Malware Analysis Report

2025-08-06 00:44

Sample ID 240403-xlltsahf4w
Target 2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk
SHA256 02be6e56ecbe4c064d2c3f67069d89512b072c7202ba9048dc835f09ddaa949f
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

02be6e56ecbe4c064d2c3f67069d89512b072c7202ba9048dc835f09ddaa949f

Threat Level: Shows suspicious behavior

The file 2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 18:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 18:56

Reported

2024-04-03 18:59

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\66c2b110205991d4.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f69fad9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b13645d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9d704d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000913907d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9c3f1d8f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b7402d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2f4e4d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001426f4d8f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a3383d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebd342d9f885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 227.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 218.122.19.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp
SG 34.143.166.163:80 typgfhb.biz tcp

Files

memory/624-0-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/624-2-0x0000000140000000-0x0000000140247000-memory.dmp

memory/624-7-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/624-10-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/624-12-0x0000000140000000-0x0000000140247000-memory.dmp

C:\Windows\System32\alg.exe

MD5 45e79f868bb635d1b706292486d151a8
SHA1 e831d7f853511064d5d06f8775ca053864a6fc28
SHA256 fd4559178614925ab260ce107481872015a7fce98b77a85867189c2990a7b117
SHA512 dce71732a5337d244aad205c66eabbc02c576858e76edff10d0f84d5779cc0ec37c758d90965810176ed412934cfc07f10942cbdcd6e85ec3c0710f6e3013194

memory/2148-15-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/2148-14-0x0000000000500000-0x0000000000560000-memory.dmp

memory/2148-22-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 953b5578c6e6e1cfa555ded6e68b47c9
SHA1 bca8c6b6f2f3b64d92f1e1729b3bb906e8c8f689
SHA256 540ed896695c983d57b9d5de3c140f2d5995d0bb569973f999bb594cc804ed09
SHA512 06ebfe17a272ab7978e1f98ee15d9455f7f147c53c4f8d2a5c6e617e380fe0c671371dabcea06177a53e639c9f204fdc789a77f1cf4a291f65291522292eb1a5

memory/432-28-0x0000000000D30000-0x0000000000D90000-memory.dmp

memory/432-27-0x0000000140000000-0x0000000140237000-memory.dmp

memory/432-34-0x0000000000D30000-0x0000000000D90000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 1b569d7d75b491c792ba2ce0c9439d0b
SHA1 19135879514e0380d55a18de06b41f15dcbc601b
SHA256 a4ae1719865b653f23c53cb3ee1e1be29d77936030f155e17cbb2c9b6531cee0
SHA512 7535ca6e20b6836993950ff4ede86c2682888705e61d71c42d136dba83f7c039b795a56aceac4a0a1c862622fe8196913c236d4155b65402ef854fdb451b26b3

memory/4624-38-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4624-40-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4624-45-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a1b9c9f7ed8f69362c1bd66fc94c5968
SHA1 3da06dd6538060bcb167e964ebb497b421b4747d
SHA256 8c1b819aefe1c2db12ccd85bb171c8a51402cf9201beeea0c673e7fd21c42d3a
SHA512 fa27ee9e3265f22fb37d8af574109b72355d77ffb152b3b5fd775bcf255d73ff563fd85a12bc2e6eba49c66c7ab2ac888904cc7fc05614ea306566bf448a04e1

memory/4252-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

memory/4252-49-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/4252-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

memory/2244-64-0x0000000000800000-0x0000000000860000-memory.dmp

memory/4252-63-0x0000000140000000-0x00000001400CA000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 efbd4e945eb97d967dc0932f313ceb7c
SHA1 fca0f1f536fd5990ce452bc30e4557ae8bdbb83d
SHA256 cc2cbe06d83d5ea0e6efccf20ff1397e9291d3bfa020d263c7ee89e363106124
SHA512 acc2be2758efba9cf6d62fa9c49ac8ada0c3240391f93be4538412d6266105f86f2ca185f2feabc2b7f3525285dce8a582b1bbbbb5e32eb07f405eb7cb35939b

memory/4252-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp

memory/2244-65-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2244-72-0x0000000000800000-0x0000000000860000-memory.dmp

memory/2148-230-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/432-234-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4624-235-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2244-238-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 b575133dfaf593e98adf37645954a924
SHA1 f19a62b9259f1cd3b5fa2ca4eee7b2bbd9e22c34
SHA256 27b7d11a59621901225064b3d82a15d9db7ceb85c16fc6987d9d020fd67bd9de
SHA512 e9bf77a646d028c7fa82eff470d12eed13631de7bbdc2fbf048441c5847141993187bd2d7d4558e2e3b911b0e4b90f4d0ed5dcffd2c4130dc8ddd79257e397c3

memory/2348-244-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/2348-243-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/2348-250-0x0000000000580000-0x00000000005E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 0e2ae53b3e1cd002bb98d6af20c4346f
SHA1 cbdc0868c4a3047411a6a8307bff1d7b6f47ad72
SHA256 e6e4fde8ff74e8c41fe19a5503f5df8a6b2ed9c6357d9d9cc5071fd6c8e31746
SHA512 6b9ba2dbd748c52da30cca422f5b775e68566c22c789cbc8f0e4a3476dffc2c0c949f2c7c451febd5aa13b8df242a5f8ce76091c101ea6ced23d03f64a8f915c

memory/3632-254-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3632-255-0x0000000000E80000-0x0000000000EE0000-memory.dmp

memory/3632-263-0x0000000000E80000-0x0000000000EE0000-memory.dmp

memory/3632-268-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3632-269-0x0000000000E80000-0x0000000000EE0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 52e1679e3fa1500103033b0b9452005e
SHA1 75186d174a84470551a998d2a42d999b82846e0d
SHA256 c2eefc1fc9c78b853f2446621cb1691e2363e9123b6906a0bf1f038ddb858424
SHA512 9c506add4be41388a0810345fcf377a8a269c07776d55560ecf391b4fc4b534d58b242e111b37ae25fc22375490334ad1685927aba86f45fc0c229310a0b5650

memory/1936-271-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/1936-280-0x0000000000CF0000-0x0000000000D50000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 f9538ca5136cd4c819b15ff39d188d2d
SHA1 b1cef5878fe6a93f371a9c3393656d24c1062aa7
SHA256 71a7c66982a1fbdece41193e9e81d84e512d3f69e14fce490dc0049f8a9420a3
SHA512 8ddbc738fe1b825f80475a1480fbb1dc949b9a8e1d3ea7854fa7ee8fa26f4815532eeff944af51932e85a707798177fcf6db8ca97fdf34cae5616d9dc51943fa

memory/3576-284-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3576-294-0x0000000000790000-0x00000000007F0000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 b969b59aaeedf5c01b455a65006a1bb8
SHA1 b91ce6d2408c4d9a828874422c961cbd421c947f
SHA256 5b29cb2dbd1cbcb880fe221b89e8fc4ffb81b3ccbf756bc41f346b3e58ccc73e
SHA512 c69702ea81db649969038b5c0f0988cd7f0ccc676e2f398f431d0839ce5060ce6482b8c08bc11971adff47e2c5489de525f471a0ed06cd427ce83836cf247600

memory/5084-299-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 f0662c21340ef9d30c40c0140d2e9918
SHA1 8609eafbf890dc46b9da7a3036824b0865ed070f
SHA256 267a81bbe7c734dbfac63968e6d85323c93c64e70a5c708dd262897e1ade3dd2
SHA512 507e30902bc9d4d7391ad7b1fea4e61c3f53c4ce3c0a3148b08f8158c6ff8c983bc82de9944ee3aee45d7c0b301a5fe280c2a1972fd203d2c2339e0885c3d71d

memory/2448-303-0x0000000140000000-0x0000000140095000-memory.dmp

memory/2348-311-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/2448-312-0x0000000000780000-0x00000000007E0000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 09c903536b9ca609dbf62b22392ef4ac
SHA1 12482a98c10948dc92b59c5e1c58ec7b28d28f43
SHA256 b7a98d43b76f39a2509ab89255c16086de8711410d917fd648a17cddb085c6b0
SHA512 49ee00738ccbdf7fbf7cd75ebf11f91b0d526344fe73ff375ffc522c76825dd9f8941357ddd1751f93c3c7cac1d897d70c42292530af0702e053ac02c6bc18cd

memory/2548-316-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2548-322-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 f044e19bf97cf2836f05b2500c53b5de
SHA1 2bcd4b05e6aa1ce2c002d5566cb0d9b59bf54779
SHA256 87b434a59ea415c1d37f9d92f65045cc819743faf5cd252f845766d3ae52515d
SHA512 5e87c844201a9a624629e0f227dc787632d2a6cc22813b48f060838735e1d8fdfb2c0f30ee09e726c3c5805e91b49130febec491d847bbacf2870f2b32bf4191

memory/5076-328-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1936-336-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/5076-337-0x0000000000760000-0x00000000007C0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 6769522850134be3a33451d83493b986
SHA1 729835136f98db4d8340b432812b329f23baa035
SHA256 3381664de0730a12bfe4c61dd8d6e3d226108c1835a6aebe61f10b6ea733b5af
SHA512 46b8454dac983dd04ceb6bacfe1655b87b847bcc70f0d26b7935bd3fb4405c4246a31a9979c8a1491256ba5005ce4dc93bc460fe757a37a06e3edb2bf7bbaca4

memory/4852-341-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3576-350-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4852-351-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a54ab6b19bc5b1f01511997596991222
SHA1 2fe26cecd5b01a8d54be0004a5ccda6e673f9434
SHA256 f84eb316666d63937b4cfae619396052c4aaa0e8579f2c1f8ffcaafd426639f3
SHA512 a8331728bf23f3d183b31a845faaed7b2be84d98f13fafb7521ecc8e360e3cd4de9fb4d3604a0484433d106941bf375854868f2e8653f04958f0af5e83b8e558

memory/1360-355-0x0000000140000000-0x0000000140102000-memory.dmp

memory/5084-364-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1360-366-0x0000000000D60000-0x0000000000DC0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 f6305519f826bf055ebfe623688d935a
SHA1 0fb7c29301439e133132e88c7e6de327a2bf5f9e
SHA256 82133232cab82e3c099df49bd200a449aafa275deaa5ec55270feee3799b894c
SHA512 377999df57f72cd42c98ef7f69b5d46a1327411ec54c504a35af03e4bc38c64f9830cedc75edeee6b566d9519b84825de5ddd55698217fe3c7276a680488f249

memory/452-371-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/2448-368-0x0000000140000000-0x0000000140095000-memory.dmp

memory/452-376-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 b3149dc6513d586cda71666bb89746bd
SHA1 d3545c1abf23c223d86625765a124d82331c7e58
SHA256 41c755670b96e151a3fc5735ee290da76f4ec36da04eed32222596431846a13a
SHA512 38e53c54e6b12ca4fa9094468df011e74531c0d837825a8249af64fb8814cdbda8dc125a0dc9a9eb41a9aeb30934f7776a260320a2621ce9739365df2f1ac3f9

memory/2548-381-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/436-383-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2548-389-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/436-391-0x0000000000B40000-0x0000000000BA0000-memory.dmp

memory/436-396-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/436-397-0x0000000000B40000-0x0000000000BA0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 4b5519f9401a8f77a5f735a97eb9d599
SHA1 0caf5d9287458e0d526b570a135e9665381d6598
SHA256 dec1d96cb4f4ddfc99bd5a256bbad899841656adb8814ae1e6b78935205e27be
SHA512 0007e28dc82d41b45dafcc57e78da4189e7ad3ee3f32e8e368df14c5a7ea3b88c824e4dd2216110cf0217fda49e9c3f9550b17e6466a841619097a4bd933ce39

memory/5076-399-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2208-402-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2208-408-0x0000000000B70000-0x0000000000BD0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 f134e94b3fa4a3c627dc42569c06cd37
SHA1 79dc6ee7fcfec176c4d472375c4b584a6d537491
SHA256 35a41f84c6f9d13b59f6e32f0505d519f8d14258e5943331e84bfb9cee43e57e
SHA512 a87eeb32a46e2aeff3b5c6a9226e9d004482c4289cd4d4cad0bca9442c9b869f6178cc1051e9144c72ff8ae278adbbcc99af145db25861fdce01cd56774e2789

memory/4852-412-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3784-414-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3784-421-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 9cf41ada8a348a87db48e0bfa6172bbe
SHA1 3b3634900498e13f56831c414994457beb6ded67
SHA256 de8c55c436ddce84483581a8dc314a05deb69d9e8bddbf9a5ab32e06dcafe12a
SHA512 ca15d45fe9789255e2c1994454f1dff1941c6dc123d7b3584e4135f761767b9cce5cf03904e0a5fbce286ca3de4dcbfa7ea1ca82fc68774468e0de3693fc042e

memory/1360-425-0x0000000140000000-0x0000000140102000-memory.dmp

memory/644-428-0x0000000140000000-0x0000000140216000-memory.dmp

memory/644-434-0x0000000000590000-0x00000000005F0000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 919e8d030cab20e97f617bdbdcd825a1
SHA1 2e9f7826278c3cf5dc9fe9a5ed8db5edd93f157b
SHA256 424eb510c908f78d67971b6820110f063b1a2309407f2cceffef6f3ff8611a6a
SHA512 d9145635c822a23fb5eed2058358d09ddd9e4b5ad6ee30c5aa02432bbe90b72fae0f7831cff9a235b0fbaa5b33a4a9c38d218e489d0b3aa49a46e1f05da50298

memory/452-438-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4080-439-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/452-447-0x0000000000800000-0x0000000000860000-memory.dmp

memory/4080-449-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 c66c8f6a453eb6c8b9ac655596746001
SHA1 52ca3a0eede17135d19c803c3a03b020b574b4d9
SHA256 5daddafd0180f3f6363be872df898474795b95a38705203fc52bc630fec3aab9
SHA512 3606f4e20316991193fb7bf4d7b05be0727670fc7db3db092dc89de59fbd5e23a56b0093c68d30f75efbc7852ee1929364c216a5e384b977401898626813d604

memory/3936-453-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3936-461-0x0000000000500000-0x0000000000560000-memory.dmp

C:\odt\office2016setup.exe

MD5 f3f61fa2e13df49c5ea5bf7cea7cfa16
SHA1 f516deea2ed3b15f17d5047e150283209b949555
SHA256 5e4c7e2ceb025e1be670893b0592beed36acd635a66df3a790ea425ffdeab6a0
SHA512 01825ea50c3a0cce37b7939d6d3cac2e40bfeb82ec7847c128b975985844a665fdc94fb1151d12a372d6e33d2ecf9fb7c670923f00c363088fe856a58062a311

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 a56e90ec19b0c8813a8dd1f84439d026
SHA1 072a0b3474d4cb86a31b273df23f3b2d48369449
SHA256 6d59c2a6c5ec5d800cd79bd3230e48ded1192e187475e9b250b2450a11331d1a
SHA512 c4d6466fe8ced3da1caea725531c5ac54700bd9ae60e2217cbe7c365ee783940a1d03172ae65b7c72849cdee3e81497c36c895e694f298a97188c6cc536f2590

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 dcfac451462f3e1cd7c9617b7e855bf1
SHA1 71aea364165ffd3246fa7d7737861d99c30f9334
SHA256 b81447f419dfaa7c285e4731926944b367b0119959fa59d539999d06f20e3ab6
SHA512 e19a491ddbb04dd63bf78fc4768f97dc26667ff8f8f58fe5ecd19dd405ca56f8a498d72bcebba4a72815cd9b4eab977a3aeebc2a615b809aca4ccefee96e7af2

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 8fd63c3540db11cfef1345eff32b7551
SHA1 fbcc87380a495a0e7a131cff6eb93a4bc49fc9c2
SHA256 b1e9882da8505e1cdc72b3f7007ae31aec8f5a3dec4187c0fdaea2f395b97045
SHA512 09b18700b77adda98607215eb8a453ba95f5a111457abd494208663d54be26a680fce4b65c929bd2584ae7a53acc2cd6f8ef819d5add5dc0393f0759b8b5a530

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 185a20f7b003b415e4613d16fb715c06
SHA1 7ddbd1f2399793ca2c3a07059a696143539bf02f
SHA256 78ee0baaf1b3f884ec4bf8dc6179308921485b6814df781881f00df42fa08618
SHA512 dd97210a3862a6f7482e2ae9fa2937252dd89de0791d026384ee43a5e66be45102ae43a7c0f7eaeb048fdba4071573dcfd4916c298725354ded30320268e99be

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 870a87f50da76d25b7317de2ac7a188c
SHA1 4bf509527283bfaabb345376b1cbc5f0c911a9dc
SHA256 10d677eaa8fc0fff6f49be18062e4764c4427b13d88a4be11aba47a9ae89bd7c
SHA512 c6c025dd1c973842fc0ee03efa67afa9761a893cda61946b498f4174ac6bbb66786dab20f242d137c253fcca3f29e567407ea45330e54786927ef065f388643c

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 d043fcd22001a5a90dd80ca8a5ace819
SHA1 bfe8c323d5a07fa9eaa319a00517bc8c6c81ae9c
SHA256 353af9c878ccf7cc9286736892580cafddf0fb52394a911ee8bb595b3092d77f
SHA512 618546815332fc93b0ac9d50c011f8be815dece956559a17ccd1a2278d8bfe04cb3e1b1bb1a0e1b58a2f7f03652c58576955cf7c694f423305438f1273746a25

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 c3e8f7873412e3b5037cf7bed5aea6fc
SHA1 7c3263b3ee4155facb45e44c75bcd830dc0e7fdc
SHA256 0c493899bee3fea242a51c7c954e196d4ffea5ebe9c776b350af53aa6321cf4a
SHA512 d3f8085808dae3346a3c3d8a3d5d74dbc73c9ddbb1024a405b069f34b351a9b4f0f5486ca035fc5bb39356230b9446d6731e3e86e38d5511dfb3aab609f5eceb

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 b05ddd662cd4e3e2576ca30e1aa9035a
SHA1 316e9eb20786c183775df1a673573f6d4695ab48
SHA256 1242b87734be55b349f91753575d779f235e1ef271456b602edb6969316b3d18
SHA512 e1e88db6fa4b87e799a0cfd803b55f53a104ac2908f0079765d72900cd10af759d6ed54c66666a781560bd5e7b723d7b01a2dfaa6dceb875b30975f238c730af

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 8b99928eead82028e95022ae9f95f094
SHA1 379f18475d67f25fc647ac40522084773d3ce655
SHA256 763919a8602e8b1fa8b0e561e8b6a91581ee318580c2e78e69581bf9e0340ac0
SHA512 858decf90c5db58aedd18b1d1fce13fda433a4899c6a0dbc1986258f82d032350297eb003891f27e1020b53d9e7117044ed953bb095d975f3fc0b974c1c8dd66

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 3e3315777f5f6383961f057866705649
SHA1 d7dd9a022208a2be12a6d0e1c088597145694747
SHA256 9a0d9ed094b4f906548740a91428d8add4b67c74fcf0f060183b0e99c98684ef
SHA512 90979f679abb15e692865eb7578dc92ff5bf93759afab15c487aea80379f831d4492874e8f0979490254ca192525de53ee8197436a5e0be77d81c3ab2c962bfe

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 9b6014330248c4b56cdec030fd70a320
SHA1 022bb22ec7ae4d09f7cf07ebbd4507893fed15a4
SHA256 5f5c20188f4327ec83867c218cb6b95617abf9cb78d0fd80508183b97ef033b4
SHA512 a5d6cfcba3513ee9a66d98dbdcad45b3c422153fa0a407d040efdf11bd9babc0af1d98c39e65a94844759098ee0fac60745f4f9bd0f14cd9f2bca72a288ec567

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 0eddea29f6f53fb5862cdc26c3836959
SHA1 42eaa69f9cd4e4a130fa21c07ba181ef83e048f8
SHA256 bfe757d903ef695b0e7dcfcda06fcb9a21fb348b79115b84c28ed95448752f28
SHA512 3af7855621a8dd1d9f0733f9d5ddedeba093283c47972289c1f0d8bbe1b756bcd4ba0c264dc5f72293956d0bb5eb70fe6a893d4fcc021c8b7a04ea5b980287cf

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 2f6929f869debb4639e56bee07f80373
SHA1 39f9d8588f56882c231e3dcb08144d336d1f4624
SHA256 69b528b56a7734b95f4d7659e3b5e8659683704927a0e00fb6f7015b5f389885
SHA512 96ac1436be6dc0b6d62f1d6fc4f57f2aa281509d25aab02900ef023dd6c421f65388598880b0d5d7de7d223089ee7c3947ebab8bc8077d2bc1f665717a03db6f

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 c145b5268582002edbf53411d0ab637f
SHA1 b21d24b7e689100eb3e15ea8f10f38543bb9be0a
SHA256 712f74f34debd0009b74a981098e2500745cfc525f0179d4b8eae7ff3656b097
SHA512 37a5f3b3f8224f7e77f5daca78939c3c7d3338cfe8c861cd2d8b37b9bfadf733bade86a04273f49fa1f65244749ce3b330527cae89c2e5559657d2779756c702

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 98a6cdd2c669d34cc3c04baa431ba226
SHA1 daa1abbda4cc32465d1ed3931ace801214ea5631
SHA256 c43839ad19046c56b7e8ec611e28b102101f2b3960b19d581153d3c4100376db
SHA512 714bb272e465f2355b2addae270b609520821226209d30819898a7350b7b0a342a4a565f60aee7a158be4afa7e37a81df4923ec010f1b126676fbd21359f7b6b

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 a1e4c978d307c7f8b25559244ccb0e54
SHA1 2f2db43b3b1a603fd562f5d63d686f83c1eb6f65
SHA256 ea7265aad4f9fb38c1fb9b94a4882f1337ab1a752f068a79d0044eabf2023fef
SHA512 64ca85786f6d2c0c4647d61484add93a4cb341457667a95feb6b9fc79ec4ff0dc41be3a5fb7e8910c962e6bcd25e81bbc33d4ef1aac814dd0ae9001dce0042ce

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 c43a57200bb9b030f2e66a40a0b999df
SHA1 3b5ecc304ccfd305cff0412b2610bdfed781a541
SHA256 558e53d6f086b315f7003cae6e3c788d1a589263c450aaa22b2965f58ac37a85
SHA512 d2ce95e08398a79baf3496f9d64700761ef2700c6d309729c374ed3961fb029de66305316b7a63d99f9b414fad83e718c048376857fcbc7b19053e4264152f7f

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 9b35a00c4cc1fb7042c3a044724ab8f2
SHA1 94b3bb9986333243fb2f59bbadbdb7516b060b21
SHA256 338c64265f70ce0493735cf8be6d9bfe2e67fcf5842a0df536c36e0f503fa80b
SHA512 fcbe7d85051d9cf6cf61ea0691175df5e2b09f681ea24c74d7ae6b3717cf61a846e6046ef18593f1d47c5d81b6d4c19bc80bfa96155af270156a9fa308c6146d

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 296bd96ab00ffd319e631b40ef3e9c76
SHA1 ac2e40b3c6de1cd926a36d9d6a5afca0a533245c
SHA256 66e772da5005306d2a7dd3678ca641c4b1f5d7d0bc726eb36e8bca85ecf5364e
SHA512 b947b33dcedd8de20f7cc07001618ef358d291305246ce338e06f64666d72620c0dc1797bb59df210ca50033b7e30b19d092cc656aea382eae536b524837032b

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 e4f06cee24ca3e46e3bd6336b3620f38
SHA1 6daad35b763698e2b91e10c320dd6e4de3069737
SHA256 f037f08013f49b971c2d35e2a3c7c6c8dfd1add17f4bbddebedee9517fb6c678
SHA512 393735dc4a307a0e946f0efa255bd50edcfb6b9a0a4a5c48eddf6c448f2b9bc2f8de8080f601cc7cea0efcef97251a9c9d24d4479f6cab68da790404285972f6

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 24655ed553bc0c6bced769cdb14e282e
SHA1 903ac23f3922bd5142c1afacd98e6e4ec7810ff2
SHA256 19bf4bee5959adbc33b82c92beb20d55bb3b53880fdb40d19ceedf884f19ad24
SHA512 ed59dc48c269605348845d457c58010ef38d04905d5ed889a5c4c97b849a7da564633b98f3ccccb42d88fa97993c1f8ddfec313a94ebfd3a6441a802ae381ea1

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 4f000bd00e7c98677bde3586b1e41ad1
SHA1 bcda2e859f9abc10bcf538c41dece78450642085
SHA256 c47d079e7ca3865eaad41bb5b0de1bc1c1d0110085e467a0f77474925b5cb8b7
SHA512 9cee8fad15014493e097572d9fd5eb56d68f1057903a87f16fc42ea9a8c086e36add24158cac43aadb8860a3974009756703f45ba5ed68a2eef28e7a371d11d7

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 c1d1d1b12ade97ac757fe00040fa5fad
SHA1 45b49722b637ea270ab49b9d7ecd4874bc4ccc57
SHA256 ec53b60ccfd9b8bfa0ac95938b5e4f9d6b2e8881eadb181717a168500f90d584
SHA512 cecef8a02d1e046a90fd3428ca8ed41c893fcf70a1f70df08cac25ebb033c773225778acd9a3ca0c7ca2c2e3a0063fc0a2a81ed6a7596369045235bbf5d46a94

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 d89435547febcf354914e4b187047e8b
SHA1 350962caa90931e01421c631f12ef1c22e0e4f87
SHA256 5c76b3ab8b1828f657b54f079a27cad84534a6a2147c8b6a613304e00344eda5
SHA512 d0ce246424a416cc44534d4a7acc6ae7a5052c8a78f318212f914e5d894b5611455d039e0221c3959515afde47902f05ce1ceaa9097dd9b1aaa0faeca7b8f998

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 1722d2645d32f5276f54ddf5219c7104
SHA1 d60e042ab7bc25427fb73f428a9a4c1b1430d8c2
SHA256 3eb57ffeac21c5b9ea7dd559935bdeba105c24d82b6927b312c242ff23453b41
SHA512 d39eb51c9da503d7b5812c1bf0ca676faed96ed0f17d34946b6b1af74cbc25dc16899d71ded76ceb5aad04e4fff364e88b12b277b6fb40b33e07aa6e39364311

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 8db4cf4f9a3e17a3181f7deb7776f99c
SHA1 cc69c782a6bad0a9d1b6d5e55275133f8d261484
SHA256 788d6afe46a7ca4d699a9446a98e047e1c3f88c069ebb7b3cd3f9ed5e8aa656f
SHA512 26b2ab9fdd9d6512ddf169a1b91c78bc8d4833d654473ae939af413fdfbd135eaa40257269bbaeb0e1196dbfa05c468afa2fca0a8dd417a35b8bda3e9f4a35eb

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 0a7e34c1ddab89c7059c9ddc93e6859b
SHA1 2f31a057b39541d4ad2b97fdeabe1ce29cdf6857
SHA256 9f464b18eefa21e805181b486b3909ebe321abec76084cba7492da1499fce0e0
SHA512 ee74939080a331159c4570e9359f532b7e10b907543666056a674ee23748c6b532d97896234673335681adda496aeb9831d69e1b756ef7bfcc3f5f184855e043

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 4d98d68ab70e07788f329cbe879fbb9b
SHA1 9834b2ad025d527fdb9c21e632546bcd4455d38c
SHA256 71114c310d2e918ab6547a883c30b3d186cb207a26df8d32fd4139a270d21b37
SHA512 bae51766ea5b02aa6b9cfdaddd4a8aacd707a33332ff1e26d8361241892a5c00cabc397900290f4583ae5b8ae12eb3fff7592529d25961b5dbc45032ab2ce70e

C:\Program Files\dotnet\dotnet.exe

MD5 781f8e4a8df586d8997fb9a16c0d090e
SHA1 ae2dd1994e7dbce54b1a75b1d5acc4397bd3c27e
SHA256 99d34e9fd71573bd1ae90519d0be281a23686120f63c7c1fe12460e1063e6b15
SHA512 1f79960510fec572ebad1a1d359b1b1dc5804a908570fe7a19fc557df83c7821060ff355b50e882e15a4d3a9b35235e1d50a28ad71f0b08b8b7fb1b41fa0ae27

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 d9bb9f0b641b3df1f22fe05aaa992cea
SHA1 41943418622ae162bff737d1763ea2155e75d349
SHA256 a19309b678770e236cfdd119ad6d5cd9cdfe3ad530ea46a44f651024c53070f4
SHA512 46c9a8551c3cd0520bd9e482cf22ba0b50287f17735ed718bab8cff82efb30b2cf3fd57af52403f1495ba155c9508833a736d520bc3f77f4aaff28baa00c2ced

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 4952c7dff06edfd879f73ae72b61957c
SHA1 181c6e19941941961253468540f0f42af7471e0e
SHA256 126777cb02fdd0f7bf1b1adbb7603667471751425cee9557d7e59335dc3aaaae
SHA512 1e8a96163dd6c6a010408d138920239ad09dd0157b1eea834aa3c729af355f1cf6621451ae7ea78a8da2ab41025df131d2eb5ffd894c40a603403e0bd8535d5f

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 0376e8f5ed47437dd83c4228b14ead14
SHA1 353f9339b8fa31ab32ad12987662a3f2fdc592f1
SHA256 2f309964fbd5f9fd7f33e266182e4792b0c4077a043efb93c79ae1c943f462a5
SHA512 cac8be77657a605bf2565428799297b2cdbb4db235aa6ef75cfd1f55055373a0b456729a6e4731c65747bc9bbf02570824728600c5654c620a93d12ef5e81f5a

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 bf3e804ac70a047bde244c0dafb82e97
SHA1 5e4f095d278a3686e6777f2000cf5e9e7df455df
SHA256 fa1b13444eb5893e20bf1193dd24d013e02775ec53877e1ce913efc594738f60
SHA512 2adaa13379abcab8f6d8cf7a9226cd1c70148a2a87cb75962e0250b5670c4ddd6d338045882cfa49ec8afda9bda4ab3b67e5d8b335cb9b96b8c7e29f7897a83f

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 d01dc41c66f8588c98148ce492673462
SHA1 aa6f80268b7e64625ff1d6c715aeeec38cbcebe2
SHA256 32b8f8f9b05144c9b38f9376d6204e3e62cc10bfe3ec74fcc376e6e2f0a2068c
SHA512 2f0116f4e3f9fc8ce1e3c8cb913ca4195fde6d958f8e5c07559274dd40ce95b8034f519ea936764da6261eb16578fc1b58c38dd734f1ca220db00c2b704c28df

C:\Program Files\7-Zip\Uninstall.exe

MD5 318be854e795bc36b167bfa2b33ff37d
SHA1 a0f2885b4b2b82a7498e48c8d91db73184825e90
SHA256 378b1cd89488f6e010e2faf6b75ff4b1a79c0cfb09b5de6805f4c4181d7de24a
SHA512 5d1fbf0d529dec9f95193af2b28d281d7a0ff3a5bb3f022dec87eebca9b4add9fe56134661641b062c442abcd4de0e80e7e0125c3989680ab7f448c605f697b5

C:\Program Files\7-Zip\7zG.exe

MD5 044db04f9a8fdc025f127bbd35d087fd
SHA1 d29072db77d8de5f2b1f448cc68fba826825e9cf
SHA256 6c695f02de801b36aef14febc2bffbf91c298422f6823b335041e97f8b99aa77
SHA512 bdc42ccfc82d4e22a1b0c0967d29aa9af6e5db0050fdefa2e65e7b91a9d9d27bfe2fac1680aa17a9e1cd37260ed80e20543782bb80ddc62b0cdea9334d36d243

C:\Program Files\7-Zip\7zFM.exe

MD5 2915eb373443082235c57eada4600140
SHA1 bc58e46530dbb24f0f12cc62512cc212fa05c641
SHA256 03180969f527cd33dc50cc3584d6ecec6366091b46a969de95a3ea450584dc01
SHA512 9d2df71085318fed97fe6ec05b6b3e08ce96b9fdba58ce14843b55228a135efb7a438ffa383d930b03620c76d13d76a961baa40a3f135552b3a2b3dadfdf86f7

C:\Program Files\7-Zip\7z.exe

MD5 e3c9f386b9274cd793fb15bbb276d5a3
SHA1 5f722ce27d749f38e13b5b60cccf5cf15cad94e0
SHA256 2682d5d43e7e7fdb18ff43d000d58bbbb769d1a6dfb909ecef5cde854d217ab0
SHA512 4c8e84388a79af8de0868a79dab5bc357333de305b8d11326678bc2d8f5d0ac6c0f71cfebf969d248b084a943fa6ecffb20fd391cb6f721642e7b59ff5de5687

memory/2088-546-0x000001BDD4BD0000-0x000001BDD4BE0000-memory.dmp

memory/2208-545-0x0000000140000000-0x0000000140147000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 18:56

Reported

2024-04-03 18:59

Platform

win7-20240319-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_a9c34050c70ba4518c0a131fa5848ba8_ryuk.exe"

Network

N/A

Files

memory/1676-0-0x0000000140000000-0x0000000140247000-memory.dmp