Malware Analysis Report

2024-11-15 06:11

Sample ID 240407-3e3fvahh37
Target 2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk
SHA256 f4803378bd47f1b4f02da35eaf8e9e6f13dade4c547e75eb23594fd476ddd872
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

f4803378bd47f1b4f02da35eaf8e9e6f13dade4c547e75eb23594fd476ddd872

Threat Level: Shows suspicious behavior

The file 2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:26

Reported

2024-04-07 23:29

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5d362878c4fd1e7a.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77625\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e4c10394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b355a394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a89dff384389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5f95e394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba80a6394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ca98e394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a6f74394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd983d394389da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_39ba9ddbb084defc9a20778e9d8c3cd7_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp

Files

memory/1600-0-0x0000000140000000-0x000000014022D000-memory.dmp

memory/1600-1-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1600-8-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1600-12-0x0000000000830000-0x0000000000890000-memory.dmp

C:\Windows\System32\alg.exe

MD5 624df1eaaebb994aef8b11fd5263798a
SHA1 3decf9630be2469fb9b702926110b33356f5030e
SHA256 995d3a5131112de0aca4f914dd236242935ff22385c314502e366b34972c110a
SHA512 6e0d49ee05675f608085b4b5145fa3775ee852c759d6abd716cc4289a697dfe44f5f9f0b91bbb9809be94d87ad5dd22174cbb97ba1aeeb5821aca074495289e6

memory/4556-15-0x0000000000720000-0x0000000000780000-memory.dmp

memory/1600-16-0x0000000140000000-0x000000014022D000-memory.dmp

memory/4556-17-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/4556-24-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 b5eb75b679992c8c023f77946f20a06c
SHA1 612702f8341a18a2db56d8379ec15f357303c39a
SHA256 2bbe2703a1fc62b9db54443501d5de9e3b2da890c327a89f000539e616b7bb38
SHA512 3a4a62f2c9b5eb1c7f97af9989b5364a16e2396e4841cbd09c268a668a208c0797fafbfea5943c7ae3e51ab77740e4a0a9584682374f797ed56fa0262c53a864

memory/728-29-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/728-30-0x0000000140000000-0x0000000140237000-memory.dmp

memory/728-37-0x0000000000CA0000-0x0000000000D00000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d746e77012c1b1266ff7929ef3e83b6f
SHA1 014179f162084630e81859369f76e70c93a65103
SHA256 82b679f6bcb1db342f1a7b96f72d045a8e9272a5df3b32e015322d0df6ad25b4
SHA512 15b397a0da8c2d35d9c48df61b1262e519354868e876c0d98498c390a0e9bca5b16092f8550cf993e4c2ad150be3fc57b0769d74531df6290fe9c8101e3abb74

memory/4148-41-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4148-42-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4148-48-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b4fc8aacb3f44c6c335258757cb927cd
SHA1 2ff4d4bd9d825277f2c63493d40d1445be125ca7
SHA256 3ac9be0f1ee337e1aefaf7c97c23b5741cb6b58655536eab50e96034bb37b10a
SHA512 362ba19de5b9f6fe0ce0ed948be394ca887986a5a5aaba494b29f9c1cbcfd228174dba0a7d96c622d95d7a9c111e1088dbc2c077605d7ff47594328fe688c144

memory/3292-52-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3292-54-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3292-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3292-63-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3292-65-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2784-68-0x0000000140000000-0x000000014020E000-memory.dmp

memory/2784-67-0x00000000007D0000-0x0000000000830000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 45db770ed5cef6ed2373ae6a3815147e
SHA1 8ce587e521f73d75f0679e2395bc4672fba77758
SHA256 f91bdb047a736d3d20e066bd4111305d68b3b9cb946b074fb8026811b18e6e43
SHA512 c18f5a983702b78f78427399f1cebbe608a75f5819f3b0d417e0e397e155d1ab363d442913804147818b8c1b1c6c7c1af43734422e7cdaf1495650925150d346

memory/2784-74-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/4556-229-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/728-236-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4148-237-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2784-240-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 bf61e11608d4068fd0bdb4fe833eed7b
SHA1 356fc8ce0f5f50778713c517fbe9725f17b6b61b
SHA256 031b5dec9f379106e0663480c84e827f42e066c782f4dc1e0b94739383357378
SHA512 fd626efc98a50b0378c6bb9ea1239d5a2d4dbc39100994d938fdccf69a9fac5385130c9c182722d5266cf8b473dd2bc46fb7fa25470172573885f06c5d88e571

memory/1356-246-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/1356-245-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/1356-253-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 29782a31607d81dcd483f9e7fdbf182d
SHA1 eb5269b56838bc514013ba5bc976f7877c182ce1
SHA256 fa6acb4d63473827ab07bbd6bcba5bb250f2ae4d5ad1ada2d613a58b325b2166
SHA512 940c2ae6af9024f315bd1493bca5245ae98b83758df580d6d91474b74949cbab4bc26e80e51f65cad1c81b50a67b06d3fe60a5abf89918cc476a4b6ebd7940c7

memory/1336-257-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1336-258-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/1336-265-0x0000000000E70000-0x0000000000ED0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 9a5d5105f749e767e225b134d4d72761
SHA1 ff69123c02f773516d87d2ee4995395cc6de6ca5
SHA256 bdf96cfd333599f425b8664e178520c2c4bf01bf6adc6e9407e70f0e714b5120
SHA512 fbe0167c3efa84835f4d1a3356f2518fb812deb337c218e7c700135d6020751ca253d508eec48b533a92c56e646c8844ae47f2bb28a77cfd48b083fdd8859558

memory/1336-272-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1336-273-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/4764-274-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/4764-283-0x0000000000CC0000-0x0000000000D20000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 5310b2854737101ff4eb8acd3391b432
SHA1 1f322579d4bf5237ba78a3db7fa41a98d138720e
SHA256 168b978db68ae75f2bd36d3c512445fe05e5b36691694571e96862ca785be455
SHA512 63aca1c4a59837c17ead85ac50e7376984e88f848497baee89dd80dfc7bf01bdb4680df754abf116ed4837ca6cbe0eee9f74e7c6ad7b9803676450a55a372eb3

memory/4752-287-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/4752-297-0x0000000000600000-0x0000000000660000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 0c22fe60dc5f6f3cbfcbed4b5f1923ad
SHA1 641604f5787746d250298d8c91a2507bbb153633
SHA256 9cd8fd28ef766474b33bdd6f1041a62b10e19146dbb92c4f785c6efb36a97343
SHA512 51772a7cc48aa73cfd4764adc691bed323b7cb5bff05ae716e060c7a409b5a841a94d8dd474aea25cdd0440937ad9b610b9238fdcaafb0b63ba533009275b651

memory/4640-302-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/4640-310-0x0000000000660000-0x00000000006C7000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b578c9dac07f09b15b667d4e1f08c0e7
SHA1 ec0f4d474140a9231cc0fa957d5f1686b0c54bd9
SHA256 2146e142fdb82ea16b02aa19d4e77150dd66b083b463ea1b1d6a73e406024841
SHA512 9ff18844564b2a0961ea008dbb00f0f4bd02095ff93ec9eecf7d6d8f822cc69b5d764541b624fb3ebdfa4ed1dc7e4624b423746574e46fe98684f9aa650495da

memory/1356-314-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/2692-317-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/2692-323-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 fc79d7f4e5ccc3fe1265dcbe671cc820
SHA1 9af9372d20fb123cd55e037a0337fcc7ac832a4a
SHA256 134fde3dec4ebd86d68b813734b89a718f49dfe52c26fc1451f1398fe50d6833
SHA512 7204a664204395cff28eaab492f539da33b913d98beb4014beb198604deed04480a93a44a8c0c2698c9f4b0848192e389033eff3e2e322952c985bb2396a44d8

memory/4324-327-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4324-335-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 7d0d7114b081a8e933153a60dc0f4b79
SHA1 adbe9608186b77df6c4dc94950874c55eeb20b4c
SHA256 8a8cf1e83465b759df8f37d152ff3ff136ec1decea8873dca05d31a00670f9a0
SHA512 69b75805b1273560c178601b12aba7c3c59fac378659470fa19667c4fef6aa8fd31f68aa76c59ebe60560495c815d7031163c72085c83ab244aa7d89a2620db3

memory/652-342-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/4764-339-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/652-349-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 b534dbc4dfc434829bb9ae69cf434612
SHA1 00243d98172532096ced5f042f1399879356ab3e
SHA256 40cf02e7cf343e5c4903cb24e33420a9a43d046e66265e7ebbba2cd38bcae63c
SHA512 b40c73be23ab6ab4ddf009dd9c2231ba354efce9925c27114137be314429533d8e30f84556aba06b2b8c37c6c327c0f5de749ba071edaf6d407405ac7e12444b

memory/4860-353-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4752-352-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/4752-360-0x0000000000600000-0x0000000000660000-memory.dmp

memory/4860-362-0x0000000000740000-0x00000000007A0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 d82a7d492e8e97b007a82a6c7bdbf868
SHA1 e38514f0cf75ced343f925a14344eaf77b5b6a97
SHA256 faefcdcd50407bd2eeaae1e260b6c615c94a8f8d4929c3abe726c47af866014d
SHA512 80ced0310306c727492461c66fd952dc9c75567fa3ebb1de0ead242e503b44c4c274b40c234ba5073eb011227da2772c1543e659eafb866820ee49ff472f95a9

memory/4640-367-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/4628-368-0x0000000140000000-0x0000000140241000-memory.dmp

memory/4628-376-0x0000000000DA0000-0x0000000000E00000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 f996aa53173a1e5b06c2236b3fae3928
SHA1 add61767e558407c1f0d6a2875fe1a980e10d7c0
SHA256 33141b6b1b8770dfb3ccf82c9b8e5fc4b9a0e851b35ae171d3c4b86f669200ce
SHA512 1bef22bf73c2664ffcf1154dc1e417c6e6a87af0f871c02f4cbb75652c66a3fdd918e202b10ade668823e845dd6a9487d0e51947e061cdfc0cf1f7a4233f7239

memory/2692-382-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/4492-384-0x0000000140000000-0x0000000140221000-memory.dmp

memory/4492-389-0x0000000000620000-0x0000000000680000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 a142c9ce358ffad20a686b60dede0957
SHA1 e687942a4ba2585f0928112e5ac0c341daf35c7a
SHA256 e5abc35461d6e886ee846b169ab033a6699ac7a5cd4b6f778dfc5d068515c9da
SHA512 b1957937c76e3378c40e3a07b0c90fbb19ba3fe44074e3d3d41816eec84ba8dbb9b7331087683661314a9fe2b6bebbc8c12b33c0986d09d017c84e4b1fe1b49d

memory/4324-393-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1888-396-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1888-403-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/1888-407-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1888-408-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\System32\vds.exe

MD5 0287663e417b421ae4e67b1dea908fec
SHA1 00cff90cc1b37715f4f13c74965fc810e85b5e88
SHA256 f1ca5d968057bc2c3b3df2a2b47564561b97b06cc09f197aec52a9f1aacda127
SHA512 01fd3328e43ecc074c38e560fddefb440b860947ac5735a4ed3461503b7a94c4d895c8dc62a5006a28523aa6de826cdc8fef71aefa034dff9f56b1285eaaa5fa

memory/652-410-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/3464-413-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3464-419-0x0000000000C30000-0x0000000000C90000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 ec3a4da818e193089bdfe0ecd9d42c5e
SHA1 b80673fefdacfa13831080a77bb870111bfdb10e
SHA256 2dcb2c42771b3ec6b73c3d3851ca3486a2355178eadd21e1056252be2548cc7e
SHA512 6749208eb921a71aebe7d13183fd8b370a189b995f36ef1f2ce337705b39071dce5e89942ca3a88c455bf5470c75c21006f3fd8425a155c1bab60d024edafd27

memory/4860-423-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4928-424-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4928-433-0x0000000000790000-0x00000000007F0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 8aec5bfa322fd0fa8cb8f7bdb0c5c533
SHA1 029101a656c56a8543b4cfa7e619b31c76fb54fa
SHA256 fdcfc036cedb3ae50fc63d735dab4e1098f0fa509975844b9d4cbc1677596878
SHA512 77759dcea8d80546822c0a0d80d51b75b348ac823db05bc5a1e127e3a9afae52fb5e9232145d0f5d498f17ac2483ae945aaca8c8e80e88d88b4ee24c1c168455

memory/4628-436-0x0000000140000000-0x0000000140241000-memory.dmp

memory/4804-437-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4628-446-0x0000000000DA0000-0x0000000000E00000-memory.dmp

memory/4804-447-0x0000000000BE0000-0x0000000000C40000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 c7cb31657655cf89c7405ff0f462fb35
SHA1 ac7cd157874ddd6fd3927cd3a1ca043eb0021ef0
SHA256 8d6e55c6d073cf55601ed8d0cc4ba9cf66e2f51caa0dbdba6a0c5f909aa3d935
SHA512 de8f0befa422adcd2f4d6ed12beff6f272b74f327bbb90049abb489e8e0aa7b2ccb28ad4c550e1d8125dc4cff62d4af4858a31b37549cff941fe267c38059092

memory/4492-450-0x0000000140000000-0x0000000140221000-memory.dmp

memory/5108-453-0x0000000140000000-0x0000000140205000-memory.dmp

memory/5108-460-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 e046f30980d07380a3b8d0031c4acb70
SHA1 862518cf3d9e11b591751d6bc963ddf00bab7328
SHA256 5262af143555edad51f199dd44f2daaa033cfa00f344b76ffd5bf5c5327020e9
SHA512 afae2542a337037b95e762408509af047597dc24696073069f93aa02420a15abdcf5255028ae1fb295b85b75ae1a377271c68534a39e953a117eccb65ed64c27

memory/3768-464-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 a9d1437505325d64f8b90e4573f5822b
SHA1 6af84810636affbea3a92ce8677bd649921d1158
SHA256 f23228431b6a495950b7cc57051233b651034d2b025e8dbe4041dce4bb67e9dd
SHA512 4bf740b2a9fcb69c70979f5f0a30cbcc55491f37729c02aa9ceedf722c80a7645d85b0ccc2f0412ce80ff4965723478803bc234a8bbbb6be5f2f722cd0bce2c6

C:\Program Files\7-Zip\7zFM.exe

MD5 fd21b83719744045b093385eeabde95e
SHA1 d3e783c599136b9eba4b1e68ecc99ff3de7cebb0
SHA256 7aa72c2c304d9f1e22b26b052891c010c3547c2b94acc97de0be41d3f7dbf12b
SHA512 4eee3e8eb30e95967276c28cc05a8dfe7c3db2c994e8c8c502d12da220df85410c37ca6e76153792c549cb9eb4dec56ec828f64ab8879187ca2d2aff9173132c

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 ffbe325d65bfce67ec992fb91b512840
SHA1 8fab7501688c3a80d13e5f38dc0316d3dcbd73fa
SHA256 af298ff7189d5fc0a3bbdc0352f315f59a034eda5a344adfdfcae5604aa7e265
SHA512 cf8d8e3cda4d2eb75263a8fa9d3d94fd51f9ba7af42497c9ab934a9b093b29c6780ad64430972595cd5d2b2da7dfa69c2b18d6c1bd29747674cef04a320da539

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 9655962cc619fe5ae9818ac2e1e2b287
SHA1 23d49e17c8f73c4cd2d20bc0976b55f225fca554
SHA256 1c7b69e34af9cbb3564d2f25d57652ef612df4662ae780a5bf6a26396fdcdbb5
SHA512 f5e11029fbcb34155e6128f8223357b382be4b42e52a89fdd11cea73dd0d075f6ee5fe16f65efb3112bd1268c42f65f8492453152d1fd987d6f6213b0cc67751

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 4f4f6fd50f2cadc0d608f8b1c669c3b2
SHA1 ba729dcdf9471a5952b9c1b7b15633d661e9d33e
SHA256 74dfd1bc67d18e72dea3240d2f63ac2355c9187b08025b983937e414330d048e
SHA512 2e1f352ab75cc85fd60cf62cade23e35bcefa49a464e8a767ac5147bebda46d6d22ca90f75b0358d8d4f3b58de0483798061c2510d6cb6e6f4b350891b38fa25

C:\Program Files\7-Zip\7zG.exe

MD5 86c5118682f59ac2ee3822b788f7ac87
SHA1 77d9f92d428b77b1848b1c2bf2304677d9f8e246
SHA256 b9a03d7d016dc4f06a2bb162ffd798aee030cd72845c0c5bac6188e4c0a6ceac
SHA512 2a1c70b6bf04c094c2d6462db017d19ff7060bfa4056577520bca624304f22bca9a7b2ffa93a2139cc6bd0c698f42c64d3130070cc167ba81068d9d7e6a293f0

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d844500ddb4c1e1f6c2968e5245fe931
SHA1 812db180803b09a0d28442207ca1a9c455847263
SHA256 4dde0327eb08b47fd70b4d24b8c9f7ae29f0ac2031e8ec36da53e4730cca2254
SHA512 1732323d280f9bb3244156c19bccf7708f4ad237f11126000cb69758ae5a415cf8d35013dbcd09f8b0e85f23856e239818cd9b5480e0ef0e73cb14712e7812b6

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 5e1bd0e13894ad7a57e8ad40387d169e
SHA1 42cf1b878d3a0d47a9651d734f903e85875296ff
SHA256 e585852f2f0a968fe63d8cbd47eb8b5ba3793fea9c319695924c2297f26a80ba
SHA512 133029e3804e15a463c6266289655c20e5f4d68d69bf53e6c48f039b74bd9c5963c1c667c2e234bf0c745bf1885ebf21f3f7dc3e8d0058d06164221507a30265

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 6721d6181bf371c59a37572b228cc679
SHA1 35ff2aff88aea57ee72ed3b045cd75012faa3f81
SHA256 fe174d5ae1a987e3725889197a78ca2d6e66906fda5784c08efd2f7be58de53f
SHA512 1078327d6be702720487c48042edee90f7e6f502f028cb93a398384a89d2293bcd918eb466f9c71f383090756cc23510de351d01ec9367c3cea732e1b7f95aea

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 400e0bebd498b3d4b9404df40cd53adc
SHA1 1ea9a9565ba80d72b6e5dafbf7fee020026894f0
SHA256 3fe2118f419559ec42598e2ca2065dcae8af7c7bb9b3ce210953a85df1e27f2b
SHA512 2fa593dacef872d7dd8b48bb415b7f34ff22388e12c7f61e77b87289dc3e215ef3e3ae9d860ea231bd0bf289027e8c84b707bbbf345a51a1effb9ba3d572215a

C:\Program Files\7-Zip\Uninstall.exe

MD5 85f9427982e13069ba5c9f095ebb9cdc
SHA1 fed9753f094de31ed2d0704bcbfaabb2c6fc8107
SHA256 22f8b6d0cab58427676394ec525c5e7d70ae553b7a5495d504c07204424232a2
SHA512 886a8706a41dd8f60fb855a5a55d8e9cccc7d8324116615291ddec22888c125c8d1224cd287142c7f02b594b018a4354c4c51e43e48a3bbcc9e3366af3f92b0e

C:\odt\office2016setup.exe

MD5 07669bff9fa2e1326ed616aa445c2b3d
SHA1 20933fe97ddb78d41aabd6640de0b15d21ed0fe3
SHA256 5110ed84bd3cfea815c459dad02fd34482fa8e165ba9673edb56439f49e602ac
SHA512 f610da86b1126944c955ad54607d24f6c73084b51a74df6e4aedd11b62292f2f9c1ad9979afd02bc5df85e0a037c68bcc52a993c759690420914744d7c641dae

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 f874ada58c32b66b893bd428dcff7079
SHA1 02e3ed3df8f51e189ceaba11eb7495e620b8fbf9
SHA256 33f2b38572708d189a1124e160065de9f44bca52fe47e981a8616be90eafaf56
SHA512 87fbb2698458af49cf4e0600906181775f0f21a30755c0b21baa1adec34632a26d903be9715ab310bf66fc8383848ee0b511e75291f8239723282e0e963c1e1c

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 03de2308b1c9af6ae0eb17049b6bff9a
SHA1 3bd371dee872f70ae4aa9759ee80a95e72a30e99
SHA256 34168062bd758a51c39fa063861b6bcc18839b98219eefdbccb5249e043b44c4
SHA512 f41411de1554b3ab6732cf37399ff3d8a3603a34f022f6efd54597d518bd59220f1fc9c6341ccc76ab5987ebd44278232c473d3d5373eedc2749342e187539c6

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 79629dc0575da584d5b1d7f951f9a097
SHA1 bde8a885fcf577059a9a9a7c898641e4ca84b4be
SHA256 19f9bafb4e3c2c6d6ce50c51efdc36e0c75b4a7946f9846f66847407a5115ab2
SHA512 5819e37fb1d7daf4d5b25f6884647e5ea4bbccb05626fda4c598bb363879db943b1b97297bda510b28e174a373014dda2341cc5b58cfc455d09124729fb308b7

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 21dce90cbc7c52d931c1689288dd25f5
SHA1 c84237d34204ccdcb3d0d47b9ad11089dc8445da
SHA256 0956049b7256c487d0032b0a51c7caaad91c1b8b12064bae07d37d4fb7af97a8
SHA512 ce6ea95ec67bcb54e6ab58c6d92d8f9646fe0dc403aee1661e6c52b1f9864a88bacd8cc6db221ef1924887f4d02fa21b1200dc1c637fefd26c41dab9d5d54b1f

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 8c14d2ee4b2c5de7d2ecb6981d62bf0d
SHA1 b2176b5be490cf45711682a8beebe8b0a10f75a0
SHA256 c59c7d0ddbcf0447791013097c83ec150309eff6e7816e8bfc3d9b8842fa187d
SHA512 1cdefb78ece5382a52f21a8a8b1ea4a3dc8448f5626ee25b1ce280e498d292a10f49c444336450ea2d8764a742cf86cf18d76ccd0d916019d5af42796fb205d6

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 a43994e89fbc9ff86d4c5b0be43825f3
SHA1 587573c1396a1b4e043457c5ca9cb880e24d4312
SHA256 7576197b6278e51551a9a96521e7c80d21336498cf34bc0f7a3bc800a5d5c6e2
SHA512 79217b8ecf8f60e5246703d4fdd356d4a2adfd00ba796a0c0e5742fa899755422af613a57d4d9a852afd83ed726c6d0f2fb27a522ae2060203f2c9daad10e462

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 f3ccc5e08d327e378c883cb895ed1ee6
SHA1 3979457d7f6f15db1bdd2dea32e54c33394ca4b5
SHA256 def6099f7ee2ff8934e74f8944c23cc9a252cd5e50599fb5f0c34064cf3d4422
SHA512 9c4f803ac07dbc624bade93cd1f3479bd2172a6fcc772c748cb51f93eb9d6a5ce964e9a9840cbcdcbf205b51004def90b985a4ef9a0c4997d472a43693b7729b

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 f817f157f479022cb3621864a0ce5a62
SHA1 2b340a31a8cb7a8951e556ece3b9ee0bcdda0d77
SHA256 4aeb3491bed329e9b26a3fdf1652ee4d499f5b6420dd580fb201010c7c1ff5ff
SHA512 5540bf027aa5b76a6557c7e4997210b0b5eed8d13aae2914ae44e73c2cdaa6ccdd7c5a8dfbff5202dd63b3625e1a5e694c84c16a220baecd9143ce3e9066d510

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 610320632c98bd06cc76e5247f82babf
SHA1 e5003960b0c094d4c87075d724408dc2c4499f44
SHA256 f1f67fa19132a4a7afd38d7cea50aa1a8112406a5ba8db790164cdd900b06dbf
SHA512 c58462067c2cb08c9ed7affa18471bc54986d7a414f70ffb3e6515982c7d9a969bad34b52552b023ee710869624a60f2d0875f1b0ccdd48965a3c54377c7d959

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 46052f9069e0807d36afe3fd25f08b82
SHA1 058de1d732f456c69246782fc20e0ef9c13b9326
SHA256 254fdb41b9d740d06261469a0d5f610199f7a5e6c2090b3d730a012b2fdecf6e
SHA512 187f11ff355c4f629ae9e0ce51e5103816f6b527ba1b58cd6f0cb7944567491eccd9761e429113352d5bd32153c5a7d8cec83d85c0c0c87bd3c6344fa377a8b0

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 cf5a0b282fb08f811fc34400fdbaf47c
SHA1 e0a1576c7ae27c8430473b8d13da177944bb953d
SHA256 9d6a12f0342218ee65a0e23f6b485809df544f251f14342b402f1228d7b6454a
SHA512 8173f95d3d3ccbea3e93dad00b7d35b7dce792ba737974a926c6e54b594b3bb3bdc755ef9746ffbfa3aee433b4a229c69f076b506a3a808675a2ac8b407311a7

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 ce7225801afc69b89b4cfec1e9543804
SHA1 43e91969c8ec019e45d72b0c714b6697586864b2
SHA256 e58c4d6b2eabb858cb002db5222239a7e0199e82968bed9222ab607d1968daf7
SHA512 a6edc2168410d44adb6a584739a74584cf4953a590ccb5b79461d6f3b0d80469d4bebf5f051ba318bee2f3b46f1006d654106ccefce823a61330983e9ec91b12

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 9a633797c015d25e5eece73e93322e30
SHA1 a1656844a657d0b87796dd985c1c53c354df5ef5
SHA256 940027f21066fac4ae81c5b63cb8d665a66b9b519c1612f557ad8383a2d9370f
SHA512 885e1368636cfbe9c6ee8de9b78eecb38468ebe7c616eadfc7a745689bdb991d9f7ab6a0bf124562b3b71e2277e24bd553efba62f717dc8ec69aaf2b5e9da982

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 8777aba67955859eb123d4c6dcc13311
SHA1 2864b6826705763d150fb3005d1d2c20a2b254c2
SHA256 a3be9f8b53ca3063dd461567d308fde74f5c4235a20db69337c3aa25e845b666
SHA512 2a942dfe335591bb941ddfae233a2779aa455bcfee6fd1a09959daae6ffede385613f1c5ed231d442dc1a6132afe5beb5c659f03241c4c069134e2fe319046dc

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 30bcc20330ca01ce1a092479dca44ff8
SHA1 2376eac48109c67d77ee710b1b34cd278db9d66a
SHA256 74158eb32249562ad0d9a0a4fd13b806fceff3860ba0435a71748ce782de59e1
SHA512 739c9101d2a8b9a890849f3578a3b7cf3d0e92adbe03dddab70191d294dae34d0c0ececf87edfb11c11b2be80df885039a20b63428808867b25c62ced0070e98

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 cbb9b7d24ecfb371f5de7686d096d3a1
SHA1 3aacf2caf96ee8eee452da916d34db698f736776
SHA256 ac35610432ebc2f8568d5e07a64bb370e9bbad39f18c24edeee149520c5948fd
SHA512 2eaf719f1acd78c394c794d8846113fc4cd0bfd0033812fb392e77dfd4b511f3d7689a358b6e45aec3e65e8e1fbf4af7c3669a94476364aef898e53c1d6c6a03

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 a40328540fbd57b2a042ef01ccc85c73
SHA1 3f07df8c3baada365b8fdc4bb546247191d22692
SHA256 665c6e0b6db826efe6d3a046b4802761b5fc1745fb34d32c2b0d23dad09d218a
SHA512 c86036e8cf06d1298956d88d7ff6edae22127c34d8747fe1026468a0b04423588d8bb0384543c381d37ee301773165d9785185125e570d501ecf994d0ed8166c

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 f2efb89d6e25decf543e6a4e079c5a07
SHA1 83e1ad2b959a3e7c12055879e0d432ab160afcd3
SHA256 2eac38c91588d4bddc646f62556accc32fc2ad56329f22d784f7f41c9b996c26
SHA512 e287ab93dc8f226f99885fa0e9fcb78e1af27f71168173855cd602faba824514239f1e6c33bcedee44b9cedcb3696f4f9ddd4e7ad91f47119d55c544bc2fc4a5

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 1c3c5abe59a0f146dc613297ef9f621e
SHA1 a08f5a72e4b6ea824b39b5a53cd20c3b562b5ce0
SHA256 aefaf69f61270ee4326db9f72bffd3bf8fadccf2720b2b6560dabb3c185572e5
SHA512 e811b423225a5b5be806619c657254175cd0122b576e0b5717f8340da4d85763024c67333145a5eb96c54c5ff527e86c1693c4d18cc584bfd4b4d43a981b312e

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 33171f8b1ca4e3801617b45b92af0abb
SHA1 0c3c2c3982d4cee46e41c89a7e9a9f387172e8b3
SHA256 65aeec198969b7d980542338da149bd2213d5fbae4fd2b9282d022161053e674
SHA512 8b768f12f71f402474a06e8829eb4da79c2e2d9606c089e0c16fc68e0cfec2ef6e3cb39504348978c5a9651af4c76070c15e86ca4968350ac6d56703b64894b5

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 a2a2a5edc5128a18a76bae90dfd00b00
SHA1 3ded244afd20d99f58230ed3d0f3377afd1daf46
SHA256 8967ae71354f9010dd9437f874caa18a203f4ee8bc940df432e42a4ce50ff43a
SHA512 a097a0bebdccede2d64ce5f558210e76b20dbe31a8007f2c289f811ec89eb6f61d065e941cafef3359426e0953900bc63be436dd0456bf0592b0ae7af23ae099

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 c9e08e9a29b63dc5fc3e5a1f1c7233b2
SHA1 da8fb42ef1d3a5d760f907a36df4a8b4b1712a3b
SHA256 c429ed899b20b852e50ae241f523c3ab74df6797e8646e17baa1c94852e6c570
SHA512 1c3fa9d14ad126b7d6b66f46d6f063322bb7195362b808018d936eba11167b24d2ed16e4d8f2eb389719000bcb95cc0cc5540a79f6a5ef1e98056b81692f29be

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 ac80ebb598e3233ab81703fca31d7115
SHA1 78618ccdd8745ecaa05eadefb043d07c87e109c4
SHA256 a785fcba5aebd1656614bdc6d58277615d5dfb0d2bc247ba5c0ad2cceb450ba5
SHA512 892012a253b87d234f97647adaca6a191115bd46e7ad56dfb37083c0f088e16e6ecc9e6fa6911a026240f4221e053e45afd0ebf5f7256de53f66d8fbb4faf51d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 de603263e46a08109d30873e341e93e5
SHA1 962fc93ce3b9f0d865b1485e7827ea0130b1f2c3
SHA256 31f666d388c58b339b8bf329560466050c9f6937e32e1755846d2ed17ba0fafa
SHA512 f6097aca54b4238722408437f5093685155e49267266a94689c177aa26673625f61bc6e9cfec74e6312af7ef18c4afa3a3032b13d834b53238d9138f4b7eb505

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 9063a9f8e4d268534f2c55f3bf8e8f01
SHA1 a949bbf0de7cde401484415fe94e5dcd0bcec9e5
SHA256 f90844a81e9e8cec0feebeb9e5677b811fa6ddc379074a03d592ac1ff9788270
SHA512 f5f4d3f9ebe9846ae03db9b6e37c4605169e100af9b07629544dfe49f00dfa47ea7a82a204b571ea5b0231e0626218470b58ccdb128b43f2d29c6e11a5c043f9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 e82f91ce9756802a24e2bc8ea89cdce4
SHA1 b11639d98fdffe2dd022e9a3834ac7fe47d42136
SHA256 825057042c9817a63e87717df60637a19702d6ed323b6c2439e639801a207090
SHA512 5b354803ca9bac6c941c84c0a5655fab357bdab802b413a555aa23a1d875346aeb613560c9d75adad1dd3b63b5eea89b457dd176b73920f03d1d0ab971ea14a7

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 a33568845ca6e8bb8f119696a33c5f42
SHA1 081d619ef587e1c9e205a99b79733d6d1064924e
SHA256 389d2264d30265eed2e6351dd14644a3a55b01ec76ffd4970edcbbebda2fa30f
SHA512 7907a08a82ef49f97bc61594443d6afa721d51c282b35417b55c603750718e6ffd90adb25a2b610e94ecd7a67dd9d26cac09e2180dbf95fb7d1a40a926185306

C:\Program Files\dotnet\dotnet.exe

MD5 11c5ed176f8a9905f08a7e6d1e2009ce
SHA1 68421ec76d779aac4668a4c8fc7feb7345fee920
SHA256 21a7e4334749621bfb92e8e557c22e73ea19915e0af8d2e4878c4c9b4cbc7ea1
SHA512 caaece168a8f9fdad7854191f52f1e54d2a53ee6688bc10f777ad09f6c0effde845c2d5d5ae01146141517b52ac5deba07d1307f4e40852ac869226d43c5a91a