Malware Analysis Report

2024-11-30 02:44

Sample ID 240407-v5sqbsac82
Target 2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk
SHA256 31493c1bdf43f6a275254ad896c9a78f6cfa3960e9d193eda2773f0453022876
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

31493c1bdf43f6a275254ad896c9a78f6cfa3960e9d193eda2773f0453022876

Threat Level: Shows suspicious behavior

The file 2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 17:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 17:34

Reported

2024-04-07 17:37

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\314c406f2a644d7f.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029b91d291289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6be472a1289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073d6de291289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077d657281289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6fe3f281289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad82c5281289da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_6ee7e7514394acbfbd535f8056053b7c_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp

Files

memory/2064-0-0x0000000000510000-0x0000000000570000-memory.dmp

memory/2064-1-0x0000000140000000-0x00000001401EF000-memory.dmp

memory/2064-8-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2515da37d56e9844100b3b9ba7e045d5
SHA1 42935b559f02fd35c83e3967f36e429f7cb904ef
SHA256 9ef5c9c155c7cb03349a4b7b5310389e1418b352727edacf39dcf3fb0c419f7d
SHA512 7145601a251e812cc6a85e0d650934cc15daa2aadb2abdc5ecdcf943adbc3a81c976d258d8db2de13cdfd0e04b3ca2be4d66adf4466a210004dae877c7c05628

memory/916-13-0x0000000140000000-0x00000001401E9000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 40297125cf2ece8b9307aecfb357aea6
SHA1 b8f45d0c7ec522ae88e43e6e50dc0de17568fdc2
SHA256 3e88c00756e0e108aaff9866983cd98cd6d8e4ef5f074c28d0419ef8e6d1a6d4
SHA512 c477deaf6552c1ee7f8c9139e1250d55aeefb823f09be3037d1108d4b6b9d0e17274fd26f3721cab09b6eadee48c1366afe663368e8306f1d911c0323ffbe52c

memory/444-18-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/444-17-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/444-25-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/444-24-0x0000000000670000-0x00000000006D0000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 b3ecfa687eb7d981495e53a1a5a7da84
SHA1 548c9187007680fc51510882220c04684dc4c145
SHA256 d502cd682b0ef5dac27f9afd2b7546ec8c66bd63996e6090ff9db0dd33e0a9a8
SHA512 f5c3f2474e13e7512de20a4e717eb84823d71589bc0fc543042f91d3dd56cb5cf9711694ffedd78faca6eaa8e2d2eb7767e101e2605e4b80da0458122f60e428

C:\Windows\system32\fxssvc.exe

MD5 dc75d670ea3b222d3893cc6ecf877721
SHA1 7b7e8a78db46023f662cd6601652617eafff64d7
SHA256 ecfe933aa3cc10734cd9419ace53df48ee2e846aa73c2d63042ad8a533dd7f79
SHA512 493c6defb31f0d210ab7f44609ac067bb7740663f321b9b26ab8c1dfe8a23e3852b5424621c73028c46642587d6cfb1d73f4d9603b2f18b5cb508ad6a7f68885

memory/2064-33-0x0000000140000000-0x00000001401EF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 2d02157f83ca53baabf0e00b08eb96d0
SHA1 7f5eac4966e2fb1f62a5ed62bbf26ce7a5453c37
SHA256 47ec17f8c8c24a9172176b03a59668b5b7256de3145c80083a632b8ca510e5cd
SHA512 b6781419c8354badc945f97402f394e656cf81bec77d7b8c9c0fe147638e9d1941b3bf898c33ef4b08b577730e1b18224c17fefa1cbc73de9798530fc1bd0d52

memory/3344-36-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3344-37-0x0000000000810000-0x0000000000870000-memory.dmp

memory/2408-40-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2408-42-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3344-47-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 3e4b15d26026e4c9109ff77e7ff6d3e4
SHA1 697b62dffd68facfe30ede50fc1f040298962e49
SHA256 306800365f21dd81daad1194d1966565a5bdf3a683303f5677b7960e30f8b3e8
SHA512 2e10f122a09929b6be1cc7abc3bfbcbc7379fbf57dd36b466907f0f8ddc96a6c6cf1733aa844db254e4eec49bb5b8562fc1c4a6f8073489f61111e4a7cf38a38

memory/1416-52-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1416-51-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1416-58-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 055087a11bc3dd5b58dafd56ef3ed193
SHA1 e5f3df60a492da01420249e51943ce2bfce9fe21
SHA256 e3b48740fb2371bf39371eb8376f2ffb3a521ef7021886e399ad6b7cc1349c9e
SHA512 f64b4edc05293bf7e834f9e3ebc1c93b37c229e1be89edab2650d543a1fe7090bed1183bad9bd776a1de5719bc54a96a8792924f94a68bbc9f1fd4e1ac05d052

memory/968-63-0x0000000140000000-0x0000000140209000-memory.dmp

memory/968-62-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/968-70-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/968-69-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/968-73-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/968-76-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 3c82caa43baae08f893c271053a7449f
SHA1 1c2851813e3e54fd76e235f4b1d1a68daa4eabc4
SHA256 ec13030a79f3389af765a836ded9e89dc09e661d9320d23679d3aa600da79fc3
SHA512 949c98ccbf47b19dcb89aeebe25359c1712d26c7306bcc797d1b7c3614a51175dd90e7a3f64f69299a3e403a92cb4f2c2c41467ee0bf0560b16f86e9ed086495

memory/916-78-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/3168-80-0x0000000140000000-0x000000014020E000-memory.dmp

memory/3168-86-0x0000000000810000-0x0000000000870000-memory.dmp

memory/444-87-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/3344-223-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1416-249-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3168-252-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 97771be9c407667973483861f69d6952
SHA1 a3501c257b2d97e7086d680b15600eba8c709934
SHA256 18af80020ecebb62eabef8b8a144b71cc0480caf648fa1bb56f97e49d1672014
SHA512 93c8ed6b1c9730830fae6c3eaf4c0bd546f7cb0006222e167c5b05dc9c422ed76d3b73eb30d4785ce7ab82aa3e77f449eb0f63da08759175803795e36833dca6

memory/4860-258-0x0000000140000000-0x00000001401F8000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 e82fbac890c07a9c0a800d6af803f605
SHA1 7512b29a48eac384105c9b9ff1212c2bd4a171c8
SHA256 0ed8ad907dc3eedf18af25654e25042adf6650912eb3d0f720a17e737d3df005
SHA512 b2dfc263f5403130d851799390edb569988eb3dbdd70914199c1608f44494222cf97b0207c2932b0f83c6d74b08c5e630449387f602590127e01766917eef32e

memory/5012-265-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/5012-264-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/5012-272-0x0000000000BD0000-0x0000000000C30000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 13829dc4a8f7d99dd5792a1904e952fb
SHA1 a7ae6a7c3f19c22061eacfb1d9ef8afc6937e375
SHA256 f758bf93e6d4b030e9e7d6e71f9b8ec7bb74d29d7dbea8622fbb13c4772c0735
SHA512 8cb70a622c931d789c42b9f6063f59fe59171c47932e99bbedf4793e5004d41b723015930831e05a950668ebc863a49016b53a8938b4773cc0cda0d0a8382e4c

memory/4632-276-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/4632-277-0x00000000005E0000-0x0000000000647000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 3904790dd9947bb0c17e333b81b5c972
SHA1 58bc280d73b14a1520b0025440930695c6ce939c
SHA256 53dce30dfe6f56505992cd9120cbff484ef26e37504ea300d77b6ec9dcd7c26a
SHA512 b38f03c1fcf3c33d6a6693c7ddbc47e2313a729cf50bbddef5f422bc09afa9a05d416e6bb2109bf483ba104a545cfc9d338b26ab964262c248f2feb5ae045e62

memory/5008-286-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 412fc8f171d8562eee06a1a719ed4662
SHA1 d17453401222a33bd029ed4ff9ef5abc36ea4937
SHA256 2e40171328ebb0d4b0a032a9627be5c7c68fa79e4246be5e88d673b4019e6234
SHA512 ddcde0603e051f068a501f166cddead652c00c3d6b93cc276a2ba887af198f617e3b923e6a16db9e67fee0dc6fa6f6eecf4f0c78cdd53d4adb443b199e40e191

memory/1412-289-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 91a3a532c584a83a58cd9d0d2e678f23
SHA1 dfd1efe43c2b52ac3a88312d363bfe5f2d4c1b5e
SHA256 b3fda35c8b7753f53246c98bc4f37fa41d4fb1fe59c06ec88cc7138ea43b5adf
SHA512 d869bf5cbfc540466aa248c7ed31303cdf97d607e55d48d50f4b4dd678094d37594d8346a95cd322a611d6610d411eba72978a23b6c92d68b03abb805a1d1121

memory/4412-294-0x0000000140000000-0x00000001401D5000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 5f984df0cca4c131f62900fcc13bcc4d
SHA1 84810e5eca5f7213053e7f1508cbe5e41e440b03
SHA256 89c07d842adfeb57371ae2b329695cabf571980d9adb7f597c974078f51281a4
SHA512 bd6f6eb9b864175f956e24c597035dd5308189ea9dc40c3381c44d94f82b24d55a1da6a8f9070a5786694c86448a47a8e60ab5eafc4629434bf86ffbb752acf0

memory/2160-297-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2160-305-0x0000000000770000-0x00000000007D0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 62dbb23eca6d2796093f2b13c8a3d13f
SHA1 9d4ce4964a450196706759b7d44134c1bb3e3680
SHA256 0e5fc6f1fed0b1d054fc3862a18f2684527867c0fd701b2f24cb97c7a86eee1c
SHA512 e72be6c7c259f7ae07c40f3debacdc8a8d384a0e3ea9fd7e01e4fda4263b6d072d264fa9f230180b54d1a6d631fe3d78dfaa0441c9d4d69aee0571c990931ac6

memory/4860-310-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/3760-313-0x0000000140000000-0x0000000140241000-memory.dmp

memory/5012-317-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/3760-320-0x0000000000E80000-0x0000000000EE0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 79a6578c9afcc30c65a0c655fba2cb31
SHA1 84ca42e72e0ee73e1823f3704f86ca9d03c004f1
SHA256 621c752c135556f74654267dc0f3f2d3ec9c51c353fe777b5332745b2140c6c0
SHA512 d0608ef78540a5e5724f1a0953e859775f73dcfd926036698f146dc07b9683df226e742b0a385943e889b0b0c986d20b40f648a90a6d9694bcf6041279fed3fe

memory/2220-323-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 11fd1eba768970074428c29b01035b8b
SHA1 7ae712852a8f22f603f3673f7de630e5c9e33004
SHA256 fad89001bc2318ba84918fc774f7cbdc2ea6552dc04022c3d185b76e481f8f1d
SHA512 c946690d25963c74c308584117c0835b647c398696f3826e1cb0e45c91d06d7cb33465a8d3686211501fd27fcd0a66b085cec7cc4f35420a1574aea28c49973a

memory/4632-326-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1280-327-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1280-329-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 6ae09b0e84da0a137878e59b63846aac
SHA1 9de89294bfd47e3ce9c11564f5fe9a6181061ac5
SHA256 c3bfd7e3f55ae3b52907432ad1d7ec7e151bc8e9ceffaf83a5d30f378e18c93a
SHA512 302157823fe16d09d14beb2f3d0695559f53995cc304a6c032c026d3f7a7f0a8b6e3910aee87a3435189401b07b7af56694505ec00785214fb32cb718f66ef96

memory/4632-331-0x00000000005E0000-0x0000000000647000-memory.dmp

memory/936-332-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 7288a16be810f6807050cecad12fcd73
SHA1 90d918976d8c4e8bea6b43cfea2a687f34af13ff
SHA256 6550561bd4ebba4a1655350187da95b3f248f7ca065ed77375eeab02e0a67bf6
SHA512 8767c6ae45c4af84be589cbf0faf0eddd462f6c79be3b95dcc0d840aa9266c8f1d7fd2da12f7bcd2a84cf2a27feb3808ab6b31e2acca8cbef8ec76b6a7dee627

memory/5008-335-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/2060-336-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 5916865ebda6ae6bf576dc7a4f17d9e9
SHA1 ecd4681d789f7594f326a01f0902d17199132516
SHA256 7bf3dd92ede2f1dc51f781503068362218b43cbef0874430b3b85765d238cce0
SHA512 65601b62ff5f2695bb77ccff2e5c177b39607d1c584690039e76b67147bd109ce581095651f10038f86d702f3adff05a1d3cfed4094b5a41ac1aa5a10049dd16

memory/1412-339-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2992-340-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4412-343-0x0000000140000000-0x00000001401D5000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 cd63ab4cbd51aab877a7b7cadde0f57b
SHA1 f1cac2a8bae487aa70c5ff2536222b18282300e5
SHA256 c0663a12b9b6af855c658910310da27637112be68434ad67ad0b2dd047560f3f
SHA512 acfc5eeaf01a2db9977e24a9f0204de58b0f45932ad1b39f7c3cbb9b0e8b1c8ae1449b15d6e121be1c35f8f0dea1b71932bf869d23aa443f05269ab3d23623c1

memory/1056-344-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 f9c66882b101c5713e876eb3cf990eed
SHA1 90fe3badcad75670589005cc91a9ca90bd36bbde
SHA256 8b44e4ba453745595f7ee1d4bec38e06de394d6338884b105fe9fd0884fee2d5
SHA512 20872dda7f04fddc6b17fce4dc23b26fccd8eb52986d9b76dfc7e0ab549450de45d7f02ffe8e0eab098881cb55ed80edd321847787c81bcadcff6a8008225255

memory/2160-348-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 3f6e7ce07de212f46f02c75778266a8a
SHA1 3c802d7e41bf2804518cdfdda68b367f83c1c824
SHA256 cedb9d1b4261ffbf1195d764323f674e12a1d0d481492b3346e3290b61743023
SHA512 13fd927dd07defb113dd47ab65ded77be6cf6432c00e92b12b4d34919d0667705bbfafef20954e82181f740527eef1d15c98571ed3853d3c838644f371b5f1de

memory/2552-355-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 bcc8f049e239ecde1156a8e344ccfb6c
SHA1 3eb055b14ac74b4ee9e1688c7bcc51c7659a5253
SHA256 c05b53f43f3664a4198b848927ff892e6f164f8f2954ae1181911f2475834b96
SHA512 110bb8556d1325e05a69e53bee681563b9fe8d67cbed336eb9d7b2f514dca452d995060501a9be65bbb976319eb4188704a491a515202222658e88bd7de24241

C:\Program Files\7-Zip\Uninstall.exe

MD5 df03ff2927e9b23ccd55fa3952b7afe1
SHA1 ebf57b741baa808bb7df859e47a2047a2b2ff9d4
SHA256 a6a40b7a3db6c58d6f05a2f1cae4b0361e206e7cdb644ed151c877b78b760c60
SHA512 801daff241b3516f3c65a129a7ee47a315fab3f7d9666d741eccf556ec844416a09fc6970018c36b0af91e300cf482b1e1e594e520ed123f7689f609e4e74c16

C:\Program Files\7-Zip\7zG.exe

MD5 78704228b0fc6ca2191216e0d0b7870a
SHA1 30526cf6867604aef590fb95cf5370401afb5708
SHA256 7d9f95ebd7affe90bf3d810178d05751dda895408f0dc2a251d04c1cb995be59
SHA512 1e67ace4b2acf84bb4a3e92268f601e5fef14b45cf01214a18931f177fda2524e63e30fd221895d4472fe2b47250527ff1a1d13f08cd640f4329c6c5e3536be6

C:\Program Files\7-Zip\7zFM.exe

MD5 7c30a68af809d18ffedfb46c741f132f
SHA1 521d5ce6aefe0e2ba49cbb4067f03a01a1ffe0b5
SHA256 1554a5274584cff71187ea2e35f9bb17c42c0f4a1294d5a36a384f97238d14d9
SHA512 0940f756cd0ffc1574a3797358da819d5e68149ae5f41fd8aa75ef1bdb2d104b28a2e8fb0d243a3fe6184a393feda43aa43cb6d241d9f0c47dd335be4702b266

C:\Program Files\7-Zip\7z.exe

MD5 a79641dce705263cf238849574ffea23
SHA1 1ec6d0095652211856ca787c283be3d46de62aa1
SHA256 95e68a0070bdeb6cec2905b77e2901c2dc332b4b780916e124e79b50a758cd6a
SHA512 0c05aff6bea3c42aca9320bb1ae2f305f51bf2140977f1f39aba15e4a3e3257291d42d733f0dc4b538fa2f1a28c12b74906308c92f2eecd82df95c69b829b91b

C:\odt\office2016setup.exe

MD5 a7dac97ed8b1943e4f66e399b7dbc8a6
SHA1 e4e8e6b97d9684b2c08ef91f6926016489050d57
SHA256 440c9d7862246c12115c7dfe1f800d128806ceb5dec2593cbb45b326f639d457
SHA512 2380d49c6f1b9d4bf9d4a390551f0417887b4a4cca8b95e24ec0f82ad72024db603273e087066fa502e95e43977e1bf2f41259c57d9e622dfaf7a4daa90a3006

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 19b8ea8cf13c501b5f0905b7655b3188
SHA1 73c2ad0b73fe8533d8c7a17150ad2c675a6f2266
SHA256 1445c2a20e9146734ae00d054e9fe99b4aa352b6823d7c549e7a6659a3b3ea54
SHA512 6de1bb88f70032017c5b211d25109c4a21ef0dc9b89b55518ce09b2f4f032214b9e8aef4478fc9489a7830af501dae65be3d996bcf61ddcab76f5575c58e0da5

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 ea0b106b4010dcb415f15bc4403db6ce
SHA1 5d7e1cca652dab1d3d928fba566df3477f3576f5
SHA256 8dbf7ecb51f61756d1ded79d2614f024dc3d0e04c40af837e70348c08f7a5ef9
SHA512 8065f64bec341b30af6bb49ebc0c15ad0b223166ffe5e1ae341e70d3eb2fc288c925d47382bcb0a1bd841854357944f94411a6a2c562c468402ccb0a724def6a

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 0d6a32a8e0d9730e0db2685bf6988263
SHA1 b7861b7e327da7833d70ab92003b6df5d47cdbc0
SHA256 07d277ddfac18ffd0906c0d859219bb951df8ab0d89a5b096224ca1ab1d02f81
SHA512 41f7c2963846c44ecc217b49469091e84b9eb9d8d85f76fd14754ec89e880bccf2931fd1e28615c0749523831ed4bc08fbdce9016f7840830d95c2ce0c4c5cbd

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 e34524853c31d5fab86dbe793e697e71
SHA1 c17114f81a63e3104c2cac41aacb13d3290602e5
SHA256 2ab825bd747a1dfab11c983469b9015a095f26ff57e5c13435a3510536dab8d0
SHA512 a2f35f7cc2cf59230a33fdae17f1c1704f29e24c8d306f5c84b412ed870a3c35fb04af5acb1459263685ad549e4a1e0e5b01f53f17e349f32636d6abf348e061

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 6559d6d79506d8e4d4f0fd7ede8abb4b
SHA1 d9873307f85654da5fe5e7bff0081102fb829137
SHA256 c99535e7362bccfb758d458e61f9aaf0a258782756562684849efe2b9a35e8fc
SHA512 185007e6251ed37be8086fd4932d9aca7c91748099e1affbde46effb208f54d923a2cb9f860785340f9fe796edb95191d29f81ad65e41df5488cbdea0185fd36

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 84cd9e3a2b2a6de4d48d44664a986d29
SHA1 94c07cc4799b92f2e6f156e101d25987b7d147a4
SHA256 45499a3f716bedc102e681396a67ec384e491373af9e427c9216717bb27bff6b
SHA512 6074b25c543ddd60e0a7b3440cf4f7f27536f02d97a1077b6474b927765dbdf9ba3e211ffe81c84d110b2bf4a2b2526a1bb666a18e7818e6a3950a67a8746c74

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 d1f86109fba0b426e10905ef70b94b36
SHA1 14990c3765e963686e50b699fa224fda167cc834
SHA256 7e56a9aa4742f9fa659772315bfd02e70ea9f1bfb5d23c623b390d6d1b5119a0
SHA512 105aac47af1c31af6acf19eb0b3876acf2cfe3938311557c062c7f1bd583a00ec34070f8e60094c93dd58624e8a5421db03a57d98bde60f8fceef0af21beb42f

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 deb8e14844dd7e056f8e71361478a282
SHA1 38d77ee679e32fb7d079a7fc43d772ffaa34bff2
SHA256 227b9df1d7254e14bc77b9269f61ad5d3640ab96c5c75f64cdad272c0058962f
SHA512 c8e8b9651c68ace15bd9861fcc6dec8eb7b3ac89da8993d756ee4c2cdcaa8b8261d586a6743b23897c353312064c96c0225d147810bb4610dc602c68c4f4c1d9

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 60eaf501e37c244c918ce5adffd325cf
SHA1 aa4125213bb29cbc32af03b181d5e7b7428b5dac
SHA256 860f95b1d40759c89f06a2df526a595dc2b3ca31f98c3767f5232bab60a88d01
SHA512 c7313b1abae89801010e4a00681534fc495f4e76bd317c371249bdcf5a29e54bb236931635322f8fd63c3e835cfa0ca4cbc979d45f5d085b412ece0f2fcc95a1

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 f72e2efbebf0993f619063553dc5f8c1
SHA1 9c1af5ff2933c6a0990ff3cb8644ffc3cb9a7360
SHA256 386d74623f9e57713a61da208d57180c97e6717ca5a218d80f7f0b91d2dac8ed
SHA512 cf3178d159434f5a7c053e8ebd81d66870dd8f81d9efc99d8cbd9af91aaff60426caa25b14112e2257f5f6625ce0b3aaf4e786a19d5bff377db986328f8f7bf8

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 4c9911b2d94709ac84c84eb78db7ff2a
SHA1 717ec63e326d97137e424fa64402a77859648fe0
SHA256 6228ae409f7bab89e97ff3228921be5218a3b3a191921187ce1c9812f11cb183
SHA512 9451717742660dd26b42cbc512555531cdce35e470426d28053f7c6d380b9f25689d7571ebfa55c13d86e63b38874a4b2ca99993b479eb59f8cfce8f4abf9578

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 6cc324dd0baecd2e0e0b9d8c656ea8f5
SHA1 ebbecb7a4a88b54b209df0f9013ec4837c519f55
SHA256 401ffa840727d77352e62ca47039a303908d3e92b3e7d29051f0b7f3a2580452
SHA512 2209d382032c28b00e926795e01a35d2d20947703c7a72b462afd2bf74d2218ff37c22de2c15b5f2e632e0ec2fd8faf30a1d98bbd472d1b4b9668cdb2cc71cf8

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 d4840c5cc3c3eae397a7f70d86d52fd9
SHA1 15cb0bc912d456837268cec43dd2d12ee38a3af5
SHA256 bdc3cdadf228dc9ede272841e22be95b3e51c8720298df43f114e6a7876a0c42
SHA512 0d81c4d1eab51b2699c87a2762bc396e5de3da93948c4e4301d401ea34831225019db96fe0c2ac7c4f05dec9fde6ea26f8899594a35f7adf8b77f5ded79711f9

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 da7332983bc12cd2622e3447fb3c1af1
SHA1 75afa59202d3a1ceea0e8b537e85894c681af63f
SHA256 b0fc86508e17e0881953f3229ca54c1b8566799a66bda22b405297f8e5317bae
SHA512 c65ef5080a0814d13de0ec18ccdfb7ad64e236a5d4431c5ab575ed135ec5b98d616c066d9e3cf6e66b3d3f5cd4c5a10825256f6c21f59c2b27843f1cb9659141

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 46521bcc82b7f9b333998df8e4002de6
SHA1 445a4e21d1986962e823e64d8a3091a9576de5e8
SHA256 4928ae129c9d62427e157a98bde677eba1fe4f2478b1e84178e2f5cf427634c3
SHA512 d263da29df433cae390615a421eb44af1d4fd5ca98aec13a9cce7da9fedac8e78b65f0699a94af23896c27ab108079bbf86859ce96f0f61d98f6aa26b799d552

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 ea92407fe2af5411ea1ce92998b7e445
SHA1 0141fd31b4313d491409c4d03daf732c146aa3e6
SHA256 192338b638ee67a34ed38e7e26ba2b2125d58005caa24c62dcec3a53993638ea
SHA512 003117d1a6af3f4c9d7391fcc56b7c0b0b5da612f0b97ab9cecf11266428bf6fa969a1fb495d0ef484088828bf45a8a67e4efa4740c3304a306dc9f0c7eb1b2d

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 cc9c23a2c0e833b2a0879618f8fd5f76
SHA1 0119319bc104fd84796f7edaaf6a141fe2bdad43
SHA256 8c6790dc71ff07786afb2a57c91e0cf1a2f719777d9098bf36fbeaba95db4106
SHA512 15b1576bd85c8e4c566b8f08cb59fd4509c9fcc18a277f4f122e7f7ad639645230b86c087d113ebe098a86a654fa9993e8c09f2a8cd20c9036c13a011f1b0fb2

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 cdfff7c379df8952538d2fe0ee63b52f
SHA1 180d3285975411acb112c8b77c97ea02db814a5e
SHA256 50fdc0f4ea615b48b8ec48783a986644399ff256dd18929264f8795b145be947
SHA512 a10d467ff7412b42930f52d4330a064cb3cdec861d77e972dbbb53d5384288a62dbb2a0810efc69d1c79d04dcbcfe7c8266f4d986164c7903e805ab62f3be10d

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 7b87423012960e6a1eab8e2fffcbcb22
SHA1 b399d8309a763c6e8b4eeaf8ebb6743068717c82
SHA256 4ae9f9e9dad4cd696ba2f12a0717af190bec6b3a3d4fa0bca11ea600d4b42625
SHA512 868ec7dda915257f64bd35c50f9f269bfd0fd52a96d5e2d072c30dcfb48f5c3913c4d9eb1585f7598a0cb3a7506d8e79f776d28684a4f997e9f7d3a32222cc36

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 10992e7d563f26546a9846c0240deec3
SHA1 75305ce2d0a93cc92db2cb426daea5e1b0e2aa3e
SHA256 ce82bff860ebc02d865872379568816a9a59f6e076a78d139c0385741be712e3
SHA512 6df85dcbc9d1504c889e0b64984e7098875ed15fac3b4f3645c4f659fc15f8620bfff9d25f61c4069b2abcfa966e8955681f153d643a59b35577eb8beb19232e

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 8381fc9cf84705ca943289d4f4302e28
SHA1 f7c09082075a204aaaeb762c6eb5c564ca10c886
SHA256 38b4ab2d1f5fe07bf999ed447a0ef50704ff29f48e72fae9d18f47d0c676e603
SHA512 6b71869ed32526d97c17a27bb9e43c7a3fac58dc340ca4d649160d541214ff4f6f91caa164eaa37384f340689d6f67f34a7a4551d029ff1d3757944b371c7868

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 cb909ba1b6d40d87577d4ad5c2cbc9a2
SHA1 73a424fc24ae062d7809c501ca88b320bcb1afb2
SHA256 5aeff26f8cf2c6219c1d42371981d853162d48194f4c19f34dfaee524eb9693d
SHA512 eedd1925c208b6e8d4a0fac33149d1d1684e73bb6dfa5d55edbdb30471b3ec87d559e362ddb8d2e93034b01f46a0a5eca3bef24ca03b5bdb00d111ee37380a7a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 0bfb3dad2950155a426b70a815db6fcd
SHA1 db58c9440dc7dc424b7f6ab9faceb71afec38c6c
SHA256 a318a5bbb212bb374314afa24e33f4a3690b3aef7758d61e0c54ae6cee60339c
SHA512 1fae28f0ed773ce7a6b8e4c6b48397e5935f248b194379cfa1d800968a608d70c4fe9d634bf7d05a7464fa6b2b0760205f77181b7c98ed054b75470c40e171b2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 0a382b37d65345c11a2321249edb67e6
SHA1 f079b143a896bf40b70a566d57e82e053917e512
SHA256 fd6d9840655a64c20db12d94a89ff6042ba28d3a704ae03dc16f815d0c3f4b9c
SHA512 6118c16a7ca4d2200f978ca85c11d7824ce27b9a684526b25e85297359178d0ababdc5628c8a90b43f6d951c243c8eebb17c0d199ad65752436785a797515ad4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 fa3d5155c10439e664b2869700cc4224
SHA1 4fcc9317fcf407b5944576dc42f5d851fcc584da
SHA256 4c8d486557ce4fc57f253d57ffd1660d127d3577dc4caa6b3bb46454d3c84ac7
SHA512 c80d49bf28d1dbeb679f756738c137bee3ce7f8f90ee29556e083b3ebbda80d89d882cd3ad1b7c6996040de78bbbac9a7b3ee4e08b0df7ac00b83c5f306667fb

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 b39d07323db997d85f57ff94feacf60b
SHA1 6452a5e7f8b78b37a3c75be99e47d9cfcefc2498
SHA256 6c5576a50a5d1b679274de0a5647972024fe62e531059fe3825b078229c13a43
SHA512 4ad806c0866a4e1b6e5da659a9175822b49982d3bd925f04b7304756394e70485e390b99bb17810bab0b2308972b19a1c1256293c6905556ae57ae70dac30a0f

C:\Program Files\dotnet\dotnet.exe

MD5 aa3dbc45f6dd77611f22147e6fca4f50
SHA1 76799c9293d63232f4d97ff2cd17fb83a719f21c
SHA256 2a5b681edbe60972a8cba145851f218bafb842365676bc45049a76930e8a4264
SHA512 7c12ba34be3fdc0047d1ff9cebbb8dcd312822ac95af0ed7e4d42d8c413e44dc759cd98bd73fb64d48752bf064838aa368672817c5e4d2b41d06442940254515

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 2219b674bd12e51068dbf844fdf7dd08
SHA1 d8833bb81245f0df11d0a1d152b21ecb54741123
SHA256 e8b22ec54a0992e3c28709c6dc89d989e560a20b75d81a25c9f1a94ee7c0eb2d
SHA512 36c5f66d2dbd903153e95bf62cc1515408ada83c2b3bc1797a28fc20d1e9473e6f59c2294afcdf38f9f1597e47703fe07703a81c66d546dcf350b9c1278c0c24

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 4bb4be5ac9cd084b201d83d997a880d8
SHA1 08c7609383f5a7996c37dccde544224b3e1ce3fe
SHA256 97914e2078b2cc8ddbb9e2ddcac689fe353812829030927fc9325454dcc6c94a
SHA512 087f6e9b82dc7cf187b9899686af2b879af3390ecabc171f73645112d83dcfd8f686febfe93592c98f0632cf55a0da702aa92ab0f2a2cb9b9a82320fd0f769db

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 7c2b286e75bc568a5861bd5569cd5f77
SHA1 e742f35256edf0ad3675ddff63592933747441fa
SHA256 ce0bf5632537ea3dbe00da67079ad7508be05a299ca628babeff547b7e836d24
SHA512 6b5a8207bfc223468a8caaeb13c087cf9336620fd8cd9c255a56a21d0f1d2fc9766d6fbb2650c6bef7ac544fd66a53656d13df6abb2118275bd1e079860cc375

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 30702549dfdd2dc68bc6f441918bc58f
SHA1 419f17c02a84a638a7f9b79a37f1699b1eace98c
SHA256 1183abcbe888f7b3d7c5f155126971578d482f0519a60063c8f2c7a7be6d2bf5
SHA512 faefb777d5ff495b9d322a8f74ddaaecddd42b7d79ec637bb625f6f31dcc607fee40c157177a7b628a531e67046546682a09ae1623ae3aced8a69fa38928bdc8

memory/1412-422-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3760-427-0x0000000140000000-0x0000000140241000-memory.dmp

memory/4812-429-0x00000177F8730000-0x00000177F8740000-memory.dmp

memory/4812-428-0x00000177F8720000-0x00000177F8730000-memory.dmp

memory/2220-434-0x0000000140000000-0x0000000140221000-memory.dmp

memory/4812-435-0x00000177F8720000-0x00000177F8730000-memory.dmp

memory/4812-436-0x00000177F8740000-0x00000177F8741000-memory.dmp

memory/4812-447-0x00000177F8720000-0x00000177F8730000-memory.dmp

memory/936-454-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4812-455-0x00000177F8720000-0x00000177F8730000-memory.dmp

memory/2060-466-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4812-467-0x00000177F8720000-0x00000177F8730000-memory.dmp

memory/2992-470-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4812-485-0x00000177F8720000-0x00000177F8730000-memory.dmp

memory/4812-486-0x00000177F8B40000-0x00000177F8B50000-memory.dmp

memory/4812-487-0x00000177F8B40000-0x00000177F8B50000-memory.dmp

memory/4812-488-0x00000177F8B40000-0x00000177F8B50000-memory.dmp

memory/4812-489-0x00000177F8B40000-0x00000177F8B50000-memory.dmp