c3ba45b3cda713deb
SHA1 212dad50d845e251b8fc64012e84d2f42fc47a49
SHA256 2f5c94874954d78d022af33948945391550603b592f9f1403b42234da835a195
SHA512 208c8401df9ac2934b49df86448a7a810795590920549ee1ff91b62cd98b9a1c9a5d7c3ef60312cddc7200afd4d80195b2518ca881c21e766971250b0cf340d8

memory/3272-27-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3272-28-0x0000000000D50000-0x0000000000DB0000-memory.dmp

memory/3272-34-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 86fbc23d3524b2ebd3ad9d36b9561496
SHA1 6d353ebee77102f126b4708d877a560e653b871d
SHA256 4b6f80572fc991984e43d1674b76e64c37552103b0220c402941c4892fe80814
SHA512 3c3eff7df6684e10a28b49f2d88862873bab22bcdc7ea06dbe1407d1e197c2553e33bbcb9a98a09c07b1e60f95fdbba717292fa0223debae38496946ea0c3f20

memory/432-38-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/432-40-0x0000000140000000-0x000000014022B000-memory.dmp

memory/432-46-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 262e3ed16f9e72765b2a223028707913
SHA1 24d2d2f8c41e2ab6c1c9cef58f864c6f8e01583d
SHA256 b25c065861af4ceaf7d73618666309ba08a0719d59b5934789b21e8d2dc32bc5
SHA512 cdd68000902e7ee02d0a986021e683d1c68a421b066962cb30a8a41bfbd86ede88eef1f27893ab149301eb69a4b16286937fbc782a6d3df4723f0f27e728ffad

memory/2196-51-0x0000000140000000-0x000000014016B000-memory.dmp

memory/2196-50-0x00000000022D0000-0x0000000002330000-memory.dmp

memory/2196-57-0x00000000022D0000-0x0000000002330000-memory.dmp

memory/2196-61-0x00000000022D0000-0x0000000002330000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 56d40d05125dec9d503665c2a948c321
SHA1 62ae953d4215f07250a0e14ded099cbed872cbc7
SHA256 00813355706de362630d5a68fe805d40b6f6fad72a88569f26e883c889ae197b
SHA512 18aaf924e1ba7e763aca1ce91857f7051f33a38913cc215172501b7dde44f5da13015357f987f0e89c2a9f5aeaf2766c89d076fdd8322f5f75495cc9041e05ef

memory/2196-67-0x0000000140000000-0x000000014016B000-memory.dmp

memory/2068-66-0x0000000140000000-0x0000000140170000-memory.dmp

memory/2068-65-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/2068-74-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/3824-231-0x0000000140000000-0x000000014014A000-memory.dmp

memory/3272-236-0x0000000140000000-0x0000000140237000-memory.dmp

memory/432-237-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2068-240-0x0000000140000000-0x0000000140170000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 9fb3c591b1d9b43591fcfe82aac2e332
SHA1 1c82548d9d1e482f741efeb901a727a933a2cd55
SHA256 7daef0ea46c1b24312895b851aecb6b5a5f57575fa6749f98ee9d0626eb8b145
SHA512 045bf31d7ab947ef5f0954274a4bfaf302a1d6c4d983f9023cf6838f2f6349d08e603c4c1aecbd4fa1c386755502d3c45412f95441de104479c0ef7a20886b7e

memory/3780-246-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/3780-245-0x0000000140000000-0x0000000140149000-memory.dmp

memory/3780-252-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 d2d99719efa16e510784403969786c0c
SHA1 7fe2fe6e220665927e6cd53f5c6572d5e8515513
SHA256 6ca55ed0374e8be7057426b6bbfd2e8c8d3d145dd56b8a576a5ff6423bd6c733
SHA512 bc830811ae0defaf1b8994806643149b2f66829fe5725cc8892a818aa3bc683b9a287ef282c6c0d1714fe0f85632e43b642e7ed0378656d2a1dcb3ab0e941eff

memory/4108-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4108-257-0x0000000000930000-0x0000000000990000-memory.dmp

memory/4108-265-0x0000000000930000-0x0000000000990000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 1fd04ea607f1168e29d3981446430db7
SHA1 51664a18a5c49284ad9e52886fd5bfe5a20c1728
SHA256 89a50040ccb1a0a394db45b737d1344ff2dce3c48e74cfa3ff93306166ba1f9c
SHA512 1eafc4dea4ace080fbf94cd76156ba2f9abb9d2efbbb0e85752e125d21c80152719a7cb315ca5fffa4e3dedb8e0aae2fd4738491c22e72992456a2138eb6ab13

memory/4944-269-0x0000000140000000-0x0000000140159000-memory.dmp

memory/4108-273-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4108-275-0x0000000000930000-0x0000000000990000-memory.dmp

memory/4944-281-0x0000000000780000-0x00000000007E0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 349c1157d4e9785f0ccedfc0f1219a64
SHA1 8579cf8524e570cce8e0311fb00173bd7fe7f89c
SHA256 1e06a52031389ae95393f426cb82d07f892f8dc7120668fb941d6c61318fb618
SHA512 a9c168eb1d7b903f64c265294f9800de03de7b4719298c3aa66c957a43d8f49bb8c59364c030976857c97647fc28e1b207d83ba8f79bce80abec23ffc481cb6c

memory/4676-286-0x0000000140000000-0x000000014014B000-memory.dmp

memory/4676-295-0x0000000000B90000-0x0000000000BF0000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 36adf8d693a46fc0a93bf96ea3c26ef4
SHA1 c335977fbe82b7ab9e97bfe612eec31270166c84
SHA256 712a525d03053c71e81b444396258f17dbaf4679e21b51b218fa994926c09ead
SHA512 56374bdd1882da58e1b97b2e9d2a105e4c7f9008edd1da69da6f06296661cdffb5958f4af2b26ec4c3798bce61956f3cb14dd0c85e21626817ea6ae7dec14d51

memory/3580-301-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 398ad2d4441088f9014af1e3cf9ebc51
SHA1 923b3944307fc474b4c54076281125bc2f2637a4
SHA256 46d8b0bb7c2b930cb63437cd638984f3be6d6005467929a897072a565a76a25f
SHA512 4a3291c241fd4dde10ec9e1ef5ef2dfca75feebc0ad88a4d77566d73c32d1c0cf6a3240f26a78a4c9aab4d15b4f93e8afa5ecfaa35c314d17e98b4bbe648de90

memory/1756-305-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3780-313-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1756-314-0x0000000000620000-0x0000000000680000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 c471931752f9186163ac2aeb4d8a70ef
SHA1 b48fa2a732a6d679062a1ffd4b1f0b86653ac5d0
SHA256 3907713b9e6a4f10acb2007f125c544799fd233c664c6c28ca0627196edacf6f
SHA512 5703970921ac42f53dc109156d360f738d4085f942cfbf792fe3c6276b7f8447c85015597706b2ccc2d24ec2881a0295d42e8f1e5513c7e804ddb7f03312f301

memory/892-318-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/892-326-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 3bbdc9204974ceefa297707c900c7931
SHA1 9e7ad005fa13e73602e558e2ad79c155e261a939
SHA256 56e00683a5539294fe4cb6069b6ff2ea6512c63bbd10d7c665c3796fc067850c
SHA512 75326f0d7079875452fd57b0c67876a80890dceb9cac653889b78e354417ba0f537ae43987e7d04de8713e5bfb567092310d055936485958a981eeb4963d8beb

memory/1628-333-0x0000000140000000-0x0000000140136000-memory.dmp

memory/4944-338-0x0000000140000000-0x0000000140159000-memory.dmp

memory/1628-340-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 d8290b60f308768e2df4d2e9e8890a0b
SHA1 686d4c67ab24fa541a75e8a79beddd63c920a205
SHA256 c1d1ea07d323d4daba61606c0bfdd672bba4c9efc38159a9c5443088cf4973cc
SHA512 a7f5fedc2f45192f210089bb73b9782bb83cc4678ddd08f6cb4e36881f7414aa2da580d101e7f69ab272815f610d9a831fb5b3fa1d07ab7ea3648f1e57e1d375

memory/4004-343-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4676-352-0x0000000140000000-0x000000014014B000-memory.dmp

memory/4004-353-0x0000000000780000-0x00000000007E0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 9cdf08e317abaea440374af50f398ee8
SHA1 7ef5ff2d55f7c65807619d8e727e1f4c937b1ceb
SHA256 9acba89eeab3c994664af67db7f256d41d2db78ead8bd5353cda110f2b071514
SHA512 d698a5b81418d221c3306e2e47238d3835a6b02916a2f49993916b1ee0cf974adad79c1a589d16ebd5bedbd50151943608e55d577a8e13e17750766923022ab3

memory/1096-358-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/3580-366-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1096-367-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 b9d1fd9b8864c07a9767bcf8f18dacfb
SHA1 5b107e33bd6e68c792fbef5bcda8b4866874e9f1
SHA256 b59a340fe838f7d8706b182665bc36800b1e903a9f5cde2d3bd6cbdf679df5ef
SHA512 3d29384db3b1782ab64105507236c616b73f4021de637fbba311a7e765e93b1949fe7a80b6592e31f86927122946e108248dff13d60db4666b0476edb8c15207

memory/1756-370-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4060-371-0x0000000140000000-0x0000000140182000-memory.dmp

memory/4060-379-0x00000000007F0000-0x0000000000850000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 6867cb45efbd1bddd5ee32e6b6570919
SHA1 64f8a948ded4700ee61c2e1fc913fa57eccfec92
SHA256 8a36161a86b1fa06fc46c3aa937fb0b8fb9209669c3b045800620607ddbbfc70
SHA512 c3d07f7f9c1aadab9d1fb8d62f2ab8ef2a3a3e0cec0ba5a8ede2a7432b130b2d528d697899c621e6143be9b969e8c7df11bddb4ef3f87c3418aca79fb4c713fd

memory/892-383-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2928-384-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2928-392-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/2928-397-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2928-398-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/1628-400-0x0000000140000000-0x0000000140136000-memory.dmp

C:\Windows\System32\vds.exe

MD5 8665a906004f7257f092ae4e5f2a694e
SHA1 23cc050e172f247c40343b9fdf69fd9a77b4d625
SHA256 b5366fa375d7bb9252e28f608e58d872d95e311b9c224cb6ac26d7482ba0149f
SHA512 8086fb6ce07b33ed484083ef9d9d62d89fff5f9f8f33603105afdb15e82719313e2315f7e807ed1ee3afe20b494238193d652392857db99a710d0b63a92b0052

memory/2436-401-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2436-411-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 3ebc92308f16fae412a89d209497af51
SHA1 0cb635a8c6f369333630705bd55fe45912079db6
SHA256 b6a0e0e5019a408e0a716302da7994608ce4ba971a53f539e7c5dcbfe1332176
SHA512 20764039a01593cf5e6b4c54f85de85122e824ed78f05db929ca74c8b2e604fba658561e78b1928c8297b0ca7e4df1a5c0f1d8532d3ac21d6a30a6997e83a4ff

memory/4004-413-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2732-415-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2732-423-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 14bec35b1f3933256a297a34eaae0754
SHA1 b77607055b0dd75c082e3b3304607e6f6a30baa5
SHA256 52c3e9e87bf3370d8e09e3c8b82f7c90f5c7fc5e34574cba25e86883c49d28b1
SHA512 f479ca353808c2ec5eb2bbf3ba50b9f143a2a93e3c58f65a2d91f406cd785cb4f8fb0f6aa6801fde08c30f8fb094c33a5e622d23da5c67a39d5df26e727c1614

memory/1096-426-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/4620-429-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4620-436-0x0000000000BD0000-0x0000000000C30000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7a89564d5afbd296721993df14e0e1c2
SHA1 0d1912fe816a5bbdb0e7c9824faf970cfc3c3127
SHA256 17b3a3bd1b755d6538462cf8e807400f12155d3cacf0165fb3f95c9738b8244f
SHA512 b4e6898d8e155630b6ba901ef15752f77d52371ebe4e23b91fd53d0804cce0410a9c489a1567e9324014eadc61b3a0b134fe98480232f996167d10bd25365435

memory/4060-439-0x0000000140000000-0x0000000140182000-memory.dmp

memory/4444-441-0x0000000140000000-0x0000000140166000-memory.dmp

memory/4444-449-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 a82d6aec2f3b6cf474d920d990b3bf12
SHA1 553abce09bffcc2c215edef84c97f2e07f0bfe69
SHA256 3e6334ea43c472ebaf82a1ba08458e720a82fa4ad32604137d9b37685a5fa437
SHA512 442d1f5d2327b16f1ed052f0ea126b100de188da9511d76dc7a1ffbacfb91fc9b4aabde17bd0f617fbcbeafdafea0cdae7cf40f47911197d67f939ed709dfa9a

memory/4592-453-0x0000000140000000-0x0000000140179000-memory.dmp

C:\odt\office2016setup.exe

MD5 4381a106f351725f7a1de8fe7a241204
SHA1 4d7b942b682bc72a394e00fbc270311ae295f2c6
SHA256 1c52bdeb7b70a7f4e32bdec423a6f899c687a89f2074a1beff89790900c49cc8
SHA512 7072c24cb8a066a31e108d5e67ed9eff16ab2904e3c7c179ee382f8e0f9ecc99e73374be52252f477d12fd9857cf0b8c08e41c83eace5204b5fb4826f127e566

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 f457e38010fe1621cd13910d9977652c
SHA1 246922a7e61b620e311bd8f7f496b381f9355796
SHA256 1d7f13a51683b8c65fb22fb22091c745a5bc7d5af2d2c457cccb955c81df0cd4
SHA512 55d77dbc0a1c5b7dff3d954040211f73bdcdd0f38bfd9fa6739712b3f4f8a6513801dc777e66c76de94f393172121edb8e049f959d96f32db75916d191032e15

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 d9a3483f34b0b7d0705d0d858847418b
SHA1 9fded3d01c366993604c6964070f0d3912aa2c4f
SHA256 b7a8866df3afcd931cd78eb73da74dc3bc4fedb8bf0bb9d3433fc49678b64f38
SHA512 ab6b9cc2071b7e3376185f281849ce4bc5c0a13aff1ffb865de9002a24f1421c6e057cd8ce551c259d0f8215d23b4c7a9c1d490e1ab61de304c04a94cb54147d

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 0f139a8d1316b561476c2ce0382f1e75
SHA1 b4c41aa0c12e4951d56d2e3078465adc2f8ded8e
SHA256 93331be1fc65feaba2e42da9d2c51894f7e05329d73b8060d356f76efefccc77
SHA512 a9765455cc70f4946ca7f9db21d4380fa340f2d332888043a36c92812a7a02363a17df96b102dfff3db8b128941f11204c432e588db78b17daefb315f91b3188

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 7ad554ce4234d1559983c37217560a37
SHA1 787b894e9f98e855a8c8760a6849768c0968f10f
SHA256 e5d5435be2b5baa58e00400cecbb628487eba3e77f7693d50fb3c28ccee4df3f
SHA512 a0d0d9afebc4d86b1bb0aa806230dcfaf7d269b01d7690c7bdee6ba9746a18011a5375dbeb799525b2a9c4319e840f37fa99af4110c0ffeb7f69a5dcb72b6d45

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 65d08c327551ef33ea0b2c4bea591d15
SHA1 a3b4875f6b7d14389e59cda5000563fb3eaa1d49
SHA256 e1394dfedbff04a1431977b78282119a8d0f596d9ee7304be2936f12eb2efa0c
SHA512 cf5f0f02a1a9e83b9d73aea67b8ee6662e23756212f4b2cd9c58eefe8eb893c0f441feb5d98fe60fdfe0353befdb2ec0992b1be96ed80dc18e70076d1301fd00

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 adfa12fdba7720bb19dc7b97f0bf9585
SHA1 64fb657b8585dd585e823a8e771ce001013f2390
SHA256 45bfbb060cf7b8c64c9f53c2f18ccb2553479bbb86611c1db61cc250b1752112
SHA512 cd4d44f4fb662d0439fadf8d75422dd84371c9261f7b42f81039ed8c1aa16ada8e15e49490920f78a2afa782110597ddd77d00b32d9aef205f1f64fdf166b8ad

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 e0cd86e43c4901728384da007da84b00
SHA1 d6bb59584c3fff1ac8bd30708a2a9b0ef14a1d77
SHA256 0ba8b1d860ca5248c750d39cea2dbf8a04b759c0bbe93579b0c681f7f9151fbb
SHA512 29cb6e05968468d504d8d686eb00746d3fe7e222a67bce1ba5ca4b8b8485aa6bd3e591240827bc683f9851b5b7e31250fb7d4e5daa6c569c745869ad2f006c0c

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 57e9a9298f21ffea26bbf507442dbde2
SHA1 b976f48d91f47b7607590aa758f0ffadd714903d
SHA256 6c66dd66536e22d81205dba104bfc8610f60e278a859574975c98679208fd76e
SHA512 c840c1c0f5ecc1c566cd68e5ba46e8dd0a5e2b1a57e047f7f9a8cd014a33dea2ea15c94817a61b7427f8d68411eb275c052948c68d80bb984b8b3994f818cd1c

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 3b8685c1aeddd2224d6f130421e46ad3
SHA1 acfe0114445214ff327027ae4b07199e81ba1148
SHA256 b85f6c876decf9addab6e1de9107a1dde8ec66f956d62450f4ae2f6f872e0774
SHA512 7c81e46e22fcf3d55a1b146cae9d91bd68a0ddc3c947103fe698980fd87eee9a2dd39a85eddb6600d938fb3600b355076869c6880fc6b37e3c0fa0de4e48392d

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 f670878343fba42470056e8cae6a0f88
SHA1 06132a64bc77006ad7098069898efc473015f5d0
SHA256 0a12c1f29b8f62d43ef7b7aaf20cdb4215a57fef46e61e2cd8c239c31769d1f2
SHA512 3803d6f233811ac35e87f98e1576fcbb0f33d17a9630804fb482f1353d3552098af668a621f891a087790741e81e82604fbea7941cf6915726e9b0d81bba8017

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 9e1dc5c9c82883b84d8a4f2f10912bc3
SHA1 cf7352e6fcaad72f863392a815b11e595abae597
SHA256 222da900c615809df13b19a36682497cdfce332c2170603aa913745d7a05cbdd
SHA512 181b9335fd4cb2de2e77488940bded676847cf5490e5250b43db2ab805a109f06e9bf924c9eeebad4390d360a5fcdde43ffa0fafef29a11698c1f8b09b8b061f

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 2c2eed65eebd83f4dfe5d4da28374cb2
SHA1 9e2d75a45f00d3338446d8936d0d0d5c4a670063
SHA256 800593104334534da8216f558188541ea520d9453d2b344a5960e2e1bee3e32d
SHA512 85c760314f439559bdc9106544a40bd9ba24497f8a2e19930ff190c9ba5c6473bf4dac81fc9e9e77bf8028fcfc1e7c8a49210f7802517e0cc4bd5c3f5efa0325

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 9d8605e1d71cc1f4b424eb2e9163dd72
SHA1 9cafc88e8ea39475a9bbfe6b12967d79b91a2c2e
SHA256 1f4b2bd20956a34ab63b4f63eb9406f13a36f3844a064d55ca417daad076a7cf
SHA512 08c3d6a05d5a0ecec4e9e202d3a967e7d4fa7ecf263e6b35127db3c5e5029aafa48edffff6e296a53acf1e415f6c64317b3d3edf12e24a21dc69f631bed8e424

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 36fc465ef7a0eaaa77e6025c90ba5232
SHA1 62b40a0eec0f9f5e77928361367de03751229f60
SHA256 58dfc1f4690b07ca67f771ea3be1d2a42831a68a7fce2319f1e2bab81de32d53
SHA512 63e4897d1ae6ef89f3afb6a05075d6c2846c71c216879e49f85631415e0cd72fa3f0eb245b2b5359bd9062c9c80f09caa8167138487f903ca6d922386b1d7a3c

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 75d7c24601f107470b3c0fa323315fbb
SHA1 5196593288606825763c7a8faeea706f1a2ea658
SHA256 92d55bea89f1350bb391f62516125e163cc44d643c845442720b9b58cf99f9dd
SHA512 d8cc9761361e186e4a0ee9f79f27967613688c35022053c269ccb865eb60acec9970c3447121b8ed93c9ccf112b3621a83f5437e22395656023f45bdcf295a08

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 08db5d6e89bc08729888018a32cb5c1f
SHA1 773aec0fe9c95f2abd083be7dc116d0063470356
SHA256 6d1643533a2df6a24f9a30adf4776c8a3e40a62feefc394b8c486284d6b3e243
SHA512 041261c1633f9cf13851a5e596e168ae824c960f3407175c4df78a76678ce17c201601205655f73086107974293b8bb528ffa9ed64aae4325a243b03106f61f5

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 60da630ed51fd577db9bf287044ec314
SHA1 b71eb6d2722a904f7f68b342c316dca00cf840e3
SHA256 0a8ecf9276d3d954ddbf340f4d36cd870cf528b5b8347286d4fde1afc9acadf0
SHA512 3febd3c88ece35c2cd2f3d3b1bcf4ed7ea9cfd8e98547914def27091f97e8ddc2f8a3bf856c5723ed9c92e1083d6571e9c6d7ddc38f5d8424ba2a6304be7b343

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 3e724e754def8ffe2faf05b1e618089b
SHA1 d4af13059d61af1ebba048d0bd002f461cacd1be
SHA256 28a3c1a6166f4184bac1127ed7b0115b7ab17bfe235e9bf055ef29899491589d
SHA512 d7b2cbac92db4677eb2fe9457dd48af562842fe567e06742ef87e577454de03745a25a56d4e797400840d55ba1aafd51778676dea72eb949be3d0100117193bc

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 883d9c61fa8630f79003cf4d23e9cc31
SHA1 62d8860559249c506022379371de946bbc96c36a
SHA256 0569908716434da39bb8117e1c508b522492b6ef88a5e613df7d5edc4235a955
SHA512 f42fb73147c7e3c82ea5fd2932eececa3f42855ad564160ef3041129490ef6413b8cb3f64b1b0ee4f55ed5462056ab2cbe7f15f6507253df4b5b333ab0f0419b

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 6b50f80b43831ca3e109cb9d33fcfdff
SHA1 f4f3d4a65637cb8ef6ea711c53d3843c80af170c
SHA256 f35d31bce237df5daab63b7da8f6123379ae3b046fb7e0dbc540e68ef3e80c57
SHA512 2d0e35f9eca7d286178d397b3920587a61940f76642471e6d79dcdaca475248c23772c0145f4afad8afa535df11c4cf68667ef41e38ce975aea626cf04ca1dbd

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 5c074a715b3799d976ed9c3b01227066
SHA1 d011eb0ed14f123e19c8aa802f57094bf4ba9f6e
SHA256 5a85569825410997e84b794a87b7504b213fa297cd70bd3e0127291462e91be4
SHA512 e2763b6bc4d81d4e542acaf3937ca574a129202ec28476f203fc21961016431d634e0c495a2bca4f3ad69708420ccca5afc8da5a5cacb3a248648485f18b5f6e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 ec5f56be072e359bb53a7cfd6f0a595b
SHA1 3b537a577bbcc968a7779449fca180225621e1c8
SHA256 ea8173d4adfe504417342b67571bf4d556ceeb773bdcf9eee9db1cd0de17d33e
SHA512 de74ff283c0b7760bd5d8ae9300e88ff1f0382ab05c489f7e2f7aebead9265e0b78de3317ee7ebbc9125b87c2809a232ffc11e5fd001a71b78de2805f9246125

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 80a85fbb46f42d05d517d93dda8f033f
SHA1 23933ce25832d84de35013a7d783f24695bf974b
SHA256 6608f3722113332e728b431a6e55976c5005ccec24ade6a36a4034d63927d142
SHA512 dee2112dbec4953fbe9de0b9f8ff83e25fb23d3b3ea67f1fe5e853efb9797d7b8a0b6c9165261104edd20b0503f0ab89c620558c091020bf62cd7168b3340002

C:\Program Files\dotnet\dotnet.exe

MD5 7761910d28c0747a6f101e3ed201b4e8
SHA1 35c440f08ec20a4425dbadafd3b71a14390a10f3
SHA256 1a15eb5852c25ba4407218dff828f1607a4d0a8d827d3da6a8ae84bceab93aea
SHA512 cdbf62da3631083c94bf7d835581cd9db9e466a63dde71b40cdd37d42fa93c919a4d7448fdfa95d5edab6d0fdad2c72ca7982f2fe26b92576cc9775c8b74142b

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 0d51b6c905887b8fff213378cc012e5a
SHA1 6c7c3ccdd204f5b03200424a59adf47c82e50d71
SHA256 efcf4314f56658ca2d60b67dc59d66f026d3efd95afb75066125d86259838d22
SHA512 3980547656d04eb30dfda982bac2a57dc27e9a786f4c7a8cc3a5b6826d5fb556fb148d0363ffc8ee78568abd8b371b8d83a893868de0dbe6686b51e6a2aeb398

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 4e5773251505267111ed9fe28f85d813
SHA1 194dd0bfacab21867695db1bb4fb9947b0ec465e
SHA256 6020f2dacad223c89ef964feb87fb87a5cf1caf62f1507c69c45d0717a946984
SHA512 a0f985e040af2b1678e18f6398d14a54dca4d422b0d911f79ed335249f438bbaad23c40380ac16cefbf5ee411cc37722c3d0ce41298cdc4f0e2718f3512af7a5

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 829769ef1c5a1fbae9602d0c300bd375
SHA1 a50102544d8d5c3ddc812b75e0bceb0ff6f489b2
SHA256 f04661e5a169b9926094911a3c803f774f1decc725183fa84bc759c6effd511c
SHA512 55f84a7fc14b6258918f36f44f6959b1ee4f855feaeef0b15bad7a4a7cd8d3d3072d4cb045ac8d5068119bf5633e643844a6c33043c12aae2f96aaeb93182809

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 3a2c2b0b688b0899d33cbcb635b6086a
SHA1 98df17dd8b3fd5ae3ed37042836a755a7a62ec65
SHA256 edacc44fe946dc0760a9040c3c05271cd0e4c396cbc33d60af68116cea31be71
SHA512 d1157aab25b6c16b3008a8ab3110623b89b0015e9fe30d1eaae2082d21ed34638dc6a3deb7a96eeb28c27a64f574f454d81d9ffd5931e739b4056ec1288742c2

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 33f89b3111873fb0abf703fe92e59969
SHA1 575f4369fcc9488f6e09f9b63a2f91171a3d35a7
SHA256 ad29c321541d7769496d3ea9ba341b663f1fa7359203b3f16e6208414dd89151
SHA512 57b14d9e2cc2e29abf562662c100f344198e29f29bed3d6cba55b6396a2173ec7afb9ae0d6bd766845264080435ca0daee2bf2df162a488a44cb95ab803d4d0c

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 c66a3cf89a98f03e348ab5dd196d4024
SHA1 38cd027cefc495664f3271b837f5e0fe9391d817
SHA256 77c73bf75748f9aec4a4536e7ae5377a080b1936df4ba31afd248dc8b71a1e47
SHA512 335370209a0ab78254ffad91e665e8aa6fcb7b262fec4683849d007cc5157c4864d5905b5933e065a5c04be1718536d153e9871823a2b11ecff75d2692ac18ea

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 8b8b84504eee7c0048dcd2f6befb5973
SHA1 acdd982bb07497c2c7b6021f2cd06a5cb917e645
SHA256 38d1f1c5e1f12441b7e6f2a5162d95ec347d4bac2a496d00ea0cd78a5de9d521
SHA512 67b5c03f6a92ed6897d07cfbd63cebe9f02b39c5f7e1284a822ec710af584c403888583b81fd8176678e9de9d62071514ece676a0b953095032dbae14e65e87c

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 b20035a34796c46f571375c8ec2b9220
SHA1 6132247a0301354a31be61d66923f346253ed8a7
SHA256 1954ad85f4c87705c893b5cadf5145066b179bb818ff921ace2807a7ccc38901
SHA512 12a77acbf872ce6009ffd148c650d4694449aee0ca5bb143380e1e9cb83e073d8628f2b67cfbb089d4d9b65df0e8284ead9bd46919f6e756d22782e1ed606c03

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 8673c81f40b9bf782dc9075bba1b6b0c
SHA1 1b24d0eb315307a054cbed3e15187b1207109e92
SHA256 3a0a5460681b1202d51c4b2685f0384bc73f1e77f0dfd0227aeb917d01394ff3
SHA512 15f440eb8162872b0814baf6cc1373349727c7d59f2c11744d31590bb3c5427719c1606ade140af86d0ea5c7ca6f2affa5137c3d47ada1fce95bc63bd9d93af1

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 361b20f693c858cae7db7f147d177ccc
SHA1 69928f5fbdb9ce74017ff1970806d91e8d6914da
SHA256 f4671d58fe14deafa167e6c1e835e1be2f47c7a15e116eccfcf8edee510e5472
SHA512 8485929ac6eb160061bb64ee48f2608b2777eadd4827f5d17563d1d398d4078ff0f7aab145cdd50297a20e1f5675f6ba4449b3673e0dad7eb76c6e356e8f1b70

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 50844c44fed7706b69cef1bb62acc428
SHA1 ebab9f312b3f7a0aee7bf3187ea4a46107f87933
SHA256 f53838516c6a1394c3a20b170332ed541af24cb13a2092e45b532ae323483243
SHA512 e9a337f04dab2acf395c65d471ceff7fe961efe3ce648b0b999b67f9d9e577f90377a97ab7c22202e35eaf754c74d2d17f197b3a3e2a93ca1899832031c97dae

C:\Program Files\7-Zip\Uninstall.exe

MD5 33ab8ac2008cb3fb7456a7603c766d89
SHA1 f5de67f5cd1c244d9cf352850d4e7b2decdf2bdb
SHA256 502dfbe52422991c07ff9503e1331691725f9421e5f77e13947a2cb2be5336f9
SHA512 232b28fc93d310a19cc3cb548f1d51636fd014e72738dce48c5938ff5c0519452c827e15e8ded24a14e60deff42b36b1d51e2924ddad00959e447a37490f682b

C:\Program Files\7-Zip\7zG.exe

MD5 72b1a882a7c584975e11944a41e36e67
SHA1 e116db8eb2ffd7d65f40e20b3e8a4690225d041b
SHA256 735aab02322c778cf0c88258cac504e823193519643230b08d7d420fb25238d0
SHA512 8a37f9f2a2b9c0e4ab0bac53eacb79359b1dfd66683359bd213c7155fab99bb8b8af6ace11d08b97cf5348735477f16658a4c24c59c083696eb9dbf39e6f5811

memory/4592-465-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Program Files\7-Zip\7zFM.exe

MD5 50d0e94a4a23cc2975f33fd2d69e4427
SHA1 df20fc09a7e9a1d2703706fde24c1a76e8494a37
SHA256 7c8200dc03e3189e8f8ab49e17ceb0615076dd68003db1c8fefa668e41a21a1c
SHA512 7298d46a75bb01498f39d4e72ba0c416ade45a94a2782a4088e3469181483b6720b0f59d74535d100656d553cf9fc2865a66e6654f222c14cfb2e3ea7c78306c

C:\Program Files\7-Zip\7z.exe

MD5 3e716570f873de1f987dd4eee6997552
SHA1 86927828303e15bbb287b942fac5d2080f14de55
SHA256 0518957263cffc6b446a426e0fa8d2649676f714070d94b1b41edeed957ad42e
SHA512 12ac18910e0e3667d5358991ec04c3719c8e9c9dbc1c0ef9584527053cadb691685be9c806777e9f794b3638004e1d775d024d50f91aa16beb6c3b03a237508d

memory/2872-548-0x000001BF715D0000-0x000001BF715E0000-memory.dmp

memory/2872-549-0x000001BF715F0000-0x000001BF715F1000-memory.dmp

memory/2436-547-0x0000000140000000-0x0000000140147000-memory.dmp