Malware Analysis Report

2025-06-15 20:00

Sample ID 240611-wmamgawcmn
Target 2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk
SHA256 bd0b3d165292fb7636f512a6bac93ee5df6c8315d492ccbd48031538832dc15d
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

bd0b3d165292fb7636f512a6bac93ee5df6c8315d492ccbd48031538832dc15d

Threat Level: Shows suspicious behavior

The file 2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 18:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 18:01

Reported

2024-06-11 18:04

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe"

Network

N/A

Files

memory/1964-0-0x0000000001C20000-0x0000000001C80000-memory.dmp

memory/1964-6-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1964-7-0x0000000001C20000-0x0000000001C80000-memory.dmp

memory/1964-8-0x0000000001C20000-0x0000000001C80000-memory.dmp

memory/1964-12-0x0000000001C20000-0x0000000001C80000-memory.dmp

memory/1964-13-0x0000000140000000-0x0000000140237000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 18:01

Reported

2024-06-11 18:04

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4347ed293b476c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013edf2a229bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de9d03a329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d20d95a329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081d81da329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c53de2a229bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099ff24a329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094e68da329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc52d6a229bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b882ea329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000213b01a329bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-11_9cb6787861114ee8c297fb30b118e17c_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/1416-8-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1416-0-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1416-12-0x0000000000830000-0x0000000000890000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2677690dec38b8e286d25f7469d3e01a
SHA1 756de7d9d5cd3f89d1969f46f7a94277792d608c
SHA256 7d05d4c8229b1cb17bf63248c6541b2161c5ef6ecf5f575d7900e68357742c94
SHA512 197c28c41ef18e7a25e8d831afe120663fc2f525e4ef2838a54ee8b6172694a3b1f2ac35e6869fbf66ee0a188e912de3c46a4e1944871ff629fb5518f1a0d681

memory/1940-22-0x00000000006F0000-0x0000000000750000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 c542360fd552a5ea2257815e42622e4e
SHA1 92ba72e08018e9d9cafeef0ae6f86e87cc6c6c1c
SHA256 ef94e1ad84ffa16a55a47a5add223d27af96a3e25b831637506089373499f52e
SHA512 dd73545faf6d324259ffb910ea29be2e2b960f2cbe9be6158e121368a91e03a4b97ba0a9bf65919e44334e31885f4499b107ee00481dd58b78a38d3e9abc3a9e

memory/4544-34-0x0000000000CB0000-0x0000000000D10000-memory.dmp

memory/4544-36-0x0000000140000000-0x000000014024B000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 c9c58fe2faf35a0ff3aad8a58af54e5a
SHA1 fb98330a7de53c04b77c4cab8c933a6ee411fedc
SHA256 a8ae02b62d4083de2bba2cdd54de51b880b0dcaa94ddb384e4b89df1d043d61c
SHA512 a15eab09a1b40f98e293e941a0bde2133d6c7b7a3000ad705c48208e1944a824179aa5237bb85a3610871815c0f8289810e51b595426d8c145028440ef54b572

memory/668-45-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 9d0e0954789655bb3222a85093b78245
SHA1 9c6afb24756d5d0cc345d2d5cf60f32cccb35841
SHA256 88f8556d669f93dde42fb08ea83cac409f89005dfeb39f0301ca22829a214315
SHA512 6cba7bcfca4cf39556db2f37711c92db1cd119d00d0bfb38cac2c83487453de6910935ba3fc69e619f76e7625351ada939fac38d9febbfcd8ba64e1a67b93ebc

memory/2104-66-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/2104-60-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/3952-69-0x0000000140000000-0x0000000140166000-memory.dmp

memory/3952-77-0x0000000140000000-0x0000000140166000-memory.dmp

memory/3952-73-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/668-68-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 19fd4f08ed8183a9d70ad75c7d07c7b0
SHA1 d76ba99e618eb77d7148364ad111032f3fe21b1a
SHA256 762c035113e02f2232699dded5c0d4ee078bde4f948eeb122fc7bd6f9108cc00
SHA512 c136a679e2ccc9a8a18347718218f3e9c5102d8a50bf7283c9b3fdfc154eac77b424a2628a2fc4549226fcec3a7c8fae770c4c0078e3c963037fec531792a2bc

memory/3952-55-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/3952-49-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/668-39-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2104-122-0x0000000140000000-0x0000000140166000-memory.dmp

memory/4544-28-0x0000000000CB0000-0x0000000000D10000-memory.dmp

memory/1940-25-0x0000000140000000-0x0000000140141000-memory.dmp

memory/1940-16-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/1416-14-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1416-9-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1940-234-0x0000000140000000-0x0000000140141000-memory.dmp

memory/4544-235-0x0000000140000000-0x000000014024B000-memory.dmp

memory/668-236-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2104-237-0x0000000140000000-0x0000000140166000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 77456772340b2a18d52ace974f871905
SHA1 6e60187202aa90a5570fd0300a34a3e1b1037b92
SHA256 3f33263474cf0d584d8f0d9d19bb5c60f1cf5972feab31f07aeea4545dc23c70
SHA512 36cb09cec7cbe20dd0700f81dee4f1f9069dc81dea67f537e86327cfae906b3fd237351b783c0ab97e4607859fa23501ccc3ecf9b63753c3b70b7ab190e45149

memory/4456-242-0x0000000140000000-0x0000000140140000-memory.dmp

memory/4456-249-0x0000000000690000-0x00000000006F0000-memory.dmp

memory/4456-243-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 59c1687888596ef84a5cfab189890cca
SHA1 e0444b2706f4b1ec153f28afc81a1489c770ab03
SHA256 cf46b0404f537d4437e7dc7a19e3704b113c5ef2f7c3e53d627462a73c3c29fb
SHA512 db674e1f5ed2775bdaf4dc94dd5e38ba36606f64c681ec1ca7aee7de6f9d56aabf5600d31ea596f873ef721e206e420e535762146d9f93ccec93e94c337a68b2

memory/4860-253-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4860-254-0x0000000000A00000-0x0000000000A60000-memory.dmp

memory/4860-266-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 d174653e5600e753a8fc46c6090ef716
SHA1 fe19e0bb4924af20e448d6247a34d2af64487ed9
SHA256 1070c1a97bb288312fb7486dd8d8d68a5259d31a14189eb3bbca651da66e69d6
SHA512 762d17f730ec99c1facdf9c4ae0d8f980dc0d9bcd8b90634f89050fdebc731a950aa5beef0f32c90ecbac277d764e4cfd59340619684614fb3ab6c1d40f4aa8a

memory/1488-268-0x0000000140000000-0x0000000140150000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 1032fe00af553f33caaed5b100f14e68
SHA1 824d576f0fd8c9c3c1c6d4e7ce078794e5dd771b
SHA256 f160795ac914050f9df19630bd256b4814561a86b7915712d99d72fb2651f9a0
SHA512 48e5116e4a99135bb7009ab806d67444b9dde646abc581ab6c34b9bb3506fa8b5910bbc9f54f36e84b5573244863ba2774b7aef408e64d9635ce9904fc926797

memory/1456-283-0x0000000140000000-0x0000000140142000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 7220214759700e81a64e552495e2dab3
SHA1 189b94520adc4fb2faed0a14e9d1d7f20ae91740
SHA256 55d8b6239b954429a4e9c1696a37248a5027f1f7a3aaed411d38be6dbdb3e5f9
SHA512 4068daea07057db73df17b72014fa0d23fbe6a82d530a3545f8b471035a010a21536649743f00b727200cd96d4d383fe7adaaf8d40046cb1abcafeceed983479

memory/3724-294-0x0000000000400000-0x000000000052E000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 9359c8aa633137aa1b42307bf59b93ff
SHA1 5b896b682830f2a98c98aff073d88176a50b7c8a
SHA256 085d88b6924abbafac00be038ef63c6973d58c03c85c14aa0abe15c7b1196cb5
SHA512 db0cfdacc16e0e36808ab77bfa44a13446a78a08ff7021873ac020ca74a6d05fb62eb4941a114f604a9712562e07f4015e40e7435d86131bad41d04705758785

memory/1984-304-0x0000000140000000-0x000000014012C000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 3d73a23aed9bcc80658469bff9529e81
SHA1 17b41453a3ba9bef66b2f662d709c5041d081343
SHA256 2d513e77260bce1b5f7bdde7ce776fd5ff79b825aa2f33567aa878272b8c582d
SHA512 6db15bf7ac865aab16afa96f8fbcc5e320916830c0680007404a8d022d7fc1b7356a02b7bf9ae19915e472e579732011c8e2dad5159cd832ba7655cc1b099ba8

memory/1532-315-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 b7a38eb05e0c87945b53221bcd1a3682
SHA1 e25d0a28b612f6056d2d33c4b5b014eea352f409
SHA256 705452b588f1fdab2c2152259b3c0e6df0d64654b342abe1cb34a367c4e35911
SHA512 bea29fa17791ed9e9e70344462eaab46283892b80b557e6007a18904072466e64c60eb0805fc34db557c96ec87cabba663049fccb574ae65ea58750371216d05

memory/1972-327-0x0000000140000000-0x000000014012D000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 ca8072a63ce6921104619870b7658ee9
SHA1 fea871e9acc7e73bff53d8459012447d3ea42b19
SHA256 75eb36c7dd8dfde00a814a38ebb1ba562c8347df5ef0479cfdb0d918017f5340
SHA512 fa2494ac25e11a33b1c88577cd413b32fadf84dbe3980b858b9e1cf67abb48d9b95c65fc7bbde7d708a4bedfb800a2066d8a8e810bc867976e2457e71803bae1

memory/4628-338-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 4e9fdda18f29439fd9c962dbdfdd4169
SHA1 71611037b4ee3879bfea4c6e584e014cdb25ee6b
SHA256 020bc77d9d9a0e1f6ae724f65cb12fffdfea5d2d75100c089a606d3ac4cb7fd8
SHA512 a275f6cd8d1130971a4d6e1ce06b5ba9ed06734fa795db6052222bdadae7c025818fe5c8a1b366a428adf426f1fdcd4356bba0f1339589a0b73c9ae45629935e

memory/4484-350-0x0000000140000000-0x0000000140199000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 f6791a0deeb5902573b4a21feec8b6af
SHA1 619f51e3db1075ff3358d17b79acfec579f30b16
SHA256 cfcd3bec3d3c905237ed3ee90b4f6f997ec04c080823b791edc43ffed4667560
SHA512 edaff5e52b631b7faeecf1f6450b1ec87facd1b7afebc444c8db88591bb578aa0c40e5e6e4a7d8434a21e1fdcd3d1748e5ea795ce684cb549a9396d22000baf2

memory/4956-371-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4456-369-0x0000000140000000-0x0000000140140000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 ba44101730badc15137443dadcd8e609
SHA1 03efba3f3f8b1a4faa1a7fa7b96d4bfaffd8b810
SHA256 6bbf5a75840470e7cf18bcb43b0bf62634ec0a03e841535ddc0f3dc4ccd92259
SHA512 183fb3b6705cea549663be54fb04c8918015a435d025296ba8c656ead4443d4fd13653b51d6fb7a658fa35e8962fb95e4ea2fb2b1603fddbff7e77df0967708c

memory/2084-373-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2084-385-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 bf11cbc9ccd7a596ba80b2f95a87b186
SHA1 d458d7c1fa1f50bd3399db2b2e2ee73db975bc46
SHA256 63f0a15761b0f017c24cf71b0737b1351ad8925872cf5f5f273e06a3537263a1
SHA512 215d7a561183bfe8e8e8329668df0f775a003cd418caf2cc053bafdf2369a6efc15643511f968b3175d3d4ddc300d2fb728715a2ec1b97782ea19e72b433b6d3

memory/3040-388-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1488-387-0x0000000140000000-0x0000000140150000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 0b57478a9aa67a4e76c4f20988996af9
SHA1 a13bd063d0dca7f13a8a625a544b26e923043019
SHA256 5e0a0c841c99fdbf240b62ecab67b45f17e79d5a6298a137dfa6c45550bd0d68
SHA512 450ae73c33f6a31c0a2386315177d0be92b3b4711db4d37921779a77fe9b8069c3aed56e028c26db182468cc29c45846f9b912eae4990817a22b924a7907a38a

memory/3016-400-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1456-399-0x0000000140000000-0x0000000140142000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 98fdab8b8a2bcd5ba10a97d4ed919f99
SHA1 c96160de7d67544ab84c8f226185b5eb02ab6da2
SHA256 fd418cda0d7b38c3194533b25c900ee1acd852142676acaf2562f025d17ffe5e
SHA512 8597e91658428e7983c71250f854ab8553c85d6ddc16b2b7e810ebad52f72598f685a1a467a2a388097337dfe297c243e4c482277f5e74759670d703a79bc0d9

memory/3724-411-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3480-419-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 f02fabf5d3d323f2e72e8cdb36ace4a4
SHA1 d7cc9baabe84aae548a070bd715af99009b47f5d
SHA256 921b47061f249bdd33eb9e0cbd096bf72c7899c69f093f94af5d0b0504677b0e
SHA512 ceb09729ee954598cbc4aac8e1081a900ab5036ff3fb52edb227443553b41d3aa97c0b08dfbcf119fa8c0116344239ca2dbaf39608bdf09e1a9d7cfc0b5c96ed

memory/1984-423-0x0000000140000000-0x000000014012C000-memory.dmp

memory/4908-424-0x0000000140000000-0x000000014015D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 b786dde18e972f852d583f741ffee635
SHA1 7dfa3fe44b0c2a9bb92ff12ca6d354b5c69bc362
SHA256 e863cf0506ad20cbf661fcb450ed61485dbb3950c17ad1ad97daf8fdaf81b283
SHA512 fb2764ef59ed183c73d5a846f7d7026b98f15640ad9f4b1231bfbba8bc7c50f20101faac5ceb034f0fa108b48392e604417242a5170a82ce003d4a4009a63748

memory/3516-445-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1532-441-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 f78e89cc1d405a9d9e916ce7a7b4723d
SHA1 42cbc943d2b01ea1f80d1c89f74076a7da0b5462
SHA256 01b574c5d81864904124b389ac2e32f7d3e20852c723eeed8d2b9e24f538ef72
SHA512 ebb79f7af109faa606383ffe296d8bd19b1a29e9e21f8d42eae03034d2651581e9b58debe6a4f5bcff0a5d770a60eeeba3b635b51734efa90dc1775a037f4281

C:\Program Files\dotnet\dotnet.exe

MD5 2848ce8f6c853ea76dbda21aa74f7e60
SHA1 e34a655c806a2c18f0d6663fb6c1b8cf3066a7d4
SHA256 fd0fdce78a5fee922dfd517f6d15ec5a7d8fb002e3cd83108a87d7bca63d5ace
SHA512 492e29420717880b29350f05261c31d59495c1cfcc5628e8eebec08c1c16f80c97b367537498aeabd65b49ba70451d5c152cd89b58b4b08a4c9aad58dfe12b9b

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 4d353f2548d51171e48f8803967ec982
SHA1 666175d64678525cdb4dcad4dfedb5f1c8536ddf
SHA256 d658ce3e03a205465982bac4bb4e748cd6d0ad0b4bd0b3155520e623fa2927a3
SHA512 fea4970d80e304c5f4e7b99ebfbc1943c569b33300e85208c86f325585d65775d31ba9b1ea7c372f9adafabc38675b6523e941eb1e52786d8adc766b7d43a55a

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 aa0d148447ef7c326617567f1f988ad4
SHA1 5000a3759877c8d80ed46fa1515627c36cfbb8e6
SHA256 2362e4684b74f663338e3004a8d7f294c4dbbe11b67233a87ed0a8a2decec494
SHA512 28cfc82bfab96e774e5aa8d206c02b4a227aa3d798285e1230a0252f522bf3d5a71b3c14971ef931d369ec49057cd48acb3482c4930bf10676252d8b5a572755

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d9af1f99cebababe22a38f0b367d8599
SHA1 cad772706d47867b7ecfa5717d985492ac94d3bc
SHA256 eff48173cccf70abe18e47bcdf9c6b5529df0f3fd81f66daf7bad9ffafff1436
SHA512 53310b0c413d49ecc6dd73ea4c26bb7f8debd68555448de66184210eb69291cbea8a20ff03eb3ff057de896096118aaaf1bc63752cd6070849d48fb0fdb534df

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 80c47b7eb3b6f0391976bf554bfd02c5
SHA1 2f2abd7909f9db4e8d65e4474164f5742893a356
SHA256 e76f9ba7f2214a04a1029cd6ca239ede0c451da72d8e62b5478c37b9a2c5709d
SHA512 5aa5c3119073a38be3ea0f69fb790321f62d09f4a7dc3d10df0022e1db4337d398bc10eefa8affc68f93025f00248daed5c1d9d9ec3d284abccd699436585381

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 cd5252be628f28c1550eb98fa524ef95
SHA1 0d8612992ae0411f60ce1bcb813e7f99e8e05281
SHA256 553a27f6197f81ac059911399c7ad24c5c4fd3282d2f977b0615259a9ea75d78
SHA512 be68f6e6a52aa9786242a12245184af08a5e82134ac31bd21b35b7e76e17a7958de738ae38872798f273276d57f2ecd4211c494b6bc92adc538e1e9a7f1b33e0

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 986163ad8ead2fbc31693d83d05a3c5c
SHA1 58e3f8e293c4ea6b8f3ed0571212f6893db7d711
SHA256 26b071dfc31884742c80031e3c6344f4265307417bd9fe3d02b76f7e4dad9c77
SHA512 1d7d144c4c01adf24bf02c3063082fceff333ad2d037d5e15694b0f16770ae3ae8a26ed5880078e6d571376e3932ff4485a7502eeb9802b1a09c93679175b74b

C:\Program Files\7-Zip\Uninstall.exe

MD5 d9098ab7fc27ad1ac238d545619c03c5
SHA1 bc9f838bcc5a6dac263cb19ab1d8c04d3a3a641d
SHA256 c5e7e997498017406a51ea069c51af224a05891e3ac529eb852f4dc0c36d8079
SHA512 ac651d761d31114db25748772aa498595ac547faafb80e16bd1ed4f2966c7b48b862a485910e45e50dfd86b97251be696abd031ea60572d1e2601e26c9a4b426

C:\Program Files\7-Zip\7zG.exe

MD5 8ceac51a4f71cb44387d00993e28754a
SHA1 9c9ca89a762151ee126945003eac0b837ba87410
SHA256 5b9d171bb9dff1a0c435c782076be8ebdcf515eac499eba191da7aec7bd38e6f
SHA512 2afb5765e4a0fb5810f87db66d442c6d64a58c59317023aaace6ddbafc7056546f1cda4509dcf39582154b42bbde7907d3c26fab9aadd4d9efbf247318e71767

C:\Program Files\7-Zip\7zFM.exe

MD5 3310d820408909833788475279bf15b1
SHA1 de7ba28466bd063cd2de8e81b69fea077ef0631b
SHA256 52dc8379a1754c838b8fc115d1c2baba6f90d6919b9ba2e6fea0b376bd85521a
SHA512 a73b993bd8ad95e42483d48f7e43ceaac3eee74ef6c79a89e2e6b0da59c0af351cd3b8c031327555c0e8fa8c78b443f449d8f14137cb0e148b401c40d426b399

C:\Program Files\7-Zip\7z.exe

MD5 5e4535ca4163f22ec7e462f004b0a9aa
SHA1 24b7ad72e99d46577ee171169b556145629b0913
SHA256 4a301461ee694ef46f0a89481563c7dc9de62fddac9ce30240ce8c43f7d4905b
SHA512 8591ee43ee1bb8321dc8155c050310ffe08cbd15f5794064775ebd4a072f0263edb521122c4b6ef957f1660b28ac10a15469069d0dd13aeabc58e9b36d189ce5

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 14b2ea0d659a1a5d2f3fbcd3ae981a6a
SHA1 acb64331fac11b731d4ed2a762cef347cfcef151
SHA256 01f9cc393ac6f3ccb1147423e57d28e0ae3c9ea1465ac276ef8cfbc9e1e5ff87
SHA512 cae6914b2138922195042b797ceb9b4137f159bbab60f1d75f04ec1dcc3ba54fb2644f286ad168fe6d591f1ff0daac28808453393ad87bd6cccf8a2aebb5b6ca

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 afad7bb8963dce39c6610deb27544a87
SHA1 2c9420001d6281f4b946b3de30d255f8a7de7c60
SHA256 3d473208d45afb86b232e9f484c6f3a1d816195de8e153b25f6f16614f933b23
SHA512 5c830a99c7df31a5fc18040b3afbe666eb41c1b8f952e320505eb35ba6b29799cf0ac4ee6ea005610d853d087329f9b636c0697c1e2eb25e7f57ef9c9e097b98

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 76ea1c6cbc8680b49da7132bf5b11854
SHA1 9b8163367877c56f7b84fea8ab03c86cc91f5c23
SHA256 d824bb112438b17b34f1f9639ef8a704bd307af608bd7986b0dc687d5f047a7d
SHA512 42c36d6b340c15fccc4c4f8c5cf6d8fc016573d6f6185e0bb0be730f4db54a488756f975720c39ef62cafa6d9b8eb684786bb334eae5805303d09ecbfd698c80

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 90f3da89b7051ac667636f9eb2511a0b
SHA1 cea046f67bdd45cf313b45ecd43c8fa652663040
SHA256 7d9d45cdf238c68321101bbedd0eb58f961316e2b2934b0b7134858dab4e4399
SHA512 6b75a78b90f80db09ef1d4d5f2f905ad8d77883e6445fe1b94562e0179516b5513093f9910640ecd71be769d6e5939d20cf4b01ef2bbb0672feefcbe49a84c4c

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 955c01676dd75580ab8ec92e2311204a
SHA1 09087ed66f81e8dbd5c59f61e6ba3379c8e91bfb
SHA256 f0a2b91fd9779a93be0f4039bed4d2d71fc668c34404e4efbe859ddd9fdc9676
SHA512 ff3d0c6343ff6b3ce3d4ae126f46518aa174f1ae220997c6433b20967b138df04fed88dfabc16da3d830e94ceca838b2652f76647901adcd1a689f4e31b188e0

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 ecc752cf397b941f68405e6472c4ec87
SHA1 41648596cd0c7f96aaeeb71610bd40448852ec74
SHA256 ffb939a7f72ad40701013b159bb7210e5f6f6a5c0834413181e884f69607774c
SHA512 945e01cabe6e2fb19937bc47ca148d02677b4412f8febdfade4d26d430390ea432f857a24969e4e9e2607165e36627af8efae8b1e4c7ac4b482f7a4740f178ed

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 4ee35a56406cb022293175180d6ce61e
SHA1 675094a1761a862764a49bfc12e9792c1c118efc
SHA256 69015de7ea6ffadebf9383aebe4cfed36985ec5ad089703d6c11d0a907c36f3a
SHA512 c2274099fe4025799afdaa6c7c34c9d4ad4cd65856359b64f178b41170a0e76ee3f7a1f333be2813ca297adf9c72556acbe1fc5140ace655ae82ad63b5acd68c

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 88925e2020dc799af91f3ab3e99fa0b8
SHA1 f0acb5b9bf8aff86ad2c4d71deabc8f96e486851
SHA256 40e0214f7b4e1561d43fda6d4175a4d4d7245c89ee2a17bc6659017e702b534c
SHA512 e55275003602cae27bc5d2e3b0210a98af19cb520e51da13ea4e2e2fc2d58a4d5a027acb30e2349eca562e8dcbae7f726fcc105044977e5b73abb9568f410c9e

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 5cd7cc7659303af7ea5a395ccf98cdb9
SHA1 2e15a9a3a82e8f33bb434b19ff8eae73072e36c9
SHA256 c1187e762f4b5ce17f435ee0d870a87380549872cb1a61eaf915ddcc796adc08
SHA512 0efa74515a678be0062510b1a76c6a77007ebe0c79c0aa1b798d1f05b5d972f7add9f658dcfca001de529ea71eb21ef6c7f8760809be6399cb255a081c49fd7c

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 79e12fbf651b4168cfbbf3d7df1d9bf6
SHA1 249f1b07df6e05b1d268eb88ad93278dcdec8968
SHA256 e731fbca135a3319d59a72eb6fc61ffb3ece9ad1934f8ce6cb6338ed9527e077
SHA512 cf2e7d2ae0575866944c0f41ac5e13b3bc6e83eb341c2d2ea5591ef4d06b5aac14694f803e22f128c762dfc92614be4433ea597ed4e6651f8041f18eda577773

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 730a99b196ca33dbc6f047be82baefd4
SHA1 d081218204abb0bbdda285310a28266d15db5a39
SHA256 e69fcb87781d32c35122f0b4f0acfd783fd56533946e7bed6059ec2c8d03d716
SHA512 f91ecc496ce4fa850488c61c312ce06fa70c68c3933c939b8674e4572edfc9e00b07af6d583042c11398429c9321866fc3a7034cea4a9e1eb761cda941cd99a0

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 f70db1fbffab79d4acb62fa7823b31ba
SHA1 d13a64ec3f37dc580c1bb062dd7f214d7f299894
SHA256 422c1c0062eb984da860de2caf71b1f81eec830e8684d03d3ed52734925852e6
SHA512 6d9ba4ff038e555deebefdd0e65594f2bec500c4ee912abddcea64895fd9908fa36099fc8dcce00b400aef35394822650ee784b4425f1d5d2194e7dc2e9750cf

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 a7527daeedbd5ded118997ab92c1aa0e
SHA1 98780fc4637c6c97f4c2eebf8d5fada91c1a84b2
SHA256 667f0c6475a92c5f2856430b929291a7f92bc4e8ec2eadd46db8b37ee5bd4d1e
SHA512 c4017e4eea178eb61c07778d226fbc747bb9b38154927995b382827558f42d28c8a0534265516ceab074010e1b88a8cefb2d01e2b1430f278326d211e3fc3324

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 5bcbc69a5d0ddeb8bbb2a2d46df63c16
SHA1 d0c0c3e6b2006687f282a51ce7202b84e9af4fbb
SHA256 2f7491c70af85eeee65d457bf79fea398b317502ae8fe07120c28c5d81c47359
SHA512 24a57c4f7b916cdf7c36b266c9367f9196526cbb9b02ede83364c2121c8ee15a2a7f9fe0de7c7683f03f7ab392d8ef977f4e850f8172fb04a89f027e00d54e01

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 5cf7c94f3e7ee80291765212f995a8b9
SHA1 2ea4076a281bcdb268739f7177a8cd6548f0c9d1
SHA256 c5c582111ce54f4043845fc735aa8000a6a874f0dab0e80692971c9366b7d54d
SHA512 10589e819686e60aa2e7493f1877f1d4c3b093ac59c24db5cab09e8e729f17878e21fd106b80bfa79bfce4d218ab334de41abfb3a6dda6f1b47d1135f882d2aa

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 a006bc313489277225516f4df8dca0e5
SHA1 60d0dd66e7400e2ffa4e7f07304763c89b0cf13d
SHA256 35a6317018aa903a7b47391e561b2f982200ffc6ebbb6299758559ebb0e17c74
SHA512 52449b85437d7a284113895b17c03299afa6c2dd49da6c47fa38dc9c69da95fd7068dd935657a1337ee53994afe4e768152652c68a3cb73a1bb6d431ec35ca87

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 346da0f1b19dbe56791ade3fa74e0815
SHA1 e16e2354cb0bc0d10bc0c002da8d8d9e325b39ef
SHA256 a8cd1ba7181711a618e4cb184e7bff5bec0f90d1cedff56fc432294f1ea72c3b
SHA512 859c4b5d6a9c0ca9e4b109a1e3bf5cdb96a0161549d4ae3afeebed6e0e899d2603c0a1dcde4b4d5faa8d15f5eba2d363391b196ae5bdd97cf78160451c2420a1

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 9344896c6b5f2e795fbfd7ffb89fc59c
SHA1 8694b40bedb41eda7e994959ccde1b728aac30bb
SHA256 ad2cae0dee355799cfd975d39f54d7cf715c691b8fe6b167245e973db8d42143
SHA512 c227374f26e847fd8218ba488a6158c06ad6e96bc701d670540a09dc07cc63636a19ef850e6eca1f22ae58e6625f0d7777371b1cc78ae4b407f1dccf8be6d42e

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 d2ac4a11370ff18f43da58e190907cd6
SHA1 82f4ae8e3a8101c9b4f90c3fa46d3f0e1fa956d0
SHA256 1a975453aec59a4f599e9ecf84590956fc42d6a00c60e6d21d803fdde77608d9
SHA512 b98dfcc6d0d440387b3168e93aa734152f6cab893d6ef182377f11c5dc52f96f403379bac4d031bf0e2007dcecbdc95db0ef8479274c09f255586965f333f693

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 10683b0fb01a94e5019e37c994b9ad55
SHA1 16e262206a6ecc421816bf231b0aee92919a7996
SHA256 7f3c9b9e5f2d532a83fdd29fad1f0cbcb00b03730cf26920ec9bf1f3fc02b5d0
SHA512 7b82e4f50e7267183c21fe2faea3b13a76234bdee1219f9284d58f8a260e50039d7f3999c0f316809159c228e60d880dc7f4264e4740ea96e01324dd295b6a97

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 2b39475910808c52c3d503c40cab372f
SHA1 3d7493d1f8aa3a5b61b6dfb9bf5242e5debd736e
SHA256 bd2a6e2c949dfdf5101aa9d8a1d7f9daf882ee7c6bb5a936e8a23ff06e847965
SHA512 dac89294ed6d64be783d653cae2002ac9ce598de4a878885d188943d9b6b0d8103c6d1537220bfa8a1f90d86117d6c2ef1f451263e13defa057175de9d13798b

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 d4048c335ef95f35151fad8506ecca99
SHA1 a6765326e5f9e5558e41ad7145dfd76d99398dc2
SHA256 1ea5f0eae3b7b1c8ebfc90f85d04221e245b0e1b356c180ed800277ff9aa2f28
SHA512 b3c233d8b2bcfc4123158fed611743d5035ccc0d6c7ecbe9ac7a2111a668ba43780eb6b5f26030ae9e21074d7ea72c1fbabdec9fc84230eb2b4bef24340ce56d

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 84cfa11529b22918494ffe13c4ecf5ce
SHA1 294d59babc577866ac1e82ee0b2385a363800594
SHA256 4bae5ac693b3d767fc35da312d2804523634cb12a29c8816661f11749a725ef6
SHA512 f069062a4c1201bdbdaa6684dad07a39fa124d6f1b191af8887596eb6076926f65ddcd6c9704df3b88cefe56f6622cf7fd93e1f0377a049a2a2a24718dd56d82

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 969b4913de618b980e56b8c8618d6912
SHA1 ebf863cffc93a47b8d03d21caf69654f57969f8a
SHA256 fdffd335bfa0432144c5c53e014aa609b6f931455ba2e726c7cb752d9e221415
SHA512 02d2d11435388e4bcf69da5083e4d213148f04e7c1ab11e2eb5be3dc45940d55bb6bd7be60d14fc0d2d620da0e0d2fe48f95bda9a1cf3ad5d9c494ad0e6288bb

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 c569b6c23918b46db255d0d3518ce40b
SHA1 715a7ca8d4c881375a0e2737587cf01a0df21660
SHA256 442050a60bf6c60c038adca535d99eeedb41c803fdcbc4534977c332f34ea17d
SHA512 e113fed117b7a4e99af203a0c1d17f2c2e42d26e0a3cff38728e3f2aa1f0a7eecd1910dafc66130c90cd55887a77bba629196d6f6deeb0050430a1156889b12e

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 1a0c4f6808d2636b0212d4bd9492bd1b
SHA1 f3d8109f70da67ee02e2a6b00be3af9ed020e8dc
SHA256 7e480c11a466a835e7adcbd5d0325f98b5428e9485e70bac5608970f70c788a3
SHA512 c040e268637ba610434496d5e98b2c23840ab49f03908b6289c548b62c1609a16ab0c7fadd536a66cae67f59773d3d0eb5678b64bdfc4295eee6742d9372c9cf

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 67764efde591d76b95bba0329d1ad863
SHA1 a1a84d8bfa8689ababa2ad757c9174ecc704ed64
SHA256 d97d54a7586f4ff74cf8b0bc63415e667fb3488a6a7de801ae36c55cf5fda708
SHA512 1ba995df1a894d89a09c1819b8ee2860ab64f5433951872a977f35f76cb0c479d0199798c1139195da167e9f7ba01e94face59e2baa758b6a0dcb06127dc1ab1

memory/1972-538-0x0000000140000000-0x000000014012D000-memory.dmp

memory/4628-651-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1532-654-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4484-655-0x0000000140000000-0x0000000140199000-memory.dmp

memory/4956-658-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3040-661-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3016-662-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3480-663-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4908-664-0x0000000140000000-0x000000014015D000-memory.dmp

memory/3516-665-0x0000000140000000-0x0000000140179000-memory.dmp