Malware Analysis Report

2024-11-30 06:21

Sample ID 240612-rw3x6ayclh
Target 2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk
SHA256 cc306607a99b753169e6a4b1eabd8b31a919d1d4bf84a15647332721bf1abd74
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

cc306607a99b753169e6a4b1eabd8b31a919d1d4bf84a15647332721bf1abd74

Threat Level: Shows suspicious behavior

The file 2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: LoadsDriver

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 14:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 14:33

Reported

2024-06-12 14:36

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\11dfad7885dff9a7.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{0F1D587F-0CD0-4502-B48A-EF0248B94ACE}\chrome_installer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000006d04b3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ce4fab2d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072c982b3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b3f98b3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000060840b3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf538cb3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027bb12b3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000060840b3d5bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_33e5f4402dfbfecfe7c2f5a07a08e429_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 204.79.197.237:443 g.bing.com tcp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 146.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 44.208.124.139:80 przvgke.biz tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 13.107.42.16:443 tcp
US 44.208.124.139:80 przvgke.biz tcp
US 8.8.8.8:53 139.124.208.44.in-addr.arpa udp
US 13.107.42.16:443 tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 8.167.79.40.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 44.200.43.61:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 61.43.200.44.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 34.193.97.35:80 fwiwk.biz tcp
US 34.193.97.35:80 fwiwk.biz tcp
US 8.8.8.8:53 35.97.193.34.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 18.208.156.248:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 gnqgo.biz udp
US 18.208.156.248:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 44.213.104.86:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 18.208.156.248:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 86.104.213.44.in-addr.arpa udp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.218.204.173:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 173.204.218.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 44.213.104.86:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 44.200.43.61:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 44.200.43.61:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 44.213.104.86:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 udp
N/A 107.178.223.183:80 tcp
US 8.8.8.8:53 udp
IE 34.246.200.160:80 tcp
US 8.8.8.8:53 udp

Files

memory/4448-0-0x0000000000510000-0x0000000000570000-memory.dmp

memory/4448-9-0x0000000000510000-0x0000000000570000-memory.dmp

memory/4448-12-0x0000000000510000-0x0000000000570000-memory.dmp

memory/4448-8-0x0000000140000000-0x000000014024E000-memory.dmp

C:\Windows\System32\alg.exe

MD5 21522b5a06f8b2cabd7572ea66537582
SHA1 06b72e24629f60708cc5c1e3f5e2171367605fd4
SHA256 0dc4b9c362b524e0c9d159350230f19d3dcba38d3d9b25f94de12394ca306f8e
SHA512 22bd157aa3c4f875701502a38f2d9a86103d18885d0da0986cf726d4ba7ee7b0ee89ab7173a77a6b3640e4a1c58b45396147d72d8e9dd2e70733fc6e050e33ac

memory/3400-16-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/3400-25-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/3400-24-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/4448-14-0x0000000140000000-0x000000014024E000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 93c760f041cd4490ef0be360288561b4
SHA1 f0028f18cde5019da031e1159cadd57ebf721401
SHA256 e0c2de78921a2577cc1ec7cd3aef56084f82ce14407cd21b57730796313ba26a
SHA512 00ca223e80475ec6674a3886c544c842ee2a671c720004bfa1f259c77084f085f20534b2293302bc386a91851e3796c750c0da032f5e67540b7c42609216fa7e

memory/2552-37-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2552-38-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/2552-29-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe

MD5 9e6a0f3017f6294233588835489a5940
SHA1 45b7a679389fa7daa84bb9e13670a2afffe22f31
SHA256 8fe76b40acbda2ffb2d3c255073f76cfb5d625bc2941045cab5422e061e02962
SHA512 15b4cc3edf046fd6737a959282c19ff815b03ad3c255f15ce5a326e1105be617efe61ff731ac350a61de528786bb986c99e786bc3016112d5778620a7bd16ffb

memory/4056-41-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/4056-50-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/4056-49-0x0000000140000000-0x000000014026E000-memory.dmp

memory/2204-53-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/2204-59-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/1604-74-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/1604-73-0x0000000140000000-0x000000014020E000-memory.dmp

memory/2204-76-0x0000000140000000-0x000000014020E000-memory.dmp

memory/1604-67-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 b85cc228b5dee6bd8c90c1e03787f712
SHA1 e7a380cb9d0eaea6c3aa65da9cb2f42dac193052
SHA256 6f51a80d0e6f9b0d4a2d2ac17d267a6a309e5f349a1eebe4c6368c0e5b34634a
SHA512 6ec9ae6d1f565a0da1b0670b6278af6923fe71374db127bff7b57405cc31211d4b33c0adcd3485740a709977dcfdeb9e46fe157abde9d85ae32aa39ed078baaf

memory/2204-65-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/2204-62-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a0310545687803ad0a83c071fb7a6644
SHA1 73e833c8ac7c399a0238887470f03f97e4f16949
SHA256 fa22cb8d5152dcfbb27ff39e4a79e480234eb57789f479544261ecd53238067c
SHA512 b779adce8b7af5427712d7f0d9c3928777d2e1da9cdd2cf33dd923857bcdabaf3f037a12cecb8ffcd386636ffb59ee09137d975da59435b1c7a0f735f46572e7

memory/3400-235-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/2552-236-0x0000000140000000-0x000000014024B000-memory.dmp

memory/4056-239-0x0000000140000000-0x000000014026E000-memory.dmp

memory/1604-240-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 82ffaf49d39b9d654c82c630bd70018b
SHA1 529452ee30aa7e4c7ef7452a7d519147cfc79621
SHA256 56114cc772b5f9029a92f4023abd1385a9f3bc6a064530d58869d25d3700a519
SHA512 3f146e47249fd20d6475562c490eb11957aac85d4b88e096caefd79f3b7ab9ce30803e28172f2b7c52b801066b7e017560801163a8d974061e3f167cd6c6a6d3

memory/3748-251-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/3748-253-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/3748-245-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 5f61fdff4636c978b0e990eb54d34be9
SHA1 0ef5915f3f4d951189a69aadc6787cec95f5bb43
SHA256 c728965604994d1c519db6ffe652087a0e15a7e4608db07f6f30a603d2926af6
SHA512 e8336ed78715783c92295c21cc03bf658ba2fb2a04ce517208f5c9a9f8eac25a43f0a8bf389f7a79dcabca5741f663770e75d28dcfbc53b8f121551b6ea2a82d

memory/4312-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4312-257-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/4312-269-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 7409704f51bc765fe446b80e5e30a5d6
SHA1 3cbc996ab032cf49dd29431696b68bde1f9da532
SHA256 ebf536edf2f2f636ae548bc7f4e750b42f257c948aef76b0859cb728527c980b
SHA512 966802364ec99f85b04cd747273fe461d748a39a9896237e6ca9e9983d68d5cd2a8c480cac2a421bc046d3a9ef5222500311d9fbc84c6c8d14ad37ece2ba64c0

memory/4572-271-0x0000000140000000-0x00000001401F8000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 5c8cb37011df29f68402a8dca46401b1
SHA1 89be1ad150f0fd185e88c4898bdc75ab60fafebd
SHA256 f547aa5c91867c076515b5ae3283d3ed58f291a058e6e0328f161527ff10c048
SHA512 be543d9f3e45f5bbd75dd6d11db4edf06a7f59bc4135711a8e8ead0de0be1fd7d3706dab0d168590534efac546d462b82a1bcf9d0d7b46310e3a0735bb7debf9

memory/644-291-0x0000000140000000-0x00000001401EA000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 ab313fa582664b17ef5acb247a795eba
SHA1 0339e6194e2758a0730b46c484f959f1ae161c92
SHA256 87b5625302d1443f7d01ad307f088906bea42537f05ef0b8ff5ab4e4c11b0733
SHA512 ec0b0878ecdfbb7b8dba4228ca9ca3dea8cc1d9ff4eef3652afa2391efd3c9844d5d89e1bbd05d87a3b281e6d01dcef841b167beba62d4bd609e8585da4f1d61

memory/4432-298-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 eb03b48513f2360bfdb4cc5eb519d48e
SHA1 b6817c7afa8452b57d895b347669e394f4c84e8f
SHA256 4b21492b21b6ce1b4c88021fa2fe390c3d12107a238ee008f62ef0256652575c
SHA512 10a02437000089ba4503077ecd1a35900b9784df996c1eeb76a5be1eeb004757a96e16e1f75d2046eb336d26d0ffda50cbb4f7623976016eec20875892e3564c

memory/2152-300-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 876dbacf410605dca0481de2781bcb18
SHA1 5119fcd20dcb2f08d644bdf6debade120227e373
SHA256 5e7bf2afbeb3340514501847385b5ef28412b3c3e3fd31b85cee5d6b81ea9d13
SHA512 64c6c48a9704143ba3dbcec577e67648395b4c773514a90e1fda9fd2b9ae07ccbd6e08e8fcd498264d9d0a743cae51fe34560accd46feca4219f2d6fb6386154

memory/4740-311-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 1f5680dd45ec7e4ef225f5fee6766c69
SHA1 1c3b6f593bc9f6f9997ee77c85baf3bbc6a05bcc
SHA256 e3eb67e60516fe1619ff54d541d4f75ab5e89544ab271798484341f819f5dafd
SHA512 e7ae474fe86672d951955f299512cbae5d6d2b0e52ae3e16c336f4436d0dfe49cbd87735f5cf1b4a8c962793fb86bec423f58387b31c2c29456613e0876816fe

memory/5024-331-0x0000000140000000-0x00000001401D5000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 ebed19f75259d4d9ca497af664b4dc1c
SHA1 c8e10b0b1a496a29443fcd64a33eaf9e889776d3
SHA256 75147b54cd43d8c9a8d6307c9549ec9ff7969fc2f12874cfb3ac0c7d58685f80
SHA512 dd0f37f7f85a766a510b1d6f4c7ce2a71b558bebe8bcb94041572c3ffc8beb52b3a013ca287430f24e49ba9fce8558d28bd707176b87faf5733ab2d27dc0922e

memory/1056-334-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 5aceaefa8875f482c3e284163b02a240
SHA1 af878eb8a439fb011a293060cdf6f04df1f1ea5e
SHA256 9f1e184581c8fc043f3d0c7039cd58d86b73bd9d4e852d9f3a18a4db20d8e812
SHA512 7f0458c7d429c7c8bcfb1d1073233fc8d0495ae4fbf4e3da023e805c2fd144ba98d23149cd5303f6289617c1f119290734b7097eb32eb15592e5b4efbbd6c923

memory/2216-346-0x0000000140000000-0x0000000140241000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 8d6b5c4415ba5c070df357066661613e
SHA1 252099f210a7f2ff167512c1d062b2f98a7bbe1f
SHA256 753a461f8e587ceaee04c9f685383e2d463fb30f6779d796e84005518f4cfe21
SHA512 c2b078814e02af1725cb964463a31b4e748fc441a2320ca2ca14891c0d66585d52bc428d5e85882820ee174141d9bb51390fdcdda7d2defe5854db4e97a76812

memory/3748-357-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/1532-366-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 33555b1dd1834932a63891467da9677a
SHA1 746ecc103f2eff100492f2751595e69c70908673
SHA256 c2ed28b8a5c576499b244f27d6818aeef129b19e9f270755d334e429fe97d7b0
SHA512 c4a92e0f8201d63021636dbb071d6ee724562ab14c0c86693193ffd18b87a92b1374e1b6b0e11a0da6d9f1defb6f567c62e5bd57b978151bea6fc461a2bfc59d

memory/4532-369-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4532-381-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 22c0755f29f683d56c782e3bdd7a71e6
SHA1 7cf3b8c2b141f8ce5f26d64c2a200d8b9b23c909
SHA256 45dcd6746423ed73b0a39c73f5cd0de1e71a1a692862c05dbef01d7b82c8f552
SHA512 90998ed46e2f21fb61177e1ba9ce5df30de189f5bace7a28cb5675f811ff153d20c28b98f9c8ea73a758b94d86857fe891db5ccf1963e0f77f604b79ae96cfe9

memory/5104-384-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4572-383-0x0000000140000000-0x00000001401F8000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 45d31a313984f00ddb915b955928a937
SHA1 6bd32f7ad99cc364bb01df605e01aa0e326624bb
SHA256 40a2e1c93d2586b8103e3669987695ec4f079879971d34602a8e87ec3500e9bd
SHA512 d73948c0fa04d1bc4fb37f0feb3ab766ce1341ea9fb587c76a29578e3409171b06ac89082160dbf67bc52ac7f8cda27b748011e2493a34e527e7976f41124d1c

memory/644-395-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/940-396-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 47235873a96d1446f82cfb26f4028542
SHA1 692186131c87a2f880118591406b8d62b8103e1f
SHA256 78b0dbe3416cca15d94e2760c3325646af735451c2fd14b3ea240c2cf700be78
SHA512 22baafad2eac5d177ba817071a0e68b069eb3bf68691e04cbe96fe3522b92909eaee3e15722458bc98b86b7811416f22c436c6f6817422907e3f434373235424

memory/1260-407-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7b7e7edbf63be3e358bf327d9a5afe7f
SHA1 4cae032486ea2561dda58e2b8e369ff7fe29cd21
SHA256 5716d5f52b672bbeb8c73ee01d63caeed77b1e8b572af1e3c647f29cda9c1539
SHA512 05c3ad019da53ede03ef5b5119e2d06f71c354251008c8c3ed59ac7fb8254ec03ba7ccad5ce0bf11347d1e282a17fb0432499f1f474501e167b45535d08d43c3

memory/2152-418-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/3940-419-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 d0880748ba99d3c9b3e5ae71859f392f
SHA1 6e4006fa0532b1681c9864331655701675b8a360
SHA256 f71c0ef82fc00445b97d68aafb7926c4e22210a9b2ab6271c7894233d41911c2
SHA512 b7277486320b10ceaa74975bb5bf9734c220afc7f41746b408e5ddbd53aaeed1ffaad94c12b0ab84c313e22d9a92089ab66269b65b5adcfc77b13c3e6bb40d86

memory/4740-431-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1856-438-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 c00305e4f78dd92bb872496738454c5b
SHA1 5b0ab7df7897d2ca89fe876aad0375957cfca582
SHA256 053e67dd36590768f45b90ebce56d1ec1041fd57b82bf8167498f03c21232235
SHA512 655715c96d1f46bd1e0a0ed8ba6dc0b4fcd055f6fa0f0212d418875b2cbd78454b39a9a4bdc06ee66c77cba26e5b3eb3d8292ae4f999b371b8560e2937738f7b

C:\Program Files\7-Zip\7zFM.exe

MD5 212bd2ec5717c87e74c6f2c0cac622fd
SHA1 d5e627c9be150ff9089aa8b745c7c067582db187
SHA256 29f5a9d6a40966fec4814bcbe6e6e21163cef3cc998585278aab4171cc456d2e
SHA512 d5901e3e751e0365c0d9567fb85cb8971cc8df836dbe16be65227af3454295b0e5f3f081ae0b6893e5c234ce8436591ea810cd141a3d84267966909b9a6a24eb

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 6765e311c5966fa9f0b11bae33d6d7b0
SHA1 939d3e3445a08e3619dcf55bf15423d5ec3326a5
SHA256 b46f814dc9912639b5ad73fca305cb3826185355110011346f85bd813c3716eb
SHA512 67433850eb268cfcb0c0510348161a5f233380b8da407a76a0eef2620cbafc945d7ea155947f67a40361077a184ca7973a73e4158adbdb718e440aebd5d210c4

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d687b6dfb539cf5bd932b345c209c412
SHA1 eaadf01c94bfbfa5c851e4873f5dddeaebb11f08
SHA256 c10488abeb5306fc90d669413a45f4d9aab4b0490f9f5afb240e2a9db0eb1b24
SHA512 2f315db70705af6c0b7f1e8d75682640287d73a67c6183b2a717afd4c8e94eba19e9032f89325dcc44906de3290c40c286f661ea98b4eb8c2bb2fbfb53a00ec8

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 979867d935bd39517a04f71db0a72813
SHA1 2a2a58318f1041af5e1625fa7b5e17148b582d11
SHA256 6042c97672f3770baed584c46ebc1685babe2cb2850acf5edcd75521356942e4
SHA512 9ba5a005cf91985dce06db9a9e8913c7af51d59822a1a7717b18c9511a38263eceeb9a89628f34b4a5fc0466424d91c227428c9690430b65fd85d9bb0ef28c42

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 9452b12f46c23088ce0c3f603db30428
SHA1 03c03ced34abc4fbd9a4cfa377b8a72a73150e8a
SHA256 1a5ede9697f01796233f8f364d509e55c59840322fd2b7687c1ea2ec1b3ebfc8
SHA512 dbd90b318a7d0bc3ddacfc8ace669c10258650433401ca0b0a30cab14a98608ff4627790fc35b6179b717c87fdbe13961bf336b694c9b54a36ad8c489f00e0a1

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 74a9576a0550dc00ba547943ba101436
SHA1 e7eca3c3fbdcb28288836d846e6b9ad606f4e0f5
SHA256 e6fe8192360efc08b7ba1d4f740bfa68159f846f30a0071490e2d279a1bfc070
SHA512 03fa2f51a3fbc8fe5c03f63b9c92081d344b896d90ee928dd1951919a15650dbbda28bfda9a5ecfba61132873daeb2ada5988bc95589a1a6e882e240a5da1117

C:\Program Files\7-Zip\Uninstall.exe

MD5 0655b85ae983324383f1a9d670d507e4
SHA1 265cd6b0af4d226e34d5327d36971ff762e85706
SHA256 5311f313b1263ed4d941a89a5ee8777fbdae8dd6af5e0fd93aedfceaaa0d71d3
SHA512 b17fd71beb8a52854ebbe5412388e351c90d77455454301441b49133891a5270d11413d15926c9e913e87e358a13176848cab18057205499c1331ad0a379dee1

C:\Program Files\7-Zip\7zG.exe

MD5 f8e2ec8955a4a834ac66bdd5a876ded3
SHA1 999a66debc74951925f3b2314f5ae4bab6ebece8
SHA256 5ac89a04138d8424d5332a7929f778b2626c0bb31dfe43d2a610a28d33cd8998
SHA512 26639aa73b4996fb99f7ce2e27bb65389c015ee69fe991f08b9016c807995b952c6e2c9a0842985c02659269cbde4d9f0da267109adc4816d035fc55622a5f38

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 8b3bd4a0504e93514783cbe8b662bc4b
SHA1 eb6b21b0abf24d60bbade4b076480e72353c605c
SHA256 1bdbd8f28533a2c0004b36d9fd7b209b8427a966efc585a68f3532f76e07765b
SHA512 c0e60f1128a3f2185ec54e98ed0d51cb159dc9540be14006176264869d6a1d16396cdbc4f3570d6544571e3062c1af86b8a214fafa939cb8b701ab8feaf356c9

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 f7890a42b659733fdeee3d211134278d
SHA1 a8f91d857f225edc54b36930b45f0a6fc288c62e
SHA256 0872eab40ecf7072291af70d4040558ad26ef0c1b67d48a880663be1b4ce2ed3
SHA512 15187a218aaada2e590c581a85658d35194269009c31ba896fdfb2063479d17e72cf01bc245b64b9c4e819893fece1ddcd86b5f8f7fa8c6fefffd7c48ccfa8cc

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 ab30a5c4bd529f6b69e40e09a3630ecd
SHA1 16c8750e2142271bc3aba8ae756cbbf86d89568f
SHA256 0ee3bfc07aff1cc911b8eeaa2bcecdf64e2db2d3ef4856438abccab861c5ef81
SHA512 8deae3ced03e1756c28beb3475b706764b3a4feb6fa572e83e21133d31eef5983e41670f3fb5cb748cee6b96d777c091a0b3156e05c033020485fd30b1906722

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 7f075c300c72f7c9b706f4cecf4f1b38
SHA1 5eb66b1a3d9e491ea92f4b8ac659e822d14bd97b
SHA256 fb58a810eae2f4faea6884e38bce460da8568fda83190235ffbd92e8ef019840
SHA512 a5d23f23a8c891bfdef8ac528fd2e2005d77feb9fc3ddce0c804c60e45da630e120ba2a2ec1d0398086bcfc11956b0a88c10598828e1eb76cde49fb2985a7446

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 06dc50b12f2fafae6cc5cc70a1b1c22b
SHA1 45d1ff09a148c0342c1e94c7770a210c2d18c0ec
SHA256 98357e641a40ba290c6c4bac3096bd5dddb9f702e57ec4a627369a7fc7db682d
SHA512 a22e4016ef5b53b3387d39e7d9e7541b029a8745ec7a57c814406102eea83945a3f28a1889c98f819b3e272accf9dcb1c4c141a6bb876399a8c21dc640cda358

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 253a241d40d7c6deca9c23c1397411e4
SHA1 0d567794ce501954144a89c10c9346a58ca61d88
SHA256 ccdc81fcd98e26884f4326c3889bd6a93650e45f15703943c0f26074a4e76c1d
SHA512 fa7833dce2e32667ab8c883801c14063ed3e288e08429125e7653afb60fe8a97c6d54731490a1a80a87082906135cfa5c768a3327ed2bc7975f56c8a5168f204

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 d6e5f39c3aaefeba3e9959605645c5c2
SHA1 d4f6cd6e01a3d8b36e088f93e870ffa9d32e69bd
SHA256 02de15663600613e2aaf300e372b2d91af64e612da81ae1f78b86b9d457b660a
SHA512 0133a12ae376d6de12bbcd21bf2f7c7681626f3365291cdb0bdae159afbfaf53acec3128a2521dc968407565bd4ef856051dcab6d1aeb6f1fbd28738414ae4bf

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 80a7a91ab4600b6c66d33080f113f09c
SHA1 d4c84de3c4f4a5e2e22075db555fe890bea823bf
SHA256 8bd62698e543ced2516077708467e1b1255c156a258d877129d13be81104177a
SHA512 6e433352abdf0cc08fb19209241065d7be238c4f5d31e2bbb71395824eba95eb5000428333006becb6788f180754de4e62c5e7b16b6001b356f7cb25015b9ae6

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 bac453847b4f72c8f67d758305faba78
SHA1 9c569aa71a58618547d95cc7bff4e6adb5ee5042
SHA256 febde1fe6310c76bdc7be53cee02f4acdc6a365e853a3111ba0aaa5809ac38b6
SHA512 972a0ab09e2d1b648f98fa4baee0451d4b3d0c7954f47ff94ac211cd65f0d1a04a19e5a3ba83065c9d6cc3c3353a22c56a2dae3a839a6e900f31e2e7ef6d6c72

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 d4cc9d2ee396f33ed891bd9bfac1aa83
SHA1 64b174c003ca3b6794f304b7d94cb600be8ef2d6
SHA256 c02abb901e2060f556f166cc11302111c56a5f5222d0763f5dedfeb245fa559a
SHA512 22552c077c7a0fab82580dfb1b9a57001f602e6bcaaa779925088f3aeb2c835982ca1b36f3efa779d979e26638112ce88257d0958e14f2b0cbc35e2c835fc309

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 659b97cde8113b717e406b24397771c0
SHA1 c68635d03b6fc11bf43fdaf9d89bb5de24788f0b
SHA256 e3f950f5b20d938c1472611835e8063ff40d14f140660a1af52cd975fee55780
SHA512 f4b82512b6d68eafa3a584aa379191f4feedc93ff62dd9fda5d49721ad01cb3b7728fa4f8db6fcac02530767633d9ae09c5f714e8022692c0b05258d79ab7e63

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 c633f1ae14cdffdecd4c0925b7ec5acb
SHA1 c51480e29a5c28eb4596d3f6cc2f6961f9619f40
SHA256 49bd875872dede2cb6253f30f0449fe6c99e132d01f4538dac937d36da53686b
SHA512 e8652f1e2374013613b6fe88f8b4c9993b997ea63ab9a1c45f46511224ef3352490c082d25d1497ffad48915a2472d1b0804e63b0dc66fb48103cb105e222124

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 ba740233a00e1a5b47aab11ace381398
SHA1 751c046de9e592064d4ca97abb4d2fcf1165a683
SHA256 4b9fc0c2a7af969ff1ee37452087ce3f995261eef67cd5fa505275143b413d8e
SHA512 0cd326f9ddf6a6203cb258479a71132001359618dd423f647415e37feb84d9f2ed803516c1fec73e851d80b9b97d50090d4c145c89dfffa0850cb2ce57c12105

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 6c74fd5790b220a70f24821da61d111e
SHA1 0e65cfbe5a7a5cdc6f11aa9e893ba208e0bf8720
SHA256 6a6b01cb1645617c7b6bc932862d34fa6152cc395d15e538214514a6572d1528
SHA512 08a746f8c9e967108023c62636f562b06d3785b80f1442223cd4b1210e3e57d12c0ac221bb6e97a8ac433ae442649857bf3b5b8c35ee65bce127bbb46b5ad75c

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 396777cc885a0fc2d769c047b615a64e
SHA1 54eae0a3a75566bd880598b3f2cbeb97133a2405
SHA256 d0bd69c90c99dfa7590be938eff0ee4f6045f24d9ac99cd4f1f1c3c404849da0
SHA512 99993332c56f6babab14538723f33c7021d6c352bcc6678b768723b3089dfb2b1b422045e6826bc9196cda7880ef8bf0ff2d1345658ca034e96ef3f36351b391

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 8310dcd9355ea2cdf455c1e5d5865cea
SHA1 e3f854d47b012191403ca74d50e58066e13ee09b
SHA256 a7611fa5ea6c1da37e848f7f66a42997d29b87684354ad68850d8edbe4463873
SHA512 f3839bc433304df5bc11087435cedcc0769a995e46eb3aa3acab54a56e08c7d3ae3e575bfd97704d72f29a8050d14170831853ad784833570c881aeb6fed36de

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 ab97ba0e23a988ff4063cae15eff72b7
SHA1 c818ae7c659d6c16f9fd030e0cb93fe6a32b2b62
SHA256 b8bb82e959d3d42ef116b4d6fe6d8fb8ac3b7bc8745e9e2ff4ef1fea26efb460
SHA512 2d75883503a15822de40638afa7a9e06bb369c991c84b4119934acfdd742e760d26c6fd6c95a147c7e1127a6c59529a879a42a8398af69809606287223e303af

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 cd6a827c0c143a01b276694a6de7f129
SHA1 2c994715ed08a2cd69ced1950e794e08a52e3817
SHA256 530978d704ed5673e4b2d23e402db4c280784cc3b2ca5ccad845542657dfd1e3
SHA512 d5a423157f62f9fe7b2ed86f4a512975159d4000b512e2feeff09e7d26ec4f1917d4ac7cbb7f963c0a851b77d1d4983c1cedc4716bb762e5cabbb541d07d1d4f

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 44dd3d8f317b2c627de1055af85a3314
SHA1 1efe0ca306f13b4f8b4e2e8d5c36ac9d37a28e9f
SHA256 a03f58ed3d3eaf51b1ffc230b9e89e8dbf37693de8a2603703e3ee2c007405f3
SHA512 5506be52b7a2e83a7bf7d41497ca9215c7492a61f1dd3fbdd5839decc93fea3832a9a8ce9985bca76a89b32cd2f0f544d51da0dd6b2f6d3af4eb78f932e50489

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 a86e06fbb1875aae28045299ccc852b9
SHA1 a3f5499caaffa5a38daa08f55116f082ff9c65e8
SHA256 a89335e23f36c610eecdc4236d2468ae28b4863b046f6a5845bf60a04d83f342
SHA512 76eba2f25de98c24790dbf025149b493c94f3a131c0ab4d685e621ed8d2e5f2b3330a8963bd085042c9910e778c410102c90a648778c6c5dc949724778894d34

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 17f2ed7e8ea6df53da6d3e65bdc0e0d3
SHA1 a82fa674f8d16b66e4280b73e52626e6a4457f03
SHA256 fa66dc16be43f103a5a744f93c3c3ea05173a4b009f8198b18cd5f425a05a298
SHA512 37f326f15c5921464c5200ee88dcb5167d8c2ac3a32fbdded9f9778f36fc6664ccd9b5d078ec190d95ca44ee7d2aee68f14749096ddc7e92c5393c543b25baa3

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 faba5f2b51eafba1d5b9ac96370983fc
SHA1 c8ad1093cbad28da025910b06dccec17cd7f6ec6
SHA256 723e300b7a1c7f1109212ec8abdf37c37597b861873722cf83390bc28ff830aa
SHA512 fc3af9dd30185ab79c92771512d5f081bcd779083a8e3df7052b51b882a7ee1c56cb2567dbe9a1500ff25d4265b31c902658ffbf1498c8d511ad6a181d32d6a4

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 7f86118155f6dd506c7e61739b7fd06b
SHA1 0fe5fff04a3a96e123055d02d54d56534e273ff5
SHA256 09b7607999797c86b5463cf79a8ddbad91229359045336688ad751b727194367
SHA512 5505fa98b3c314123697d6244833111faef9df58025e6e0845e00066757f3e7f8972431045553b2a2c02b8444948f1eb53b44627ef3055bfaa8ca61ce388b615

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 e01d29859cea786cf04ef2424a41ace0
SHA1 3997e1fc39394213421d2a7e88ccbe561274fe59
SHA256 dd72c48a68b835a8c6ab8646261b07d59d28355a9dd297dc8f41ca6fbcb382cd
SHA512 7831241e2b2ac21562c7342470096cba15c300d3ac6e817b9c00237607aec9c32da25b328c7278421cecefd0b0f6b549c9e6764580e700e578bb0037facec6b7

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 41910ce95e72d081a182fac6dda7a295
SHA1 2c1c83f343db81874199e854ae565e08a1507895
SHA256 5289436db0221181b950e0f4e6ceea38bee030455d442d07e1d6aab40d7fd174
SHA512 610ed6e6cb6ef33a5f11f756836c756f0144f81d4fac957da76be7dd3fe6c4455dbd3158220aa5d1395470f77d4c612ffcdea3f21e8c3fedabd2584da35b4cbd

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 0ce424247ea62e84252247e5e15267a8
SHA1 a455963561b79d423a7bf2e11c3168f843bc863f
SHA256 a209996419ae0ad799800ad877b68f6007ba2fc65e3dad18f6c12738884e5659
SHA512 177cd6eb8ae35503075c5ac1720c2609dfe14b6e60f296aab8701e8559d064de1698ea022ea01790b142b4a422c8b003e467e85ca7dcc1c294da04a13198ff54

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 8e2dccd92268de61da2e8357c4bd5f79
SHA1 7dd4835e5c9db4c7ef83462d00a9afdbed916f36
SHA256 b3241b06f0e17a6080d3d9ec445f6fae6973a241f71a831a1e57096ee7f595c4
SHA512 f2c370d7e0f862e11de3b4fe4f706a0a7c541ab7621ee45798c17058fb12a7542d1483abe44d98cd9caf3a2aed239308a72a4e0c8f8afd2dd7cb5a1bbfcf1bce

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 fac5a8f34896d6708b01568e944d40e8
SHA1 2e38f1d46a95ad16a13f04795e17d41b4ec8fd63
SHA256 f02605cb3bad04b93cd74074b19c24369709e40dff71cf6ddf1a377cbf6ac2d1
SHA512 254083184c16f014cedb231b2c2bb682004041632ba5daf0e814357f0eefd49e466abc5540655c7fa6ad5572a2debd7bc411926a2b0b0dd977975ee583f70c25

C:\Program Files\dotnet\dotnet.exe

MD5 42bfa2c08b14e9d15ac5d2086e05dfe3
SHA1 053f5d25b7a4c6b4c1720d132dc51f9445ec2273
SHA256 18c977ed526954b1cf93b0f20b39bcf1fcc0d2f2171d98e4071726300030ac34
SHA512 ee99902037f5e53e05795b8476ad79ab05221e984b508886f1245403909054db0fb24f93e4b50e16b573937ab40be41cfd65df675d7e3faeaf4479c596fdff39

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 a0ece0225676790baf034b0c7af162f0
SHA1 4dad4c13912f19ae64aeda1659884972a39383b1
SHA256 1a726b5a74f3815d0a41996c9584c1cd555490b07ac0cef2105ad645a9cc8b5d
SHA512 cbb450b98301b2e9d0b5f44b14d93b359e45a8746749651e808f74b811d8f9def40cd45af921ca6483e202d73615108c7dedd3f7f7d77084f48bd1c8570649ea

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 48cd15146c6db3df303bb310072c4e22
SHA1 888ce3db5b2285eeed67cde2e4263cfdd5dcc265
SHA256 4fb1343ea89fda3d51bcfd73f04ed95e866f9b3dc47b25a640a76aebbbe9cd5e
SHA512 709407d4f519d2e55805c54d4c82e1ff2dacfd4ccf3a1bcd473f4156f8da063f9fdb0a18fced29909e83c7be97e0a27dc399f7dd0c2eec84071e1766200f04e6

memory/5024-551-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/1056-584-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4740-587-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2216-588-0x0000000140000000-0x0000000140241000-memory.dmp

memory/1532-589-0x0000000140000000-0x0000000140221000-memory.dmp

memory/5104-592-0x0000000140000000-0x0000000140147000-memory.dmp

memory/940-593-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1260-594-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3940-595-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1856-596-0x0000000140000000-0x0000000140179000-memory.dmp