Malware Analysis Report

2024-11-30 06:33

Sample ID 240612-vyjh3ssgqa
Target 2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk
SHA256 1c26c687ccdbde8c02baeb66170ec22edf6af78e6b9b8a470ea72f21f4c7e36a
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

1c26c687ccdbde8c02baeb66170ec22edf6af78e6b9b8a470ea72f21f4c7e36a

Threat Level: Shows suspicious behavior

The file 2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Checks processor information in registry

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 17:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 17:23

Reported

2024-06-12 17:26

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ef2c02c5b4b1389a.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008a78784edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cb7d884edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071371584edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6466684edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7d31284edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0a2e484edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce0e0e84edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2220284edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c499f883edbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_ee4a7ab67fa5f4196bcd03cedecabd75_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/4384-9-0x00000000020E0000-0x0000000002140000-memory.dmp

memory/4384-0-0x00000000020E0000-0x0000000002140000-memory.dmp

memory/4384-8-0x0000000140000000-0x00000001401F0000-memory.dmp

C:\Windows\System32\alg.exe

MD5 9cf4e5ed263d2a15d54be75eb65ff373
SHA1 4dd880655c63e54efd92fa0b336a47d6e7fc7bb3
SHA256 2cf24290f36e26caca22e132b14df07dae70b288d74377c1d6519faf159b0513
SHA512 6da8b84913061f4deadd69cab3c1fb9abf8aec333aa619f905bf61e2dd4c1d19650b00d17ef3bd17f7bb3358d35c19583868d38851f8f4e43eeda620debd7726

memory/3888-13-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 77e1c081361d4722c7a71fd704ee77f1
SHA1 9ffefe7340dd4c5b3840131c26bf0430b883ee75
SHA256 db7363edd1d6d459b02a88a815377042e20e61ecc78917e504747391f59efaef
SHA512 3481ef42e3a12fbadc97bef9e2cb6e9a4dcbd059eb8f26d414c1e16e6a80f3bb6a81f5c9f9e663dcc1a91cf419b629d2969c58099ffa6bee60719d515492ee75

memory/1204-17-0x0000000000730000-0x0000000000790000-memory.dmp

memory/1204-26-0x0000000000730000-0x0000000000790000-memory.dmp

memory/1204-25-0x0000000140000000-0x00000001400A9000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 f9a9eb0346ea5e2273fc7940993e10fd
SHA1 ab96f02304e0d1c9810cd0868294a57ba7072aa8
SHA256 a4463f5bcc304a5ea52339d755fa21c22e4e6d1b19e31a4db4f4e204d3078009
SHA512 bf0f05c69f51b5e7014e4d1cfa5c03243a2f7806bd3c774ceb980b2e2a2993994ff2b0b7da4a6da7d89d9af2ef611980abf3928019002aa598658a61b8ae599b

C:\Windows\system32\fxssvc.exe

MD5 7d56434e9082a7f5090b57754853671c
SHA1 869482e7e9884add99b3ea64e26dc3cf3a64ce96
SHA256 870d4807f7ecf0e42eab0e2801002876369d1da46ceb39889674a3c7c7ea016d
SHA512 00b091eb1e833a213a9e1fe5288031cecc43eba45db55e726ae8d7af4f10f8d07e59037cd0bf5fee3daffa105cd29ccdb1e46cd6ac7ece1c919617d951c1c8da

memory/4384-33-0x0000000140000000-0x00000001401F0000-memory.dmp

memory/3620-35-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3620-36-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 44bd93c188cdb5bfdb967b75ec3e72fa
SHA1 dcd79ddc951c5e49149849d44c3607597d39eec9
SHA256 f7428354f4699aac6e51f4a957638bdbcc8159b59fee6e4ae5509d721a9cb2b8
SHA512 ecac5baa00c48b30c5e9d1ef09123336b92759dbc1faaa9e084819e2c4c511ffcbbb54e8b353b34f2b37c19ddf739d277d4fc18148abd95d43793018b0f1cfbd

memory/1940-46-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1940-39-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1940-40-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 1af6c4a7134c6d2cebfa072fead10b26
SHA1 f1e89f88bd3b38f807151eb14fde10cd03f926ec
SHA256 f7770cea89185ac47a0d8ee87adede516d7b8f778bf1a0071ed37cb586650784
SHA512 1aee190c275d7a88d96d7ba9e7fe55e31f645d8f23477d15d75a19579acfb1a7956000a79b69e0741b8bd8c9b92b148340f7ab4b8ee719a67622349b0dc62904

memory/3140-57-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3000-63-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/3000-68-0x0000000001A60000-0x0000000001AC0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 e8c0397d9e50f4a3c0adc721bdf0b231
SHA1 b67e4c968057789f28016a46ab9e9a4c338d1754
SHA256 95fb843596029695084240177bc8d7dcaa4b72a2f5bd0eb30f7f9dad2e5301a6
SHA512 e7a3cf53afbeecb321b1058e1736a86491b46a568bf1c2071c242628b78de162eea6ce1b7a6aa1f70128a09d322d7ef473c3d59ba3122e5f2867b5237b832de8

memory/3000-73-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/2928-83-0x0000000000850000-0x00000000008B0000-memory.dmp

memory/2928-77-0x0000000000850000-0x00000000008B0000-memory.dmp

memory/3000-76-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2928-75-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3000-61-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 e0bdc6a08f0fd2e8114a476f5d192fe2
SHA1 855ebfa829cf8763a62ad4468e77608aa5088059
SHA256 1ab73b09e26f45122a0120934ed5810f19bfe528ef6880bbc5c2f93b71776134
SHA512 df33fa48b04e8a9dc2e1b2a522db23f1be97a41767d3f2ef6337d87acff82dd4219c6f11d82f7abd92ce12aa6db21f2995cc5860f458f08bf3acc87026e2e594

memory/3140-56-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3140-50-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3888-243-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1940-246-0x0000000140000000-0x000000014024B000-memory.dmp

memory/3140-247-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2928-248-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 e8fb183900f3bca7e0c950c4849d3769
SHA1 000099b04d2fc50eded377e6ba70090cd1d67a08
SHA256 31cc037a7bf9ff56e0cdeaa75c2f2e229999b54e95e57042a145ce4311700bbd
SHA512 ab8f4ec907ef61ffdd3315eb89993d1dc31d428a2fcdd1b4b38a1adf8632af50d2a7d5831ad042ede19375e99f3d9ec6f5c4e20c61222bca17db16b76e96f85f

memory/1972-254-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 4cb86a2398b91973b190c0070a1b5667
SHA1 c37186c9df337cf60ec45b02e151ea1a9b4c7d99
SHA256 a8de1644d872706022984bec233d7e3b13eb5ff86baeccacd4c6322d66aec0ca
SHA512 80f4e2f8ee51ad6acf3941d381aa62799cb8c3c9c637db648098067fd1248e562ea948e33d31279540d172c77a7a66b10ada60a49612bb4c956c7c2a29fb4d9d

memory/4060-264-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4060-258-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/4060-265-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 69140aafe1db07ce68c8800a470c38ce
SHA1 d7e41ccd245c710a508fdead4fb8ae6205a0d16f
SHA256 4a8d90947d4cea8b5d4ee251c8340f5bf5902786efe41c606c526d74cbbd7d1a
SHA512 125deb0448554325fd5a1c9ebf747a40eb5a0cfd466740e534b7209166e569a7f732c625bc87794aae88cd15c8bc5e1618eaa9edb2b55b7428250a9a00d52535

memory/2712-272-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2712-273-0x00000000007D0000-0x0000000000837000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 86d79ff7351587ebd07959e876496e4f
SHA1 382e721dc7dfdb33986a5a2f44b43b161cca9622
SHA256 2cfac6c2e3cc34503191bf39fd5552da76c69c1852fa2043a2f5d25b9698d0bb
SHA512 d02355d14739252004d84e896bdcb8d5199752a845e8816f608003df730243176595b1ec436eb704af70b8b6209f7d9707c5d10d17498121c5340cfdfbfcb17c

memory/3448-282-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 e2fb2433eb1bc2518d771c22d9bd6b71
SHA1 5501a698318b70f4750059270540dced428da5ef
SHA256 82c5c0ab5c069c73c6a83041827f88237eafb6c164c3b56e0267f133fe009dc0
SHA512 efdc3aaf0e29b659a289545ba461f5464f0ec4b25c49f7e87c8cab220f1ecfe9a279943819aa9f17f179518c78c467727f4c1a8a260bc69792f09edb564c47e8

memory/2956-286-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 07966075a74c678628807e8ce4111282
SHA1 7e48aba73041b7a95e438fad77c8327bda5a53d9
SHA256 04a9fcb1595b28cab6f9cc6a332afb0de4d361b6aa9841cb5480acdfbeffa8cd
SHA512 46f6ed9c45183c3f6ad3bdd41bb77004909032930e9b32e1ae7ec0369c0ef915ac3e9085f19f1e2942ba60cd4b7abdf848dcf1267bf21a17ec17faf8cbed4c37

memory/3180-289-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 36c14e8abaff2fdfa2bfa4dee670ef32
SHA1 a2ebbe4e927dc8af1b08a422c86ff7f2d367ba95
SHA256 c7427cd82670c7bd3752d21e8606c513a6c75c03b65550ce944055686a300728
SHA512 562a4b41e48869501364df11830d337637b32048da3c7799054b784544a076ca6e349876787e15e8b4fb8718e8752385b4f774ea8ba86c058cd36a7dec8cd43c

memory/4404-292-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 f5960fdba26e28d20d32df78eac3c8b8
SHA1 64660d5a9743b1a922ced4689656c888b8184ec6
SHA256 2d3c707223c7b752ff39f3394cce46b4040b8b9c5b141f5f0df46ac26064016c
SHA512 666081882d98667553135b40812efeaf0902cc6709f068d65e009b40bdbf1e9cb30fb06971f2469ba81e3447ae8bcaf1bfe05850f0f0dc020d386819707baf46

memory/4432-304-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 594830e2512c51f3c48d01077f4e3729
SHA1 096bb132dde26990deb594689ee9d875a2f6db92
SHA256 658de2a225e97f27f87adb70fb4fdb11da7e4c457996240d330103dbac587bba
SHA512 266229aa2730ac024916b48780fcd90fa4deaaa850f65e02d360e18a8de126b5de4f9e53bcf8004ddc76c92bd21fdcdb22f893f0dca8093ec4cc7485586a224f

memory/1812-315-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 b245d3d309072e189b8878daf00f8f59
SHA1 cc41cce915fd3cd2146dfa2a5fe9b66a9271842c
SHA256 75935a21fb40f55e24717e2d98cff712069a4b360b5c4f056f7009ceb1bac9ce
SHA512 d09dcc8a22a5339641a4aa1301c4d1e99c75a4ea042cf1e58b7cfe212644e622227224fcbd5920b2ae7e64fd79b6713e0766dd662c5747c63e91c183c94ffbe8

memory/3216-318-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3216-319-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 486a60980d75b1e5de64322164015d16
SHA1 7f1e33a33066137c4e6983fad1c2fe8b53ebeffd
SHA256 b0fd73d324a1a7579c244db239e38cd8c8b8e393b439c1d3fff36f3f3e41c11d
SHA512 51cc7f29a37923752a62747647eb4a0ee8c63d967cfe18aa4862ca60f4ef74f352840650320c0c5779a6e222f8512e3c486fa72632b883aa025d2f99b6bcce73

memory/4876-323-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1972-322-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 5ead135595101852618a2d1289b81a36
SHA1 3692f66aa066d453686c5cbc782489d6c1119903
SHA256 b81fe041af427a1ed6d2eb73a77a66f9fedd8c782973c931d3677b85c0f9d110
SHA512 e81ef0a262689c34ed8ada7c687a1a465b34c258a30efb9fac4148034b759ea9e0042c6a79262e1839344adde3f57a4b1b6f07284d9b6ada7db5808e0c2d2848

memory/4060-326-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/684-327-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 2ed4f8d6513ea1ea259a7ff484fc4ee6
SHA1 34d1f7b42769f20b1ef86ee876588ae087f48bcf
SHA256 39b919849c9dd306328c7fcddb0d5e0fef4a7244724bfb40538d936fdae3831d
SHA512 699658d8dc9e35e3cf0ff7671a847acbd7301084b504a165a03534dfb68523b03660a73971e5e74f5feb6994513ead7d072acfee91e8e48cf1eceb5af8d1f170

memory/2704-331-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2712-330-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 fe9e638ae65d23cd27f6cf78514c1c4f
SHA1 b920e76527ecc3fd356e711fd971f283ff581d5c
SHA256 f34765a7a83a44bb7a6decc57114f26094c8108cac1cfd0372a41cefccabb115
SHA512 3bd39a7b5c1477b94416b3f5f6d6a542f77cc4ee15aee6a33757b88dd04f7d413aed44ea16a13ac6b5b673c690eac9437c1ebdc6cb0c3441fdb0827c621a2764

memory/3448-334-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4884-335-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 1a6f6995004837b16c310d49dd6fab1d
SHA1 65b914a2af3871302b0b30f90578a53bbfe80f84
SHA256 ba496b8ed7c1263ec9b5cbd77341211c937c09e6ec981b2514f1929a53495cbe
SHA512 2d7cb6efbea027091fedeeab3f57625799e0627516473ac1ac0a3d1a4a2b78463f67e9bf9df236972195820d98dcc0698ee6ae3387dbdffa27df959d8a71f22d

memory/2468-340-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2956-339-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 ae58bd777c61cfef7235e60e05e375f1
SHA1 4cb8e285199b716463626c8f4c3319f685596042
SHA256 78a485a9ffb221ea6e1dfcc892d7d1d40328ef96dc7e2987a58d6107c4462a22
SHA512 53dc7e83935d5cb135a975937292c14a01af439d6de4ca11ac20da182b8ad68a85f0561559fc527bac6f7fcdbfc28b3f99330a20ca1fddae2d18d27d786f9373

C:\Program Files\7-Zip\7zFM.exe

MD5 0a6dd70aa9bcb12a857baf21404d4476
SHA1 5ccfb294fc8fde76eb78f03b1cc504797e08c2a5
SHA256 6e7cd37c528ca56f8549ed921ac87ec329680854db9bfa731d611621f4d60daa
SHA512 a8a9ba98b25ecd276c438131ed549457cf8d5408fda60d26f0a6b23cdd3da35bfe3d3d2510124d0f1c6b802b7d455fdf47561b0bcc57a8a3610a1a6e0fdedc6b

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 d8f390927276bd58e266f0a03ba27f4b
SHA1 253aa2c64a902c91636e0df5e5f8b0fc33513e07
SHA256 30e6dd0559d68fbf24f5fe040031f84a29609271d6e87cc921949dbdee44c4b3
SHA512 04e47fc75a8086862b894d18d70b9b2f9f33a31e2eb494bb5b84641e8ef4d7292037579380ee038b8fdb8a0a3743b12966fffe224cbd73c4d54eddb8464217c0

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 45ac44581064d6cd11f0524b13431963
SHA1 76937558de86e9bcaef70655e45b6c8a8e5266ac
SHA256 03921bee5271edaa5070447f710bd3515f2919bb986b9551257eb07aadee141f
SHA512 99abc1bb7726e62debc84ee85fc07e9eb0dc6c3ee488e7fafe6421918e119cfc8dbc9c7291813ccfead6c73fff6c246c7edd8c9b4df1df89a2dcb2ea687287ff

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 b3739995c02081da27912a1a253486b1
SHA1 924212f4bc12cd5e4f1bfe96e162de72c3b723d2
SHA256 80146ab92811920d976466da1b5e0172891ee2f08ac67ec3501c8fc1370c7d43
SHA512 593c98c6c3bcb17090f8a1b89a387a9f176997a10a50acccacfcf48bbf3622197699e2ce1816d2ad66689dc091fe18607239b58a9efad39b67606da2ca51327f

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 44a477601e52d2c499bdcae9691acbaa
SHA1 937fdf89aa0cac386386055065b23baaa5e8819f
SHA256 0758440796187f92d59e1a6d07fcf273ef11462082a492bdb8d2338da085cdd2
SHA512 4cdef9279e65b86195da0ccadaf7a923745739341970b98c76c396d7d9bc6c5a82239b0662f0d4201e5098ef3f0e2f05fb2d25a311efd148293574479ce35460

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 2a030ea009f218b3e93f6ba534a56d85
SHA1 58442de2ecdba021681623aa6a8cc62b0280b256
SHA256 fd5e25bf089f877946a4bf6fc85512a0b55ddbe1d39f81d7b4bb49c4544292d6
SHA512 4494510793e262a298ee411e4fbcfe47171e626705bdf394b8ee65e31c453e7ca8707e2d64c2dea098c8ceb494528688c741f10063a42f1ac2dcf457418f0377

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 eba66ceda5b330a1d17f69d50b972efb
SHA1 a50840a44b2b79832f3f75120484f46487cdb226
SHA256 d613c9eb98d26b5e7cc324c69fc66490d239ece28757c1512762df20aac5c9cc
SHA512 e855fdb382cfe7b35464fbfad5814b40d3d59b1ab7860d2792d5284be9ba68279224098662983fdf26cbc33d063d892421259b688afb05db797e0669f04a5a8d

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 45c3516ec65e7b1902b77ccd603c01d2
SHA1 754ac3bf963e89cf3b32490203d777681082951e
SHA256 c4432de669e2e8d6d9c57d0286a0b8d5d6fb31748fc09ec3cce6c59eccedbf5f
SHA512 60bc65468729de79839c8f5140f6f4252c9835e5ed36c5cf4b09a1b1f6eae72540ed5ba99e3e6cb5ecdc1ffe1dc6ed0cd325a8a391321bf455660e532f6a50b1

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 731f79feb5855abdec04f7aa3cbdab04
SHA1 7b3162dfd8fe693d1baa5a7f9fb3588762388397
SHA256 b8d36718a1e7247c9e393703053e3f15220375b450d6f1e9efa9d608d3abcd87
SHA512 bbc103d5a393f9222a3c7b0029bbc088c4cc35decbe21812315919b1a8e8666cd7fc6e0ea500d6c9b63e267ef4ec8139ddac0ca2018856b452802e5185cdf4a4

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 95e153c6598841333448cb6aaf40fff4
SHA1 afda066dbb8ab1e30a4839f2a4291c761daea5d4
SHA256 997e9d44bc40257f3586449c0962b718bd9857aa4263729ce41255a16e63bd57
SHA512 d76aff0877eaa25dfdb927d55d0391dac916b27be5767ca6bcb716f26b79a599e5e7edb8aec17801e934445ea910bc5b42ad2c0e62a7235bb5608836c21de9c7

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 ab66540903927a71e910646dd5c614d2
SHA1 f24df7452dc2c10d06d7d8630b845d801d5796a2
SHA256 d522eef6b7abb095abfbd7968ce83babae92d182543871f1fbb2e632e2ca3c75
SHA512 62e18474cef4f8bbd503f88429e71c0977da042781f65623283c6762c645082d2b8cad938076b68630e0dea2779485be295ab95990c3beb0517acf6d031304a5

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 47a17e31c5ee9ff1d90f81af127e7557
SHA1 ab7a572a236a940061522909c35f37eae1a488d4
SHA256 14d87459c83e32d915a4403df3b42fc067fdcb450e913a6b30639eaefb8fdffb
SHA512 967d2031861f074c8ed8650039d8ab228808e6568fd1625a7e0d9730e6e510c12aadd09127f9bb1cc3d9bbbef6de5078e61950c43f4cdbc9cb756c4b35d2540c

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 a6d5189abd7c083fad3b39af744b5afc
SHA1 2aedc27bae6e3e25ba2b2cb1e7870bfc6fdadf34
SHA256 f524767a04c7bb7a05982dd5b374ca4ac345baeeff1af08b85650c3c96d9180d
SHA512 99e5fec0869ed3b2540555ce5af3c5f98dc6789fb15564886d7814352cb7f1ff07640b18e2b9794fd42af1b94db199e435f9b5db8e18febfdf9d680c362d2277

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 31d96bc7e99b137739bdde13d9c0701a
SHA1 e72930084a93956accc2f72ab45903dc5ce04686
SHA256 7c6780e5f0f297dc58e0d50b76e9b0a08b57abbceea2ac3ac27136cbb17caf38
SHA512 4a505cb8e866c74ee1ef4176f0309544bcbc657f80a0b880c33a0a92e04bbe29efead36ee61403d046350d02a5e0487d35bdbe0483304756d95548c83f9b76ff

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 efe442dc915af69b74d0b2430e82d6cd
SHA1 83b3882001a301e21b72fff1a3fac7bdb203ec76
SHA256 07006a3851bb3f7e7453340c5d8910756fd762743c1cae6d1acc0d36bf968618
SHA512 e6e4fba402f8509282f6b7dad25eb1381c38987b7b36ec6c36310869f7b0658d44ad4913042358356ba81567743efab77ee183127a2da75d35c2972cec4d4fa7

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 46f192dc9914f56ff7805038412dbeeb
SHA1 25f2b87e8844f26685d3963963407772262e2ec4
SHA256 162b23b1546de51c0695e08f8969b9faf2d9c1c483126b89a5d79103bac3b8a2
SHA512 b0f19410e3a9cdd74001dce3187adce172caccf670c7d45c5eec829050bbf2dafe92f6cd240ee0193b5d1055ce9dcea82473035bd5728c4688d0f7a691df7e3b

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 9797d6fb330ef0ba11f1004d7a545503
SHA1 5a4c519f5ffd3afc41a90e4e98da32e17c7ba3bf
SHA256 4d939df99fc17851af35354d17b25fd1bb1c2dfa4d06d0e3d24f1d5a11bbb3aa
SHA512 9856882ce1ec89b76593fef7e25f93adc5d9f94eb3acca91eb70218176e67bcf875e18ea51902dfc67562a5bd0298fb517355be75ba62fa68ec8df94ca74a14f

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 fbab3901481a9b3a7db10143d3dce612
SHA1 8d323d3665c266504371739f7f9fa725f611cfc1
SHA256 4dbe84042b8aa9ed7668ad81236933d3acab28a573da405c74ab632278a12ca8
SHA512 2c03639dbb88dc092036258a5d4b53df87682f5c03e01845e52d4bba8ad8573bdef96d873cc2ee77b4823e8fa9475a2f5e303b62c9bdb91e09ece19fd9d43047

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 0eb1aff0e9e8ecdbb46a7f7b91466a54
SHA1 edd9e79c22ad2915164632d7658b88501228dc77
SHA256 896b6c701c667c19704272a2880c1f0d1592e427e6094bb294767007912b6919
SHA512 ccc82a6d7703c9f95b3fe47ac1e303e1b60f3cd4fed737beedbe66813b8c12ba4e240e58dc9babfa6a1054b339035e39fa9c01535353454a37fc7a9f5538550c

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 b35d658c70c7809f7d3edaeb597cc25e
SHA1 054c015eeb87fe32cde1e68283d1a037bad6815d
SHA256 b48cd8493e2766a9348770a986c01cb2d710257d0ba01290424818cc448f9580
SHA512 f921c34f511de2dd82e5b308352f97d1ae2f42cc7130aff2c3dbb09a778596e8b158b93236472b76327b050b009901f1651e51c8794bd093416a331b1b40d1c7

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 cbb560b25d4b89bfe0b1259dfba30913
SHA1 1baf93042aca4fba1f4de84a9dc3598da51f41c3
SHA256 8b4d363ef55e03169826c369a192d0dc1699ba716511d0a3b78acfd54a16c5ba
SHA512 f22cdfbd32026d365317a5b5e0ae2c430bd49a2c5ea3271f3c76d8538ff55ffcfbf868b75d3cb8cd1b11138c014c0dba79b80595988de5375e29347e85d3c575

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 8d0d681095f0685b59bd859d267fa30d
SHA1 c230dbba483ee4331e035a1b64a5e2f2503198f6
SHA256 3c14173b8f4a7e1e633b6552641b686fe8f0929af4de97c65225649c6066446a
SHA512 0183213f933deecdefd4c2e3fff95c5ab63a0d2fa767f36734d62588417ad0f39d36fd2cba382051671546c313c82716bae4820ab6a650b3fd8e55ecb2e09218

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 35abfc05c560f0647c91639162453f30
SHA1 56c842156053099c61e032c66b580f8bf4cff8e5
SHA256 d5f2a808eff08d95ce3a7901ced53ff0775adeb7470a51038f3e23cafc78a5ae
SHA512 a4f4cf745040de94c88a7ba0072a136148002e48275ab672f630d8cc672f997a1ee82cb4a13a7fcf11d80736a99999d8be88cffdf5f31badaab1fcc4d6496bb2

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 4f2a7308de028a0822983e8b25306ffc
SHA1 19523fd987acd34ed85ac31c9cd56b0b89f73de1
SHA256 4eba2ac1a0e2cdd7b099b3629558c71f3e80350bf7f7a4fd842df933391256a9
SHA512 7bb9693a0a70057548ac254de5403c96478850e465545e03fa82dc2667522740ff6d8f5ef96f15ac385209b36a02a6a28e043c92a42b8458a2494ff526b39c33

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 0fac7b5bcff00954d3ffffb3ecad8c08
SHA1 bb94cfaa00870f5b8b857e0c02a144190c3cf854
SHA256 c711af1b2f9bd5c8c289dd69e5cf508b8a0b257c176fa441cf78c2f2db3cd935
SHA512 ca0a0e217ca25b1e9dd389052b1e801e76143cebf1ae29b407fe7a5b66075c88a43a17d05e02c80082a8175ce670efed46c6158c12053ba937bdb8991fb11b8c

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 38dc3b987013645f0755a111dd134c1e
SHA1 fc57b9a33e8be8df085fe2f1454e229f6b983dd7
SHA256 e349aa3694364a9d60358a93500127fe193820fd9e7d0776e7d7c1da375d2f3d
SHA512 676b48387d33ca7f6d791246e61de0e08ce4cd99274bdb70e6c936052cf3770e43156ba982a83d9a0564444c410610a4b8c772504d3832e399347183b7599b31

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 24363d9ec211919519c21ef14da4297c
SHA1 a0c9efdc5a731c64e5bf40a6f00bfa06d6a08585
SHA256 22400d13d1cd4c7c6611c542067795a6f12476d7a961b67564122df6e9a301d8
SHA512 293bf8ec5204c93960a4263b325b5f26fd28088bad3b328f4fa6f82bb9dc10f815eb2a76d7f92b621431966f929287d59809bdd8a23112bb91f08e327166a1ab

C:\Program Files\dotnet\dotnet.exe

MD5 7f3bb17b700a47fe661adc37abf89165
SHA1 a0a32ed933b1e1f9bf7922e5c70c48627a56cccf
SHA256 2ce6d7473f4d25adca8cc0c32fe5a3c88ae3c40256466b9eb38e80b021d169b5
SHA512 4c0c5552482f798e9c5aeb0a7834baa040aabc255b88e9578c8565351f4a04fecc0299c254160fac05f5774b51a78c9f77da094bfe63e2396a1b8ed9233a2872

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 8f6d56a7d0fb70b2139548718859c59e
SHA1 60b77c3924b44f3e19c24ef23679d3cbd8a1936a
SHA256 8622810bdb615465b3c382abc67e1c0500a8c60be77648f1d5ce3ba45e865321
SHA512 dba9aaefb234e8b28260d448f8abc7430149d0ad7eacd96a007bfee0fdef239724f48a455be60ea53261163262a8d84803f74dfff28cf607ff35698685a943f6

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 e972f758ce9b343c6f85b1a15b08e84a
SHA1 1de55bbe76b01b676b8fca429cf44757e7840eb3
SHA256 cfb3e043fc4d0371233d7eb5144d3085fd51400f5ce60ba506b990dfe49023a3
SHA512 c634cea4153749ee78a83008e63e656dcf81edb033143d2a2b150bc452460c6d5716f71a8e5cc553cbd5d6d62be5e026224e31001dc3e50369a68c82e534a011

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 7ceb8f72b54f9fd35744773150b11763
SHA1 0d7cc9cb09c2a4fcc68c3b2450ddc41dad721a42
SHA256 9abdac30acff9506f6df7c6177380abf68a9ab11867da88c1c4d1799b33ff2bd
SHA512 2fce9971a0376c6d7342ff084b73e86523e6151a5a557f51f77c57dbabba09eb8324c4ea319f288e4be143d27716054608b723158c0773ceae4ba4d782379c99

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 7ff498a3a7b4a846ec19ca8f56fffa93
SHA1 1c7b8627afb6e40cb687ab49aeb2c8533e5564b0
SHA256 8646e59b3841ba170957f12e0fef95ac9354f898fd262bc246f250b2415adb27
SHA512 011c42b399e13b16da39c1c895afca848d2407f5fc97670d34df8bc8adcd88ce0dcc7f99d2b953ba034a1fc9d105fbbd8618e506a9c66c51f22addd6012d936f

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 c453b127b1557e2b86ccb22b021997ee
SHA1 8e873999b05ac50ab3aa45531d9abd8e046f97cf
SHA256 c94199b0f6ef72748198ee6cd5d9f2e4a2e45ef4bf7f2a1a572539d1449d1a13
SHA512 abcaf1446166b62f6cba4094a4100678c601c35ac2d7903b5f753d0de7d05586be793e9a05ab1b2f0017ebdca37010dd1c9f76a64cadee129ccdc01455953b62

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 547c761d144ff34e85aaed4b28ccd157
SHA1 969bf07c0240fa2177ab76cccc71be182fd749c3
SHA256 9fbda378905ddb15e44c649d225003533ddf6687098b29e0109e2152e7e708e7
SHA512 95b0ea5064a57e26a817625dc515b802b66c835d731e91f0542db415b4eba265c2264cc1cfa36ef7c7def1fda8a605a7cd1ffd3c884f978883db335a621f50ed

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 5bd63b40fc0b8e99137422edfb48400b
SHA1 6dfb8c6aa6b90c38e7cd5597a5ac49a8ebee9e84
SHA256 4921220a34631cf59e9f815e65c2bffe3da15124dafbe55faea3f1fae34f7af5
SHA512 d5ce0782f653fc9fc828d1466ebb519791c8314380a9efa098da035451d8ad1a53d4de1ad8eeadc57560a82dff3a6b14e120431ab9aa77c40f8ef83a58e4cb3e

C:\Program Files\7-Zip\Uninstall.exe

MD5 a4c4a800e3f467f4b83e8410706aaf30
SHA1 60230133a186b019cd6086057e15fce517772bd2
SHA256 0c40765eb7252582d1c427639aae2b95037f7f15337acb1b370983f06aff67f5
SHA512 1cf88550906d53e73433bde34ab289db34302a8001cb17d8c37d3923268655be9b4c0d75e6fea882a82ad7d314d0c0a81bbd6b67d103bf1a1be4c9369b1fba02

C:\Program Files\7-Zip\7zG.exe

MD5 832b0a3a7fcca2ad27c1ccf31677abcf
SHA1 1ab4020821715f74b92f4525e5d739ff78ee138a
SHA256 1042f3e3e50b9b1287eec3d63e89dd5141af0df49ea81c3354127bbfba4cc91a
SHA512 c13affee4981928c080ef3c6c872df56d3fea3be1079f83c2a4036d06584d4316d003ebb70974009da5a52c746b4aaa021105873b317edcb61df7cb9a8020dc5

memory/3180-447-0x0000000140000000-0x0000000140096000-memory.dmp

memory/4404-498-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2956-499-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4432-500-0x0000000140000000-0x0000000140102000-memory.dmp

memory/1812-501-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4876-504-0x0000000140000000-0x0000000140147000-memory.dmp

memory/684-505-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2704-506-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4884-507-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/2468-509-0x0000000140000000-0x0000000140179000-memory.dmp