Malware Analysis Report

2024-11-13 13:58

Sample ID 240407-ysbstsda9y
Target 2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk
SHA256 52bd52ae39724516b54696430c8d0e57f7f8a00c33d4a8e95884edc1bbdb4224
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

52bd52ae39724516b54696430c8d0e57f7f8a00c33d4a8e95884edc1bbdb4224

Threat Level: Shows suspicious behavior

The file 2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 20:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 20:02

Reported

2024-04-07 20:05

Platform

win7-20231129-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe"

Network

N/A

Files

memory/1680-0-0x0000000140000000-0x00000001401E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 20:02

Reported

2024-04-07 20:05

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\27bb9c8f822cf6b9.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d43585ba2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c6578bb2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c8674ba2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8d482ba2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae9887ba2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae9887ba2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c682b2ba2689da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_755815c44f0b37a1ed240e0abae245b1_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 udp
US 34.168.225.46:80 tcp

Files

memory/3756-0-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/3756-1-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/3756-8-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/3756-7-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/3756-11-0x00000000020B0000-0x0000000002110000-memory.dmp

C:\Windows\System32\alg.exe

MD5 567c57738f14e1fc0196ae76b94724f3
SHA1 f48bde71796f84d6e723d1563f931eaba05a6cbb
SHA256 1fa6fe256fff83c938aa1007764d49cd5788296db1073e88478fb402effadcc1
SHA512 50a6216e425cd64979864a11a935ebe549990461cb3be7fcefa3b170f12c6d2802faefad3bfb8f8ad613153bfe185b51f733c518f5355cf1da5aae2dd8677471

memory/456-14-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3756-16-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/456-15-0x0000000000630000-0x0000000000690000-memory.dmp

memory/456-22-0x0000000000630000-0x0000000000690000-memory.dmp

memory/456-23-0x0000000000630000-0x0000000000690000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 a1d0ee1ffe1450135cad9e08e76cd7d5
SHA1 29ecb199ff3be3b151115bad1df5848ff91b8a9f
SHA256 c5c97963d2f1b7e4fde65ec3cdfcd0b3285858eda7c22618677086b156a0a22c
SHA512 434d62d46255e18294a52e8353c33f0079da0311981bb279952fd65ff2d234caf9161904b0831c09928cdae8eb001ede10a716c9c65a8d1c972f617860ae5889

memory/5028-29-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5028-28-0x0000000000510000-0x0000000000570000-memory.dmp

memory/5028-35-0x0000000000510000-0x0000000000570000-memory.dmp

memory/5028-36-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 7e74e4101b3314098aa99f640eebdf83
SHA1 3b81476464df85613357c64da5679fe2e4cf545c
SHA256 a74e5f2d0ac63d4cff3355377b1dfac39c73f3f3bbce39c035fc832e73c4e0ce
SHA512 59d4437afd028c445f08433f5c5df688377851a2722dd760d2e89e6e78609be7acb58f2f1750d65a2089d236b8fc7d4bd6f62f724cd1f936b91adfb7ed489f53

memory/1480-41-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1480-40-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1480-47-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 308d8a99071a1f5356e8b2df22570e9a
SHA1 08548d56319595e91d3b2914d21a20185cd61031
SHA256 1bd5ed73a2ade1fa422001d6dec4b9f5598941ce7e278416ae2865c0c62164fe
SHA512 6e08ae7db7e294dc579c30514ff48342b42097a2918d2a5bf90ca2370964afe943285b1ff76ea7493d262ab1f46a65388c7b63ebbb418ef26663155c0bc277dc

memory/4032-52-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/4032-51-0x0000000002260000-0x00000000022C0000-memory.dmp

memory/4032-58-0x0000000002260000-0x00000000022C0000-memory.dmp

memory/4032-61-0x0000000002260000-0x00000000022C0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 0138af80c8c352f2164e488296542e07
SHA1 c36c84ca185939b05d2a4c4fed44f1b238390949
SHA256 e7488ce7a76c838890529f36200c1c7622e92c6ff7cbb6469a026678d4593c06
SHA512 c64545f739cd9e39c3caa01edc1a748524bafca9c713e943ce98623cb67cee8bd1d94a3de2816682df5372d65d869cc48090e0c1efa9cffa1df905eede01082b

memory/1772-66-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/4032-65-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1772-67-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1772-74-0x00000000007F0000-0x0000000000850000-memory.dmp

memory/456-229-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/5028-236-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1480-237-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1772-240-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 03e77a8873f616bcef98917bc5cf80ed
SHA1 b17473c3aafb1f5b9d9f32de7fa2df5c59890e1c
SHA256 70ac6a01e3cdc1c6f59f09605d03e85bc63569e0afcff841db86679565770ea3
SHA512 3f10110076a95937861eddde916be576bcd27d1cecbfa78a520dd4515863f6d15d69cfdcd4867c7982ed9459234ae836a1189ff16fdbcdbd307b364067483795

memory/2616-246-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/2616-245-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/2616-252-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 7368861f08a97cb2d17e3dea29128ae1
SHA1 c7c466cd5526bb8682684b1d04bddb061f29675d
SHA256 66e01ee2f6d7bfb0b2dcb726afc07c90349d2656a34c8735634ac72ee28b7669
SHA512 66dedcf91e663ef15fb34663d2437837415bc53d34180ae6879528651539a7139ef1a9c099cb58c3092da40c2775c6c97619d864f2fbfa23d277d41a52cd1398

memory/1580-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1580-257-0x0000000000800000-0x0000000000860000-memory.dmp

memory/1580-265-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 b2015a0593543d13088e50fc795f1156
SHA1 5318c636e0e35f47226706e325db5b9b32d5899e
SHA256 eed8a73552201019075fa4555c82f96f15bc99d64b51586a982adbc9675441dd
SHA512 4bdd749c83ae0f43e632bd0824445d1dd5ab69d5156cf5d69dd0a29f9859685dd9b764ee483f099a6fa2833b3669b6b7073b85ebd366773b8a3d111db7b37dbc

memory/1940-269-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/1580-274-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1580-276-0x0000000000800000-0x0000000000860000-memory.dmp

memory/1940-281-0x0000000000590000-0x00000000005F0000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 b1ce86a952f2e512387f2c87484db51f
SHA1 806a9ef73f0a5c94ede151e68806effdb5984e57
SHA256 f1e1a6b46c421e6aa6755e400233420a4524a3b676999d3f1968980f066f4cba
SHA512 e49e267ae44da2924472d0aa14a9e9bcc0d0440c95aafc1209c702b44799195c91145f510d1889cd69dbc51359915f6e3390948c605e43a71af8f7be676561bc

memory/2204-290-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/2204-298-0x0000000000BE0000-0x0000000000C40000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 5ac22da8f7d5440fa3e4ee7d4290992c
SHA1 f27ec47c3d781433cecf26a2e74a354c9ffeb92d
SHA256 0f7da36319698e46c09114b393b7a0db90dcac79faba4aac1fb0f2baaff4fd2b
SHA512 036d8c7432f20d6ec6f906bda62040d0bbce389ec9ca8639bad67ee158c30574193d584b7882477e9cc3bdf22e990e7f415f578c14688ccc3181d458f0854457

memory/4004-301-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 11d1163b0bc28ec52c73bb1a69ea14fb
SHA1 6902646e8653dbda059b93608dbeb971616c1697
SHA256 b6a7c017ca6b7597bc1092ce5b52caba77e9110e1fad576b73b85e708ea71616
SHA512 4e2e689ac7895195cced147dd9025e950bc91954d4af22c1695c1d436f578c06e05e6bb061c867f17217dfe91fbd5bf6c19d1311bf107f09793c09b068d1c48f

memory/1672-304-0x0000000140000000-0x0000000140095000-memory.dmp

memory/2616-312-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1672-314-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 eb19c670896d57b3f725988bd6410910
SHA1 44622a7a4666c591901c0b32faa42ca499fc2fc4
SHA256 d6d5a3368a15ac0fc6a5df81e744f221669c6f1393c64c5f6fc115edd11f1471
SHA512 d3d65207cd44ef106d0d101ff216cc51bc51343e0dbae02ea6ee6a8a91db9f9f33ed217d2d5b448fd3265b03f3cc618d25811022d9e19a725a70db9ef5c93987

memory/4772-317-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4772-326-0x00000000004E0000-0x0000000000540000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 a9eaa64416ff32aa02aeef546513d223
SHA1 f585191565a5872242aba4c9165ff34685711104
SHA256 c258309ebe0d12c2241ba5f36289f08a8be343429a139cd0ac4cb61418dbd338
SHA512 a9510e1780db76db8771bdc0e253d5b45d80cac287903890db5693839262a78ddeffb36a42047dbe3ee3053846fe006fd0dbb7d8c6a96577fba40d4c77ca2edc

memory/4604-330-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1940-338-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4604-340-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 d8f38bd903e55ef6c10ac6702f50d9b4
SHA1 aab4d387c4939f5515c0e4287930b2b408f58b87
SHA256 ebf82f2bd462779dae7d9780f72b3297af4a767b1bca40f925a8da5cc59051ba
SHA512 ad62ac97a62ebef2fb87524a097025b2020a64649f7f3e8fb08951747088436d960bec67798a6ab2144294c0798132bfb717de022b65ff347596a9c6ea0ac801

memory/1940-343-0x0000000000590000-0x00000000005F0000-memory.dmp

memory/4700-344-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2204-352-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4700-353-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 bcd3873ae285acfd3f25439e8f9e2e50
SHA1 bc8cc24fca862aa4449541b8412c9a8f34c4107d
SHA256 21d23661a6c6f7f0807c4ee7ef7745c8a9afb8c0630ad135ca2c49b8d0937c56
SHA512 d75c34ee1b0765f9e1881f495f3bbee1e0c168c1dbc6fb665bcd82668de015a1826c2b9bd3a6e725553ddc4f64c0b7e5d5f701ef8bb51ff0d536a34f859379bf

memory/4780-358-0x0000000140000000-0x0000000140102000-memory.dmp

memory/4780-368-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/4004-366-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 67c6e89d4a536e53097e3812bb387219
SHA1 27bc6c1a3f74e578bc97af4a07eeb2be22f8368e
SHA256 19538dc023768221eaae310c85cd12548306e818c85df1e1b8b8940947ae5c6d
SHA512 f60c542e5017deec7f888a597c81588f1ab4c9f02a4debe4fa5bafef0015799b1b9204aa745b3d612ff2cd5ba63f9977a7beeed68c8e29ee32aded6683dc805d

memory/1672-371-0x0000000140000000-0x0000000140095000-memory.dmp

memory/1340-372-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/1340-380-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 9f28774e44a4c64ae096e63ade275773
SHA1 a4f6b948d2d312dd8db3c1d5abf6ce62bd4bb8da
SHA256 259cfa3af8bd9ea862f7dd7fbd8de55f4b388dd8b71ea37f0ffe77b05d7f6c2b
SHA512 49e2c54eb94105d7768ddfa3928fe5b7654b16d43d277712e65de9893f781269aa0f186145b5032b519ef4a6d62d41e79ea01c566b556e25e065b730ce4f9368

memory/4772-384-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3124-386-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3124-394-0x0000000000B30000-0x0000000000B90000-memory.dmp

memory/3124-398-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3124-399-0x0000000000B30000-0x0000000000B90000-memory.dmp

C:\Windows\System32\vds.exe

MD5 4f91d8e0f5beb46557f20b7a3082eec1
SHA1 d8b22b031bd0fd9ac06f0f1adacb3fabdf6bdbec
SHA256 f0e6fe7825392cca3e08bec8c55f1ee11f0c8817d9adfc198462a63060f16963
SHA512 29cd8782e1ef48f4afb5ac8fdaad675f2a8c4f60d0d46209dca535df7d3adb7e75e3cd92a1f739fe2364bcc3320658f0c8ea536e721e80650c57c16c63cb617a

memory/4604-401-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2004-404-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2004-409-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 9d86d5aafcac1b23082f33c8b6a644f3
SHA1 274d165ca2905841b95b72aaecce1d7853751863
SHA256 51f8866854470dda0ea178e8efbee84ebfe07f85c065818d8b0369a310e2a360
SHA512 139b9327478c020f4b8287f09057222b08f6c0606bfb1c2e09bfbc74aa17650d74c4bb5520a2dfaceb22046887a47a34415ce263659411331903af1174d2678a

memory/4700-414-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4988-415-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4988-424-0x0000000000790000-0x00000000007F0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 edc940a3a5375f642e5465173622021e
SHA1 b2f6f011a4bf9c149e3678e6572b449d7834f604
SHA256 8d5bd90a4c9af433e196cf3e8bb1c33d923989804314fa775c16031ce7b15d13
SHA512 d4443f5c69e1d851ad37c126dc8fc1d70a52c9da0008aad7a8fa65cd41e282de701e0d5da9a3269250d50a1f7f4b4fdb1091d49c1b018c05b1819846dd86b54e

memory/4780-427-0x0000000140000000-0x0000000140102000-memory.dmp

memory/3352-428-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3352-436-0x0000000000BE0000-0x0000000000C40000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 eedff9c8b07bc5f958920f773089c1c5
SHA1 b694961f52c88dc25e3ee86538420dfbe26a5357
SHA256 080686009c26fa67d1bc6c84061ba6e43211672653899ded8532ae75a346bb66
SHA512 38d2b70cdcfe681bab34245b678bd7f0a1666e42287b5a7449a59b4b15e866f8107f36f64cff6157f70d400efb954cd1603ce29e6bfeadb4ef8358af8512acb1

memory/1340-440-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4944-441-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/4944-449-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 ee258181211b8beb6fd8b86b18cb3da2
SHA1 d5a0018c3fbbe1f02a6e559478d58dcef3fd0aad
SHA256 245220fad136cb24ecfd30989674b7a7464e8ad1405f083d9d8996d66d58b031
SHA512 99648d9be0ff7a1a5d57ae5b6b226699d4c5ea7d821464d86d462c4f5d4fffcc5396f4801b4ef8936539b47dc50d29763b44cda98a3b5212fdbbf4bb853edcde

memory/1612-454-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1612-462-0x0000000000710000-0x0000000000770000-memory.dmp

C:\odt\office2016setup.exe

MD5 954e38f6ae1ebcc9ea612b500f1d5686
SHA1 c8fad84fb2fe947df2dd8f38f2d9e6a1260b7e8a
SHA256 2ac1edd02b4dc475f45bf4da257db395e4e9bf496164ba901d44ecea03da351f
SHA512 a2d2afaabeadef67a505af8e46e835ea49005b75882d6822ebab12f8e20ccced0d705ec215638f409867db216af76d0447bf49a3508656bec34e2bdaa91a3250

C:\Program Files\7-Zip\7zG.exe

MD5 077bb23b61189b136b1e6b12f48c9dea
SHA1 ca2446341433f629f41ec9a5e6194d0e471393e8
SHA256 29c8c0aa51d52d7ad026d0ce7bc164b988f1af339c272026c2717e8ad8dfec6b
SHA512 e236e62bacd209d9b96f840a801d9ebad4509391dd40647cac221536169e0ad682a43cc8b16f1949a14255c7ff074cf03d096ec84c1038e79f552ec2c6f261ca

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 dd39f8c81ac7d162496163713dfdd98e
SHA1 c8ed3932cdf386a369c9924e3dbe58dec02b4155
SHA256 256df863cd7967a7c741ceb1f614dad34ef2bedfe7cd7af7cb755a01569bd6f3
SHA512 2db76d1f24648101d721903e1459db54b0d9261f6859bbb6d7e2516c62ea27929467f9cc6eb0a2b100eeefc7f21abe32814c27bca92e0f4359bb2f6bdb71fe7b

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 a3cfaebe09e8b92a9058f620b5d0ea99
SHA1 b61b34751cada08bf13db25a473da3c598428af6
SHA256 0db725d01736f596820d30de3548cbd8564403dfae2297b64d94299f5725f94b
SHA512 76853f20a02c092c33a9e2f5257b898f154df486d9a2a88d08f0fef7d0e2ea52cb7c89b1d8e5ec1890b0e8082e1bc37d2530acdb167974769fcd34d861126104

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 08ea729f6ec6c2707b2ee920e2fc05df
SHA1 4f1568aeebd7f04f4cb60d24a5a6454ba4a7779d
SHA256 d63e756689d5b2fbfd90c71831d7da3891a19895475f1800d60623145210886e
SHA512 8a1519fbab715cdb39533c06b3648d8768d2e85b7105a736473197a95da6efc4c2da79fb6786f4e8ccd43b207bb3de03b34072755e7e1a67cd97ba509ac3861f

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 6d34b2836116ab1ebd7f5db9920cba47
SHA1 764d23c6cbdc6e8891817a19084ed27b3822dc79
SHA256 572d1ffe84428d3f6c92f996c45f4989e5af2f621e8ade7cd67318c02c6bbdb2
SHA512 9d5c4bfb380b34d24c40b199af2be24d4119cd2bb601e6d4d25c54fd99d273cfe1608cfb2ff8034e23fdc7b9528569cd216f24a90fddf6ff249df66333b4ff8f

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 4b2ec41b35c1b9744cde2214dd17262d
SHA1 b6e836ee983d9ca16c4de914595d028019367264
SHA256 558861c45453c42faf4d47d8001d573338e6d66872134b0c09c495643c4a814c
SHA512 68ee15a25d5edcb74c13500e0ed9c1b8403a8c55c59070c424d34a18a9d0ad50217e98996daf225d545aaa9028d239c1da943287ee8db1c274123a1f8c664fed

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 4171bf43114f9b51288498b2f7b4a314
SHA1 225ee613c2cef982fc1ecbd4d1bf9b15774c6684
SHA256 968f4b5869f61c9016e1c577fe27894bbcf3504539f6f0e170cedb1ee2e4d541
SHA512 3b7cfdd6680fe8d3923c09f0b0e797014779f477fb696827bad196572f3131e915a8697dfcc0382973696326db66aa06dbcc40ea0d82d09e92bdbe8d15a428d6

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 4f2b3f27722cc688a9affb5752b2dd8a
SHA1 7fea739a09559c65f771c70cd0b91ef4a9cfaba3
SHA256 d1d63e3e66a88105e6a7d62dec9e93aaff54f575717b6396a1d83fe916f7ea6e
SHA512 07cfa12d344be9085198aab9319d27028d35e7799eaff8fc55eaa5bd034d3fb812c640027cb6034d2f0212f88dde97a83fbc28d4bf1aa7cf55108a763ff5f240

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 dacae08a613dcca05da368fb2882e3b3
SHA1 e7ef358ff4c459b0a2154851d4260223bcf95fe5
SHA256 7775f3981eb68ef9a14306fccb6dafcb22129038dfc8b89ec0be1e4ec74ca805
SHA512 d0809ca8b1dd2d86efe6d613165faa1946ee05fd808517c22e04e66e1802be006b131482f2e41ceb4f5adf76b9446e13afd02f0e26f6eaf336512264d5d9b02c

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 7d710a5304f7d26bb66005f5f9f0d570
SHA1 6a241f3f8745ed1d94cf8217291819962ed37b10
SHA256 860f598ddceaa21e5a62dbdb7ba745f06ea44ca3417d72a3324739a64e76e223
SHA512 cc54c87406f3c1bb21ebe1c45a2d778248973e1fa204d49a4f5daaa53e638c74cafcb3d5054459d8905f5b089419c51eb58eb51f8abb435c1bc4999b76fdcba7

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 8dd5320ea57ae081e55dcffc9b622761
SHA1 cccb65baa44b44259e0fc1fa47b5d0f05f1fbd3b
SHA256 05ccbddea0e51e30f2865ada8d33232bba79108c081d9b5d710950220adb116a
SHA512 08aedecb46333083bfd4aa88795c28e0ec2747ed6c52705f95d64fafac89f0bba0b95b1ce6551e42301c5a660bc88ac1bd5f63b89cb3ebc366d7213ea88d18c2

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 f40985c55e85ddb25c1733faf4e5ff84
SHA1 05964cb9198964513c5917df8690fb251f2915ee
SHA256 3ccf688cd6235c226755e9debf942de97bd26535c8a71d53f4f3f1eb261c2d22
SHA512 49681a9b0ac0dbb254bf312854395d7bc78cdb712c28b6e90ace6d92aef5ccf8c3c527ec3ce5b65d9c9c6b3b49aa48d0e61aa3c0fdc4c6d5a08edc399b0cbe7a

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 e4a310df2679772e79ce74f5b6480433
SHA1 ba401ac3f7fdc0146eced9215a87bba43cb7d15a
SHA256 bc1d95a89cd4992142a5a35fade2bf4048fa5c7383561380e3553a25f5f74e61
SHA512 4f0bde64925d82fbe53e6add772ecde1df7350b143cae255329dfe734135a91173e1574941f26cd39a42aa27c33efbb9e8c4302f657cf92b6e841991f7f96eec

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 5ea10ddb5d8f65e00683bf206ac2e354
SHA1 9cef688f16921d9ebae2b49ff92d0fe633e32e45
SHA256 fbb451b82494a9c8212c053caf041f1b28371f94941254dfe44a479cce1419c3
SHA512 d310092f55189f04c7f0a676fccd58a3cb89f0a4453bae09a6af400fdb464fcc982bf678a8b256d10919d630d6d098e05eebbef406442f6548a584cbf4e99418

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 28f631050ff74ab5203a09841ff8b24c
SHA1 cc3197408ffa8093e08ee55530d6f761ca857e0f
SHA256 b080175843cdd9cab57da2c126a739388dc9781be1de5b0ae0dfc2c8ff60b168
SHA512 7066254d5736330958c0e19ad118de991449054dc29b2e008b540fbb968aabc3e410fcd7f245aa3ee0b2a2feb1616c590806038b35e09b75c95f868706593105

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 0b8391ba8eda65e993e1039a132153aa
SHA1 3081bb3c7490ba76799b662b624072855233ff92
SHA256 0b8b3dc92c48846edd516c7c09c1f9e197ba8454026b13b77095fb5ce301f61a
SHA512 8a38da12c4cc851e89c8cbc200ad6af88416d2c8641ddcbdc8075e9844f02417e8fb5184d7f5f6828da945e0ecaabb6caa8e7f7c67589041c390c1010e82f89e

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 78445dd0e17c910ad8276ac8fedbd3e6
SHA1 1691a91042104d2fea4f09043a4c22793a2b11cf
SHA256 0c0103c4ae8fb39fb210fd253560caa70a924cdbeaff51ddd7c41e6d24107f13
SHA512 1e2f322e7f7b687de9b1a766d9c1edde1095e007240f51d591ec2ccaadd7b16be33b632d7162ab9763deba84cdd065749ea0a35ae24b28167fae4ee866370bf0

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 b4ada634f042da89234cdd047e448b9b
SHA1 dd66001f668b5c9c5339c84881ca8b72c0fe8461
SHA256 d5324437dbee1c2722d6af9d8d0b528622dddddb50e09dd657a482e38d5af262
SHA512 e21c8c40a4aa0834bcc4cd7fc2c05be4fabba0620a6f1455607b5047a74235ce8bbd6eda6b5e58ba03c866bea936d8d6b07e77834451d3a4d99f07939d4b9679

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 7eb0cfcf3d63ec8f5a979e5591f23f7e
SHA1 ed19cc3f81e9118aab0d7111506ebb3703f9ff9c
SHA256 3b375bb2bacaae8ec944b09702ad727e8ae7cf38960df53f11be92f3840845ef
SHA512 0af01939182899b794e25d456978d4557b47270cc3845d3501e991a9ebfd5788f7036b5bba029d3d6a10558e61c24ad8be7e604f1d0b66d931e0240b1b06018a

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 8abe61c22b1aa3b9969977d1f9612ce0
SHA1 48164306e180bd427a80d21d833091093ba72bd3
SHA256 b548857d904a8a31c073dc09d62f1d7ad4bd6997c660b4807e55838f3c5e6227
SHA512 06f085b6c462e711dd6d6d6f058eeba609fed60b5df05ef00f18818d65402f6361542b317775bf84d3951ae6af03a866a860d08a652e7875a05177b14204818f

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 09d52e297d3952b1ddcf98dd765e2491
SHA1 0e81923001591f0d08015d11e0367897f2733bf7
SHA256 878395752c8a8a6e7fe33d9373143e1fc1a99d46eddaaabd7ea3ce7c3b52c057
SHA512 36c9e38694e41cb6147f090a88bdceed635b091882dc9df26351dbfbd4dfed0fdd2a6cf3679d4771975020256e723d31d0e167080d99a09fa4d5d7a5c629e0e2

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 a49e6dfe17443096ba65d87850e6bf17
SHA1 4d94d8994dce77e24eb1eddcece8bf579ce1af69
SHA256 1338cc7d21a8114fd3b9f3a30ce28e9c0063f9d5ff106018c1ef9677f1a450fd
SHA512 d8c25c901580b4811e7d8ad6b7171fc4406f41578b532dffe9ef87be77426e0f327a4ba8f6e5e7d222e39fa8359657ca07b232a1b890a5335ec92564c1329894

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 1ccd5ed4f45f694afb85940755020a1e
SHA1 81878945bb7b6bb2e43585d343a4b4cd232917a6
SHA256 99baddafef054f0d4995eae27303a3d86d6fcf87ebdb1435f31cf577a3d2a2c2
SHA512 f077433d8d26e7ddc8b8d13142a32927875d98be0ca64343454b41f1d8ba627d03f8f84a3d5c91b43f917770869ab5b1d5309057f975b492f46d14964898e4dd

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 852f637758404f820b30122e1874c290
SHA1 c20c6ada3e616a941c98fdc793029bf59085fdec
SHA256 44cbd00fd037efd89839d1863ad2ecc67d0a99101e4c8ef2edb7943d8c60b9a5
SHA512 8b14fac757b739a910e1b0131041de5792220fbb3cc5700bf26f44b37978663ba3786be0c574901b38f4d428e36d99d7df81b7a55c0c81eff8893e4ff76a27f5

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 cc449c13bcedf9536990fa9b6cabec60
SHA1 635eee32fbf8d7a4ee9e86e966c64562f0840ef8
SHA256 172d34ed434555e471c4bdb508345812008aef928541c53cb461298813b0b983
SHA512 c358c752c8ab72ae875e1bbc471246adf829cad5bb13012e8b14e946de6b995f96ef8c66a7ce4c9ea3b5dcf4173cedebea2559a24e3e15fde0c01150b91930c3

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 cacd4c589f04e986cd854c8bd86ffe91
SHA1 9c2760f4f1cbc341684c24f0951adda0df25cdb2
SHA256 345db6756d19a37e52f331a494b5596c8fca4fdb1bf5b6b6d5493d32e08db405
SHA512 663df6eb46e2eb56edfd3b6a7c96b427987e084dc5bf5315c1720e5616731182171298b9f8d07a4bff163593ca896220ee761cf28818381dc4227cb3b1a80e5e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 1fc4f3ce8999e918b8a67774c615bf41
SHA1 de25f4b00b759d3667cb020bcca4ad1eedca8089
SHA256 5f7ec50fe5ab52ddf8833648431c6db769ce31e31930c50e344e1fad64eeb0b4
SHA512 6931a44b4008988bc794a101c8cc15f4284d32126790b4a190c5e5c5c025a16247e0be1b4a75095289c42650537a966debf9a14b7cc9517face215c6a2aa7af0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 8fc7cfd4cc014df2076248b416633dd3
SHA1 fc656d1fd61d5fb6acf5ce26cc086e61838c66fa
SHA256 4db74508f86df287b556abf20bd317d35fe3009c84c84fb4f275c475ecd8df04
SHA512 afcd1033aa02203956d6e4f0b6fc9bba1fea36020439cedba39665b2ff25aa874626222b9c0a5730187e2693dd4c182f15414daff469e42146e41c0b9d3613f4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 590be45745701486536b487b3bfa058d
SHA1 1c394dc209c352068c2b7b68fecdfc4bc1e9865a
SHA256 c0532d79dd59463de721e072625b8f6bd489ccdc0ac8b3ee22ea0e58c77e30a3
SHA512 ede75fd7ba3689a9347fdcaa15b25fcfba5447ca163e21fb1d981f7918e31b08c1a7188eea62f7d40d6c70ab713c2f6a56ed195736ab5b43daa49763e16bf3d5

C:\Program Files\dotnet\dotnet.exe

MD5 7d60b73eb8b27d4485f6896c77082e8d
SHA1 534fe27910250371758a8a5f3ce922551187906d
SHA256 11c9880d2665281087a92ce2cc0ed5beebb702ad871b4ae5a9dadd4ee9c5962a
SHA512 517fc185d5c5f73837aa0a6041840f64ef7c397e4455caa8a1952912d6a4afcae470463d2254f5257e00bfd27f3053e485b1e9b1636a08a2c0484f62dc3d62a6

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 909b0e816d0953cfd2a96723a4c5e000
SHA1 be17eed4c4f72e10d39b9866828d5a5cd0d70bad
SHA256 2e46038654d7d56da9d13d45c79df1e19f60d8026b8d7b0b67301ec41f9cb4a4
SHA512 2c275a5062ac043ebc58ec8e492a7c05d3568bb7e9e781d77d0dda1ba290e07cc63e4e21c8c9549a7395c873067f2745c7213e8a846cd53c30990f2e1a93f290

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 beaacdf8802d94b61d50510b6dff19ac
SHA1 8ccbf0bedadf7e443196fcda05d9198012386660
SHA256 93b2670bd783bcf104b16c5396c1f53d71042d020594554a3224b16232ac9c4e
SHA512 71ae1e15f4a5260f4078c9637cebd989e1088f24e662dd9bf1ffaacdf1c9761dbb3fa68144ab1f6862b50c8e2e0206e0f9854373e6928c25487f906b20fa732f

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 8461e55446b688ce4e7be07dfb0f7159
SHA1 5be047faf4b8d45b917b70467cdef3efc4c45c5b
SHA256 dc3a1cffd6a39588b1d369cf8e3fca9874307691aedeac3da251e0f9e2a1e007
SHA512 df11e67186f851df971b2e51471f7380e6be92156fa6e0cda49978d58f6fb203a2227de0a7db3d34905ad73ec5f7bdf0404290c0899b9041210d50db25839484

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 f86767beb09a6fb7aeb8e4d890fe52d5
SHA1 4324426a6577d5261d8836128747d710cbae3410
SHA256 71d39e05e1b4dd8c029601d93f7b74365144575ad3d9c71c5ed5cfc13e7e71b6
SHA512 97720484b67a4000dd9e4ef665d525bba341fd63f6968d51cb37790764480867fef4c35b890424bc800649a778fd3ca7dc20cc186545e3911415a525abf58fea

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 d5efe3352d872a4048e458af27b7ddd9
SHA1 cbb23eebc4ae7c4e065da6bf4ec3aa4bfe2438cd
SHA256 dedb8b78751f251bb74617eb05fcff27cefc6a877e42a9705cda9bc987868260
SHA512 fc221d8f219e1dc574a337b7418a383d7f77cf6c26cb3668828e58e5f8f526d6b02e5ba64fe842d0a87b6cf4d22a557a2371f3c5fae1e3ee5aad859fa7abd425

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ece47e8ba510c9e627f42fec45bfeb50
SHA1 db0498c99b958236d69c2684e4718e1326ae7bf6
SHA256 65768c6a10370c876c36c230afea0ed9ede78cda26eb878feb64e13ed0e451db
SHA512 930f6212ea9a3f5ee733032e2aa9bbed73a00fba352f1cc9e50152a2745094958c0c19eddc2f090a2e594656c92d8c31cf2254aed90c84dbf96ce52a7e7c8614

C:\Program Files\7-Zip\Uninstall.exe

MD5 347059e66962da3527d8bed111df9b5a
SHA1 fed53401d5827bb7a1fad31be912f3bc008627db
SHA256 91418179ab2ab65ff3009e15e859c00d4949f352e76c0b20ac621a0b50ced7da
SHA512 80865992621a47170e0044618f793917624288d68e63d1000e6ddf42d88a2d6ea3a51a142785feee6e44693f99862393f8a8fb9ce721e86bdadfc21ec44aed99

C:\Program Files\7-Zip\7zFM.exe

MD5 6c188f02d9041ab79bce3196c2c3e3f2
SHA1 e02c1fb5698f83f99d0f4a170dc54dd99d483f6e
SHA256 76f0399565eb98ee730c1b59cc3fb8aba7bc10153129ca6c9b1b3217824bfb0f
SHA512 1c5fc99625bf61eea2a40fd168dd155e252a304d6ec1896682fea1693ddaa9df1ed261ac97b87f5c04756fd83750ca1f1d0ad97eca7f66e05dcbe7d5839a2aa5

C:\Program Files\7-Zip\7z.exe

MD5 c4e53a758e2b50325c46a4674b4f20c6
SHA1 716670d00cd3291f8ec0a9d2c9f168400c490b46
SHA256 b2dec350bcd5b8d973a128837f99916437595734d203551a5b2c03c76aaf4cd8
SHA512 b942225f28e3ac5593d931e6b2c512b6e3730b15af01ae65a63b2199d724f0dd3fb2762be0cb4fd6050a2d1bf38e052eb8a251a537b214162354cf476b95242e

memory/2004-540-0x0000000140000000-0x0000000140147000-memory.dmp