Malware Analysis Report

2024-11-30 02:46

Sample ID 240407-wg567aaf46
Target 2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk
SHA256 d9a28dc593b0e541c4582615fa3d2f47d6fd3c4392800a92a22058f6f71f9673
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

d9a28dc593b0e541c4582615fa3d2f47d6fd3c4392800a92a22058f6f71f9673

Threat Level: Shows suspicious behavior

The file 2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 17:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 17:54

Reported

2024-04-07 17:57

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe"

Network

N/A

Files

memory/2324-0-0x0000000140000000-0x00000001401AF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 17:54

Reported

2024-04-07 17:57

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f3a032192a644d7f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{13D35E3E-D723-4ADE-A208-2AB0A3B02FDA}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_124281\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a15afe71489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003701bbe71489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072c727e91489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7e8aae91489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068b8f5e81489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b918f8e81489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093722de81489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cafa55e81489da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_9b5c9d97b358af2f35b9361d8095a0bb_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 104.155.138.21:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 21.138.155.104.in-addr.arpa udp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 106.246.116.51.in-addr.arpa udp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp

Files

memory/212-0-0x0000000140000000-0x00000001401AF000-memory.dmp

memory/212-1-0x00000000008D0000-0x0000000000930000-memory.dmp

memory/212-7-0x00000000008D0000-0x0000000000930000-memory.dmp

memory/212-11-0x00000000008D0000-0x0000000000930000-memory.dmp

memory/212-13-0x0000000140000000-0x00000001401AF000-memory.dmp

C:\Windows\System32\alg.exe

MD5 b0542524a43cdc137ecf59414f04c8a9
SHA1 30c05b6bac719592fc45444fd1412717189d5ad5
SHA256 c363192993369a42935172aeaea42807a7f21772c927dbe2f6c5ae661ced6c19
SHA512 3c89282f3402563560d8ec7d8551fcb6805ab3044d0b5bccc96660909edf0c780fa5f0d0699457d1f5c5f2fddead893ae8eff181af809bea31a28df52c9a83fb

memory/3480-15-0x0000000000710000-0x0000000000770000-memory.dmp

memory/3480-16-0x0000000140000000-0x000000014014A000-memory.dmp

memory/3480-22-0x0000000000710000-0x0000000000770000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 0d523175861662e1a63f3cb890546bce
SHA1 4ca0502a3b90e310cde15d6911004ef203711038
SHA256 9eb9ad2906efd117f9fcb6d795dbb4a459717c47c30df6a369bec3da1d371b48
SHA512 9d77ab72aef4bb2058ee755c0d8a32ed23a482763bdfd946ffaebd981f86bec0c429c59436f68deb2a19f9a99aa31af5ebf3c1878ba44ea6f03451d531a866b3

memory/2132-28-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2132-27-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/2132-34-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/2132-35-0x0000000000D80000-0x0000000000DE0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 0b0135bacbf9d9eb251aaedf0de75c01
SHA1 33f9d87a7fc4fa12dc3803c655afc01d5fc84c0c
SHA256 a8beefb43f264f46245b0ad11e5955f5b9f4231b246ca9f6b1cf4017a0d0c2ba
SHA512 66aacd25eccfbeee6ae1588b06a0b2cd3047f3333eead1979dc3cb46e351eb9a5cd9f7561e9706c99c06d3c6b843963c76af7e5ee4888fba277d4c1f1928fa93

memory/1656-40-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1656-39-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1656-46-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d65b531cd54f033d8cca942515d33a72
SHA1 9bca92dd788248345f99de7136516055987966cb
SHA256 ee1a157b36f344877c5a488123276d057ad99db81395d013fbc29c08a9607960
SHA512 03a6a9d820c037dddfc2e2339b5585a473b8a4c8480165bbd95851cac0905e63c9144bc5ac4c02277f7ce00e7c8149fad77d16e4cef8df7c212ed470036ecb16

memory/2324-51-0x0000000001510000-0x0000000001570000-memory.dmp

memory/2324-50-0x0000000140000000-0x000000014016B000-memory.dmp

memory/2324-58-0x0000000001510000-0x0000000001570000-memory.dmp

memory/2324-62-0x0000000001510000-0x0000000001570000-memory.dmp

memory/2324-65-0x0000000140000000-0x000000014016B000-memory.dmp

memory/4740-67-0x0000000140000000-0x0000000140170000-memory.dmp

memory/4740-66-0x00000000006F0000-0x0000000000750000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 176f317fe1457758a51cde6f0d499806
SHA1 459c8c0db75c1ec66235e44ff3992b51c2be7e31
SHA256 b0e4d6df9570a9df8a8c7d327dce2cde0d31312ae14a6e013d58ed171d0afb12
SHA512 233853cedf777f4ffcab5bbdcd6e86e59ac60142e189f525a183c54a83e26f734ebf4f9cbed471f9bd6111117d47c60fbe63bef81f69b0568cb59baca02bb119

memory/4740-74-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/3480-181-0x0000000140000000-0x000000014014A000-memory.dmp

memory/2132-232-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1656-237-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4740-238-0x0000000140000000-0x0000000140170000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 a26b6e93d38bfcab2d1ee416191c60e3
SHA1 94bb64a7a58ea581fbb946ac3f3ada806ff57d7d
SHA256 fcd964d169a85a0bf14617c077ec8a9d5f40596811f3f069d6ad354b960b147b
SHA512 5bef1a6da87591857dd8c3d343d14433ebeab56abadfa9ea9ca1befeea43031d578cb4ce93274a133a860403d2de575d9cae653866632069c0f5f8bb0157400a

memory/4004-246-0x0000000140000000-0x0000000140149000-memory.dmp

memory/4004-245-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/4004-252-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 75e222f1259e768820b87125c1d91edc
SHA1 b22f704e2de8492b6f5b359a63cea826545c41b8
SHA256 adc3c659ee87cee134e2f13d12ccff06bab2e3b328a0eeff617703e3e66f8b6a
SHA512 14230e395191594c48441785eb99fd76712c451d1a434bf076e226f5ceb824a97ce01eb06aea719a87e68b635244470cb6400fb1b190e038b9a8453ccd111b73

memory/3292-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3292-257-0x0000000000DD0000-0x0000000000E30000-memory.dmp

memory/3292-264-0x0000000000DD0000-0x0000000000E30000-memory.dmp

memory/3292-270-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3292-271-0x0000000000DD0000-0x0000000000E30000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 67d06b11556786aad389e1004c0c152b
SHA1 387f6f416239ab507b4da2d6b579305eb517e069
SHA256 68e7d4c5c407961696dcade3170fde973d40e45f3dbc7f388a259efd19cb940a
SHA512 8f65d9f4e3cf4bf73059daa48bbebcbeac5ff2668aefde7f00441beb7b798d9c9d0082065def1f55f49382736b529bcd3f11f330eaef74dc7d5da1b6ba018ed4

memory/808-273-0x0000000140000000-0x0000000140159000-memory.dmp

memory/808-281-0x0000000000D90000-0x0000000000DF0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 b4d7786c58c5c89f5484f6d7eb42538a
SHA1 0bc1e9976b6b0eb814f3fb8bb31b5a0d80710523
SHA256 d8a9756895bb6af4f845bc818d76a9efb3e9faa259cca13807edbdd970fbd064
SHA512 10fad5024004653b09847d640886495c2eae7edb777cf3815be4ad39521b617bcf62e47a3153330b5e3721ea7f63a4ccd5617a92628a30ca78ce792b635c07f0

memory/1988-286-0x0000000140000000-0x000000014014B000-memory.dmp

memory/1988-297-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 d1556a81f1d9b3d81d62c1564c89ad4c
SHA1 a3e4661be7a78d8b2187f0c59a97249eedb70e01
SHA256 b8efbb6d459fe63ae3bf96e7b55844842953dbc3bc0b9052fc4bdc8400dd875c
SHA512 0fac2699040d8398f00b125515be7a45565680f914c13f4a148d15bd95d5dfb8749e5059ff69e5b29e5833107ebe90e52e4fa7c3082c38be161aeda7c8ea498a

memory/3164-301-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 5017a54d209fd8356959c02a3e8d9b36
SHA1 3f3693497e69daff543b2eee32fc7d7c07997a1a
SHA256 5b6a45ac60c03654c075b62029e15c6e58238349138bd1a9092045b2c0a8d356
SHA512 94be1bd7afab37ac533cf518319e8b89cc4b05ddd619ce2df42e2cb4563e5e783b5884076f3083d8774d1ddc4a6f28b0a3a960df24450dcf47664c5db16c4c73

memory/2396-304-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4004-312-0x0000000140000000-0x0000000140149000-memory.dmp

memory/2396-314-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 223c05d2eaab53428b0db99da55994c4
SHA1 9d10f26762fa6f4425247084daf86b94bfafa47d
SHA256 8e67281638b03aa477d887d81c94a78cf845883b9e90d918dd811a481551d68a
SHA512 80e26d5a7901fb20329339431848039254f677fab5f117dc9fb6cc21e0d70deb68b635ac4a07b166181d1790d7a1dd4ef3bd899dfe0ffa320f33165615630b91

memory/2880-318-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2880-325-0x00000000005E0000-0x0000000000640000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 06b3c37ed8fc283283f435f22e8bfb6c
SHA1 cfd6cb5c52452d3e0efda6109ea1a06285257ed3
SHA256 921d7da7141086f1a0176ed3ef9c901fcc095e4486b7546c82f7c694471002e5
SHA512 05a4a927dadb748a4edc57d4560e2e2a9d088546a11a61984042b5932a0ea722b15b5c947b7cd61b43b111d2c11de36b4697fe4b40e1708d595c42c720b5ea69

memory/2112-330-0x0000000140000000-0x0000000140136000-memory.dmp

memory/808-339-0x0000000140000000-0x0000000140159000-memory.dmp

memory/2112-340-0x0000000000540000-0x00000000005A0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 8bd0fa28adcfd534edc31431e74c289a
SHA1 997ca8a1cc03c56a9b854e64cf41758edbace848
SHA256 5ec8b8dfd3d4c4dd62f8de7a552e4510cf9db9898d9e8c040030d5c0f4c6931d
SHA512 4df5fbe749e6b95fdf203de2b3077b282a776769fbb345c3b08d99beb0e4f349cdfb89f9c36caefc881119afa19e06791c31e54f7ce22f56a03937a5ff016f24

memory/4336-343-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1988-352-0x0000000140000000-0x000000014014B000-memory.dmp

memory/4336-353-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 949bbd3f71eed43ada715847840bf543
SHA1 d6cb657ed2c2fb8361679e1a24881f520ff90cae
SHA256 706fa92f0627c0b6eda3c13dee0b8db28da9c9df0221b232d44a91d4f449896c
SHA512 900bc60130cd1cc9217c5b251254be7b2291f95d9880a767d0fe5f17285fd368699c19eb13a81725d80f2cef8756e46e97c413e818475cddec5388fce929cdbe

memory/4388-357-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/3164-365-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4388-367-0x0000000000DB0000-0x0000000000E10000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 3b4e2303b63c08b2c14cd9de795ac4c5
SHA1 3f226e8136d5568c41e206b6af110d7a233bb5bc
SHA256 0484883bab47e81be900351ca59a28cd1c09620d5f2a7a3d54795f8d9cd2858b
SHA512 5bac4582b3478629056fe3e0a0b865cfc4a4e394a6164c7937c84c7afd4e9775c8d497d688f7ddadc61d4ec822e31cfa28fdceaa6f37e383e7c9604451d824a5

memory/2396-371-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4512-373-0x0000000140000000-0x0000000140182000-memory.dmp

memory/4512-379-0x0000000000860000-0x00000000008C0000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 11f1e558f330a1806fe090b9e50614d2
SHA1 eb0cac2761c8b0d63a232ee2e9c19dfd351ab6b2
SHA256 aa864e3677164074d2f7157531224637b4d9893dd935446d5883ea13d606fadd
SHA512 14ab70b9f812a913f97f7c03748d6c65b6ba800101d05b9d79f7c2de6b23f039916613ee864434554eaf3d9b3ed81dc70eeb16dd69518bc47b4f850e4ae9ad61

memory/2880-383-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5104-386-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/5104-392-0x0000000000B60000-0x0000000000BC0000-memory.dmp

memory/5104-397-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/5104-398-0x0000000000B60000-0x0000000000BC0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f8f73185777dc96b2626d0a5d73b07dc
SHA1 543c986f562491e377e7756ab807b20d171529ed
SHA256 c2c4e01ea100abb0a07cda9da68f68c135942eec0e3e4232421c9ba3596c3e97
SHA512 ec1a407301b8ee5c23ab1bb318fe985e8dd3eff27b7fa8056b8853807b8319c4517ab15a734ee73d130fdaa5e78e828a75df8125be7dc219fd5b49fbaf41a936

memory/2112-400-0x0000000140000000-0x0000000140136000-memory.dmp

memory/2756-401-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2756-408-0x0000000000B00000-0x0000000000B60000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 458da8ba6816ae7e5695f531bc83e2f1
SHA1 b403a29170949bd55a44c7b50285081f718fa723
SHA256 5bdc6a87e3a2a0800f647839f8e6029758b2b7668d2c06526e2ebccc5765858d
SHA512 2048bcaa8418943a345c88c710c5521ef03485733ea129606d4dcc6db2f93a6e72279a94923297de6d36983515384a4dfd75ac6e8028c477e030d7be53117a52

memory/4336-413-0x0000000140000000-0x0000000140169000-memory.dmp

memory/804-414-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/804-422-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 7704ca1956c325272276a5a126274b06
SHA1 0c8944840294367ef5f0e90fc06744cfecaa2d28
SHA256 538eba80f0d106ab0e2658d65bc8f950e961883cde294a530fe605bf7ea0f33e
SHA512 c078adc157c1f7dfe001bff06b99bf7e4eebb8d3b35a9bded334c0dafed7ed6fc3102f9b080c29dcbf4ca8e2800ce986bebaeef47494154abbbd1a619cf4ed0c

memory/4388-426-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/1484-427-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1484-435-0x00000000007F0000-0x0000000000850000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 774d9cd237d3666ae4b9282d0c735e67
SHA1 16e8b6c5c53dd7e076642edbed68f693ec86975a
SHA256 f01a4844390742c117d4ed5a4534c4802faf9968d65ca5ebfe70ecaf0e3539ca
SHA512 8d5c7efc53b402ff6037f2a3175b5d0c9044474b92890bb7b7f2a1b96eb8d506111ca36abba9e2afbafe7b82bf413449203bd944c7cf169daefc7d92efd228f2

memory/4512-439-0x0000000140000000-0x0000000140182000-memory.dmp

memory/4820-441-0x0000000140000000-0x0000000140166000-memory.dmp

memory/4820-448-0x00000000004C0000-0x0000000000520000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 a6fe4d4be16de205b9486416eaa6cbda
SHA1 e26ac2c65ef7ad8d1147d09e824e418f18ac8652
SHA256 1d7860584003ad22777405be285ca334f98ceb64b01fabaf92de6f3d458961d7
SHA512 27777807fa99c37ced30c2c6426d2fcacbf7d76462242d0414a5fb182cff3f0a3ade9ca2d887045ed96841a4aab5faaf63c9d88d68d4ebfecaf858d1458484fa

memory/2520-453-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2520-461-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\odt\office2016setup.exe

MD5 ec503c0e4b262c56df0d8b6f9a3d2e29
SHA1 b185d53cff8bbfa8c76e35044d7e96b467e6ef20
SHA256 5ff77077b0e20ac67c693192e9927bb66253d7d5bc8d4b5418eec80514f9c7af
SHA512 64fa56db1315a4e784417795d8b0ac3dd231da951c119916fb79f99c2955fbe3409a9e26a04ec5c7108f77862efe47eea41ff74d86eea2c7960c4552a65df8e5

C:\Program Files\7-Zip\Uninstall.exe

MD5 e301d57bc1ee9b8aa19a6376922ca266
SHA1 c76022d6f90c88abd43f5aebcc44b4a78565aea6
SHA256 29e9c6e5fbaa8981054d2cb53ee4af4e70525390f7b4138879749e48a335247d
SHA512 c071b22d96a76639512897e7c65d0ceab77d101805c6c14c4d13ddc57e6d0fa9af6587f30f2c887740861d28e432cefa7fd3a4a5f0a94adaa115be959c94e35d

C:\Program Files\7-Zip\7zG.exe

MD5 b83f494918574e28f720755adc1f8e4c
SHA1 c8419ac73e5623e5b00d4d35bb35c6ee0bdb3a62
SHA256 2222c0b93aa2df0483f01de66de48cf08d20b450da67ea19f73d36b59f67d89d
SHA512 41b38d678ddfc2c223489f266a86cb33b564578fbd9dcb2bfedbdb6620d900b8aa128116b6034a51ea9ad75f10a88af713f78cb2176ee6b38cf87ec9ef526943

C:\Program Files\7-Zip\7zFM.exe

MD5 5de48bc8d1ed71d819bed45751f7d25d
SHA1 3e0c91d310fe56f61b759dca7ef85f432913b8bc
SHA256 1f225fddae587c54d00ddf3d2fa593ff5d4adc802b730f1f20bab71164eb3321
SHA512 057b0abb9f50bef5df8159d679ecec5ebecd16a06bb68fa038fc44e5f1929d2f0237d77a7000a58065d0a6f39afd08961c6a1d0f999e15d0f5bb5fae07a707c7

C:\Program Files\7-Zip\7z.exe

MD5 e7e36eb0b6012b58adef079080af7b12
SHA1 eca2d19126ddfbef1707a015e6f78c89f4ed527e
SHA256 e191af92c2087795747ba610e27ff731362838070feb7e7e49112b20326b7ea9
SHA512 00d650c56669405ca70c9b45d894110caf1417d0eb920304b081849886be511ac66aafbac7858ffcacab9d36d5b5ae20c1984d6d127c70e2a93fdcb9980a50b1

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 ebc0d007a07152fa3a7e3fe050e09a3c
SHA1 4b22fffa5a3667c8dc47a44934ed443f12069e8a
SHA256 c5d923ae8846a88e83508c984adffdbed0605a9235fde85225918899a796022d
SHA512 26bd5c0b6d27da30dbc1df99dfa3017acb9d6edb9dd1869eca1c985f33490fa206151b87a83639162507fc44b67c42fda6ec4e4371023ff0dd439c7bb38aa91e

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 71a9c19681eab6f05f17df8cfe41e8f0
SHA1 60fce1d07a58ea81f212bfa0658e2caf955dfa3f
SHA256 9723d35ec0a43c1c138bb19344f46d778e29b5ad65ec864ee33b138076f33dac
SHA512 907d0bd3904c988ee8f7f01b758a6dcbe343ea83ce98e0149b9d0279134c4159dbdebe8fe9239475c6529917370b8997054626e9748fe59114268f0085ae281d

C:\Program Files\dotnet\dotnet.exe

MD5 f3d2fff1a9e931466980129da7847613
SHA1 de743b95604b7a8cd9b452c0e8fa265ec2e1af90
SHA256 2a6c8e98b0c7e13fd0ce0f47417819e85fa14fd9e433ecf385c81db341b3cfa0
SHA512 7e6ebf6a2ae5003d11f6782bd1808acff74b1013d8f1b61397f00b4513731371bfa1794e187604cb7ba4f1ffd456ea6b86aaae47815657e8e3750823f42e10c4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 10c1275af9d96b82f2a51dfe36cb9b81
SHA1 aa90e6b544eca92dd45a544f1ddddb9c121b86e8
SHA256 f20f4f7ccd7d6d835788ee8ad556fe75fbfae46a474d8bfb47107568b970235e
SHA512 150325121a9b841eda2a970085e839a9cb6e0b7a2e57e1de5e9ba20f7df6bd426e9579282c7db16c3d13c9317307ade7d0a0f92488bfe84c2e19d776d059bfc4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 f39681079f854e954c6a1f8ab8657d2c
SHA1 c0c645e80c121ee6c774e1cdad85017140ce90f5
SHA256 ad792b9b324d74be441c4d0073ab4aa4cb33e2bad4f2ea0fcc35787c3eff65b7
SHA512 4a48aa72ce119022e7219c77cd88439fa793f4cb8584668e84721ca534e178dc17f5554da2d87ed2a325882c3dbede4d24a8e3aea81c889ba180686cab6a8b6e

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 81fc325fc0651fdabd6b76fff920c2e2
SHA1 68186f839292c96599b90ddedbb05c9378667f82
SHA256 b6826f8a503e1b4fd53780478c2157ccb17d561c1a2fad661710536eeeb4feab
SHA512 5fa1fa628ec8f60037886621120f8899a7db1f9d7e7c7c23d1a083adba3e9818e15ffc4457de6a6dc7b549bdff9b0aac812dce7ed2743953e78e334a9ebe701a

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 5b8fe2f3acce0245fcb054abceef7593
SHA1 4f2708acda1b0cc333ba4b5745cf4d3fcf85f6ad
SHA256 cd54da9868894afbb4fd6cdc567140b1e6538cf77229196e0d447ce5b952af2b
SHA512 19da47dd7468cbca1d50860327f7d5b23940f0452e94b7709dd3931b2367684a15aef4d89260a471eb4ada8a0c1dcfa055639147e7e3fc12f19105724a6acc0c

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 b6649379c3378006570ae9daefb6dc01
SHA1 20e07b5d843ffa8864a4cb6f8d018a4ea33cdfa0
SHA256 f77ff8a1ef87f660290bb7e2fa2cd127aee7085e5e29cb21dc66da9f76e7da99
SHA512 d031100eb336e10110fcfbd9effb88027c3c8de2f176b571d5c0410e04634e5c17c2c71b1b2a52c6651e0dff1c5ac0e7d0654351f626aa94c94f13f1d96de251

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 d217d2a808a5bc37e479458e1dfffe26
SHA1 2c6b906a9e3adfdac9ed76e90f256c83366f12eb
SHA256 8f92f653a5b801e71f1f8285f8364826810b03929399fb815f29d9e758698437
SHA512 1c1c8bc3f1c8734a96afe5835673ad881fadd2f3340f556d89e7f46ba14bb9b44878978f7b0baa414f3fb247c4537127cf2d00a900fce48cb6cb20caa709ee5b

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ca7d729ab8152f44faa8782103cf08fc
SHA1 fd58c8b5d1a169dae0d75e8cf67b3bcfc4447ff6
SHA256 29c404a8f317efb4a4f1094c2184089a9aef7f68971c8d6e853450c7051b68a3
SHA512 2731657bf918d06766d120db2f6209d82f95ff4913160cf18cc0301c8dda80f75498fd8f9598d9d4745dafc6674aeaee112df2d575b579803d6f6f87f0e985d6

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 6785486e564444d6c15d4067ab6ecd9c
SHA1 ee89d986bbdc411266f8adcb2cd5fd5cafc510a6
SHA256 c51070b67544dda1d11601e6b69d9f388800fe08daaf885ef1369cc0f47f9ece
SHA512 f691e004b08e02f3bc71ec9789697be1c5ec7697df3ef2383c75e576e236721659858c2dffa4e32a062ec24ec63a353764017942a25932d03e20112fa023dece

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 17201fa55e4f54a56c6503da41365701
SHA1 3faf0ec52ec51206d4e019e68578c7261b770575
SHA256 e1812ac75a3098d4a5d25980a582d22ff43ee846381ccb319f827985cf2c438f
SHA512 3f05726e80a3e4fb91fa1f179bb3e5827c3079c4c524cde1a6bff9145911de670cce0b63ca65f22bf5e5c1426e42d9c8df35796801c6e42c212f9ade422c4168

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 dcc40ef604b4765ffda93ca8146031cc
SHA1 6a606d4a954de666d4b783777db1288888c9fd2e
SHA256 f37bc450cea1f9c895821b4b23e98f23f5404f3ace761375d9e6e5aa46dfc23b
SHA512 71fcccbcf85d5bc9d674e41a5e686122951c89448815f53a413e7602c9500389b7e81c21e3ed9f5880c7b936c57da97abafb80cde1ac21d1dfc68dc9723cca9f

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 d5ed6c796250662d5ef22189205052dd
SHA1 fc3861dd0d5e5573a65d32f51e25ed7fde50f60e
SHA256 67841f35677396c73610a603ddee4aa5e528b0b01f35d6238817e480eea42b96
SHA512 5bb8ddd3af2be33489e970faa3cac71aa3547a0afb160a313844e672edbb62ae94b56dfbefb180ff12969dc14252066c2624ec82e6f252aeff8d93b02d2cad3f

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 bd735fb8fbac65f12b2d2cc05344ea1a
SHA1 4df11961d8b5b6ee60ab929e225c39b647eddc0c
SHA256 76179d627778dd4b684140db7166296a6ceac3ab4a0e7ccde33c87d4b73591da
SHA512 6f732adaabc806f69c19b35664a782bc317d35f45cc279570e158c4c1631d640a563a59973def6d476920c8c14dd3d009534dbd4f70fb18a0e8d030b2a84cff1

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 2ef2204596fccf4435ddb27ac9856c02
SHA1 c3a01e8a58e7e36287100d981e2670ea02e5f8b4
SHA256 ae634f8afb334a060580184952a362f8e8c4e6579ae253ef2a5db3e28e33dfe9
SHA512 aeab1802b04a90cf5f90e0a6b05f7703821bfa05dcf092e8c5f968db163d727c703aab21ba3b8b9c043329256882ade8889fe7deebc75ad183c2e9f7f1e5b6ac

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 81abb3fd7637bc4afcc8e7f8b187fa86
SHA1 b0d22e985137f73ca2e4332f0f2475e7907d3207
SHA256 1a14c14373521ff82f7c2d486754fd00a4aa836f18a619855ec72f197ad7be80
SHA512 8c9778e4b251f0350e39818a28e9a10b56528f2e291ec9ac2373e376443010145619c070bb7dc0c7fa0b2c2b3b1ea33cd8f419073e9ad46c2007cbb8de4f1e3c

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 17dddd025165c1053af3b5570704d9f0
SHA1 03a4144c29a23064d6cba2730734f9219374b423
SHA256 922643413fb4cfe0917eeee95bb8ea7d6ef54b42203a99c17b744d59d4285a34
SHA512 90c486993b9a199c2cfca6caa894c7ad31197254785903d3244c88b2df6f8f66ef9086ce264d88c77a37ea082405d388b856bc2463f62a4c80ad2b9e1cd1afc9

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 98f30e2c790902c714a63ecbd41c021c
SHA1 ba9b59f8a4be92295ffbb788cf2c5a8af0adc9d0
SHA256 239bbf92fb8d208e7ddf1a3e14d951971abf3f3f6d97ef5f01bd253b55f292ad
SHA512 b4aa2c87d5c2d3c9b4c0cf4d12a429827fb267e35a53d56e2a9ea80379d5eabc57a0b5cf2da397f8cb41f4b67d84eada33f2151a5460ed64cb0fff540dd6281d

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 7547226a9936f12e8a8b2800f788b044
SHA1 f502a706388ab872a8bb97b36f439654afe336b7
SHA256 c28117654b4acbcd4324f59c13bcd80e3731fce1199a88e3b0bf7a081b8ca9cd
SHA512 4370b55df0b5ea47fd9c1fc88f1b35c32865f32d480d0ffb0762969a8b3e4d63ff061418241079425313cb62269fe4dbc124bac38721021b8c5ce5cd3fa51cdc

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 40889ffe0409a7489c2c40623aee8e4a
SHA1 995970a01465cda5b8333dbdf6606748a117e0ed
SHA256 7bb1fc1c7c6c42dd0dcbc2c43b4b6b521d2bdf4261e06268fc1116cc82907e1e
SHA512 726bdfaa0bfe75e2526f06dabfed8e8ca72d14371965cd289d05ea053b6c12382625b451b8ebd7dc0719520f0f4aa5a216168570faff94652cb77d65f9488c0a

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 5cc3f65879bc48d2b11be9261a0c5384
SHA1 77c70d3fce50f9354d88867ffb6c8f8454271815
SHA256 7c947eaf0ee60b8cbf08ba14405bd4859f2bb83abf5c260af0fca472b02d3dbb
SHA512 27a8903e787901587c05a4ebae37818c8318f9a8a473c7b9667fda3cb7966979382e81918bb9a36936177413de42a473a07402839f3a5cdb6a207459208f56b5

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 2b4d8e06fabfe1b1731b5a088a7df351
SHA1 68e3ec762363cc630a303efb0140f3f0657450ab
SHA256 a5a83468a44eac36704aee09fc36cbdcfe8e4d0a56f4f38cd900d0f85ed31dda
SHA512 5bd62e3eba5e2ee8df835d468ecd13d4bfce40599e16dc7b15c0c712c631f19a23a831a72b4ec939cc85d0ce63497d621be74807eb76408ae57a1f23c16e7c84

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 288786ab3115afc4e75b97acb1551ba2
SHA1 a54a6d9e1a839b4a71dd4bc618c48578418ba41e
SHA256 56e9606b3e8d2dd8acfa0ca5a2333d995648fd89abd0bf871b9f683f652a8fba
SHA512 9af0c182061dd97d646de8d405304720021ade98d75a3953cdd8fbd91c614199ebbb96a5dec95508f43c85406f33f63101b52fa4d32bd614934cb0435e1add6a

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 c8bd74cb3b620d3d9311113a8b7f5b0b
SHA1 8c45e79e68be06d3ed479dea9d52b021d988f3b0
SHA256 047675cc6b29165417c18d65b991740f4c79d31f1fd9933f08dfc8c9a8f44b2a
SHA512 9a39108c2e49666bd6372b4a01f9e025429b1785c124e2cce24a187628a4a1334189081348fc956da420011cbe11f652cba673a8bd074ea8476370f13cfa9abd

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 06aa82434e307bf7ef563f89ead7d20e
SHA1 48ef1c01ec12a3ded0d9cbf96d0c6f830a3320b3
SHA256 38dcaa68b479d1790286c1e47effe65cfdbf4d975593490cf247ed0c39886f1c
SHA512 7e20bfddeecc4aeec3adb48323c1ca90d040151c179a20e2d0375e297f38242fc1101cb5278fe84c6b1879f8b29aa50c9ae4cb5ded3716b072249480c2d019db

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 79989a2eb4225bf2d9cf37e79e8f9808
SHA1 9eaecc442718700dae6f7a4cc962f7444d5b0644
SHA256 00619b0768c949774dd872b30c698ba1c8464c095a08c901688aa26b86ab6d9d
SHA512 002edef2e8b502326da804ee354db980ba9789316261fb0827d377830b5561badbfe5430d5f63a88542e6a8c46fbb69dcd6396aab0125b352a5f3e9ceb2ff0e6

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 88d5785670ea9d6051d26f95ce91d4f5
SHA1 c4b923d6a5cfe4c869a7c10fa7f924579d73c1f5
SHA256 636c003b97d077310cd70085d65df2c1c3dd46fc37f63f7316f1f3715c7324db
SHA512 2b88abbdf69a511c7c1f0279cdb8d18cc800ae253ae031bf0a77dec691e09d14c192e015ede6eb5a66ee373667bf37e3d7a4368e4ce06a66deb2a7c04a1f858c

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 7c861ac29f660b70dc0921186c68d91c
SHA1 7eb3ef674129370dcfcfd2abe1b31887e16f86f7
SHA256 d756a5a0a92bc692d65890478499c691355b0e0a005dbf9f2cbe0b5988c6bf4f
SHA512 cae074bd80de725475030159ec14b2e6d964c6a4f22b9ca72d2c64e1fe88cb9c389c3d8896a815bc2bbde3183770caca8ee6f028bae34d4a60a76ac4888a5912

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 843fb3e162960360c951000433aa18ad
SHA1 f59e106918ce6f9c86de6d3b4c75072c893fea54
SHA256 32327667fd4e3dc07d17d219f79fbbb6b7f3e12f18a6d637998f617a9a6eded2
SHA512 c704a8a6589429992107420c13b3432ea868d7e317868bf3efed71037d87e0cc5529f30917b61380cbc5914b61f59e59a2808e12ab616211474451ba227c111e

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 001df34ca09e5d97ec0985da497cf534
SHA1 dcd6676d582c2c2099e35a01342fa30e90ffbae3
SHA256 c4f9fef7d288afaadd94077cc5330f5ea8fe4b45e68fbbe0d752ada961e6eb58
SHA512 7b9a5423646c828cc7ef3e1b6d6718ce4fc363cc62d830198fb6bfe17e7eb9c14670451adc08df728cb5f98f9ac72729933a6b34e0b17e2587d65807f6b71a33

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 11366ae6ffeddf6ec3a1db62be84587e
SHA1 92f9b1d8bea72261f7659b75a380a4d46b539f6b
SHA256 0f2e831184d739217ab952cbe402e41619caa08b1fb34e5f6ca6935fe2a72ccd
SHA512 8d5c5110f71d39cd83beb6c0f09e933ce3717efc102de147d49d401b68e3a79e831b85bed078088214e201c948161a8aa35725e5e02dd753d54a5624d5d29f3b

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 c5df3836e708080f1208499dc1de96a1
SHA1 7e3c1838c7d4e4d8739d8ab0070d57b4afc57f4d
SHA256 fa4c3e764f9e036f85a98ca84192b0096f3aea4c2fdaeff4b43798b35bbfb0c2
SHA512 5af23e4a5d32e383c49131e05e7b8977aac7f05a16824593b669c51e9349d82db012af1bd76d62385c0e458e334a99912bf1e17d002e10691077329fe2a22fb6

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 88f510f96bf1e8a6998c75c3dbd3b8c1
SHA1 b3066b331fcb92f3d07062a3e9e1bb7ba7b62351
SHA256 1501751ccd2be77a9eba62bd3c2823a9c959f7e50995fe8693c553590bf8f76c
SHA512 447c626ee028949c92728e34e79e4ba19b40a279ad564375f1da4b722728a84c25f59feacf15a1bf0b9872bd72025d011e5397eee04241cf6dfd7fd451098c53

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 eb746d605aa80852190eaf9e79351dea
SHA1 3f00baf53cae716a7e9e59a69105e75ff37f587e
SHA256 002648f416ddcb25087face1b590bd2f360050d55857316223a4ca269ec13732
SHA512 b136d9422f58d4458707184aec05ff10b28d414b732d1cbce0adcebdec8439d672258d418038d03c078bcae5e4cd9ca123c9eb707da4db4a4c27d6f0ab2d16f2

memory/2880-539-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2880-540-0x00000000005E0000-0x0000000000640000-memory.dmp

memory/2756-543-0x0000000140000000-0x0000000140147000-memory.dmp