Malware Analysis Report

2024-11-30 06:37

Sample ID 240612-wg1ayaxgkr
Target 2024-06-12_a814541e7d38db549918848f7716df15_ryuk
SHA256 78ecf86f97332973ed7cbb37b92619273e7f6aeb9df17653b9f033604fe3cb37
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

78ecf86f97332973ed7cbb37b92619273e7f6aeb9df17653b9f033604fe3cb37

Threat Level: Shows suspicious behavior

The file 2024-06-12_a814541e7d38db549918848f7716df15_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 17:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 17:54

Reported

2024-06-12 17:56

Platform

win7-20240611-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe"

Network

N/A

Files

memory/2448-0-0x0000000140000000-0x000000014010E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 17:54

Reported

2024-06-12 17:56

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ea13811e293b476c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e50b7bef1bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000918004bef1bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079fd05bff1bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006df519bef1bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c9ec5bef1bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_a814541e7d38db549918848f7716df15_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/3196-0-0x0000000140000000-0x000000014010E000-memory.dmp

memory/3196-8-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/3196-1-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/3196-14-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/3196-13-0x0000000140000000-0x000000014010E000-memory.dmp

memory/2664-16-0x0000000000700000-0x0000000000760000-memory.dmp

memory/2664-24-0x0000000000700000-0x0000000000760000-memory.dmp

memory/2664-23-0x0000000000700000-0x0000000000760000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 eb183d9054e097c15959fa6103684f88
SHA1 02ea847a33ac3c490a9ab842d85590e6785b139d
SHA256 1b464f200dbac82b3cc66088920e2be2f99bbdd18b556f609db84fcfcff611ff
SHA512 09af95369dedfb5bf75fae7243c32af6a8a233f6b5f300ed4d41c0e078dc648187d2bc2e5ea12d39a2ac63678bef003cf0a0555116e7ec5528168d0978d7ecc9

memory/744-35-0x0000000000510000-0x0000000000570000-memory.dmp

memory/744-29-0x0000000000510000-0x0000000000570000-memory.dmp

memory/744-37-0x0000000140000000-0x000000014024B000-memory.dmp

memory/2664-22-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\alg.exe

MD5 a0345710307282eb3bfbfdeb02f88955
SHA1 9a402ffdf9b908b085e7671c0749c50b5af888ec
SHA256 28e56dd4369e3e61f8f5c93535851011bf6c1848dd04a6b16ede0725cab21523
SHA512 1be980d18134e3269f4e05665b1c11e158f24e250af6019b6543c6397615e3f5f02e0062ebe0e9af45340f7fb61fad76326701e995e072000ba8f8c488f8ee6b

memory/3984-40-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3984-49-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3984-48-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 0dbe3304e22741cbca0ce7d4a62d4cf0
SHA1 caab42f97ff2c42911c3ccdcb7e44846bf292335
SHA256 55810917869f92f01dc262739a8052be29a2b54d653e8ff3ae4acf486351cab1
SHA512 299ffb668e367cf8836877e5c500be609c1792add416d2573fa3e117205131efab7188b0648c601b2f9b0696763a716a3fc99bd006e42a5df90dc34737efb282

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 396a0b6eef757fcec3ebd008ee72924b
SHA1 22f0e1c91103e5297501a73c72bf8b66a5b61723
SHA256 21b7256e5f8b218b0d9f30e2bbb791a6ab69196b284ca9bb15b8710f4a3aa282
SHA512 d752561d1f481101f181ef8672c1e4a1bd1c153c6f29ee484d00e752e9bb4141cc1f2b81e07f25d1af7ada3cab744769cea53ab3f07e500a22d793d45d2b0684

memory/1572-52-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1572-53-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/1572-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/1572-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 97ccc06d91991c3a99badebdbabb1d58
SHA1 6d752684fc2afef0d6ff8a0570d17af4332dd699
SHA256 a8b7c53f1435e41e39c76211cb840c25da3b63e1cf444d321b6b0352213864c0
SHA512 462f2a88daa181eeccd86fef16da2ec20fb663b8b0ca4594498fa3974d45713f8ab91eb5fd3e39d778ddc0a572bbdd5a3f27a7e3f2737a414c7389275ed1ce30

memory/5100-74-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/5100-76-0x0000000000420000-0x0000000000480000-memory.dmp

memory/5100-68-0x0000000000420000-0x0000000000480000-memory.dmp

memory/1572-67-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/2664-235-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/744-236-0x0000000140000000-0x000000014024B000-memory.dmp

memory/3984-239-0x0000000140000000-0x000000014022B000-memory.dmp

memory/5100-240-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 cf9461264c4c4cb40defdb8b0efd7716
SHA1 dcc55002387a387ffb54212b7b735a5d6d34dc73
SHA256 9cf5bd8ba8361b42b2d0be75382257766a1013f8f088979db311c1f50cd73443
SHA512 39db00d1233103b317aa57346e411c5de3e0ae7eacd8e420ba3753c6dfa411408d762435d815d5e639b5e1d931518f397fe6f514662b096dd31a09cd9f681c47

memory/5116-245-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/5116-246-0x0000000000720000-0x0000000000780000-memory.dmp

memory/5116-252-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 fd57c25e8d8f0ab8258e4c3eabeddce5
SHA1 de9082acf295d27832766bef60af341e9cacf207
SHA256 086080b8a5769f217830ff14c796fe30527a93452efca4cb3e92e99601ade6c1
SHA512 890744c0b09925e0e3f1a82d2d785716ff8f1cd3f3da707b43b6fde5462ef1a8c503966960d08c55dfd71b1733bbb149b971673492e51a4afa52061f1a281063

memory/2624-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2624-257-0x0000000000930000-0x0000000000990000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 a02b3050873e4f9b781914f5332003c8
SHA1 4ca5bbbdc7ee7a85d66d655dcd2e87b8f5c98dcd
SHA256 2cae7038d27b0a021311cb9b29fba9ca3e77025aeff412dce70a301d9333d788
SHA512 5a6b9591343fa0ad1e72a2ecf3939969d67af48a7465a9d2c5f22adfc43909c5f576e15cb89c9475007d6759d16aec73bd346789d656565460de1b63110f0e01

memory/2624-269-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4912-271-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 33d2e115ab6f538d6815e4f672a44bc3
SHA1 142e97383c413b5d8bae0639f831cc5cc7e83ce3
SHA256 3a278310236ad11493cbd892e6d1fe396bf6be59e9476705332bd47b3597f918
SHA512 e307017af4447f2dff15bc85919c60b65915cc050442a0e0eca19407d91309c07d6f5a34ac00bbf48447484f4349e1ad1a00833e7378f655a64f13263333670e

memory/732-283-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 3d2a17757a9f2c5a715c9bdeeb28293f
SHA1 e201093c65d61134f4cf5baed0c7790b534b2a92
SHA256 32043e6f4c7ca1b785242e4510b2cf3bf5539685b0618234bf4e4802f3e64bb5
SHA512 52b818de97fccdd2389da62d8c62093bc02e17c9bb80632973be53e5ef7ed4bc19289ff9d0e64159f53b8a8f393703f400b1fb2686567a905868295f5dea96f5

memory/2712-297-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 9a6a1e4f5081a1d5ffd21eb34db7ea08
SHA1 a37ed1ce6e8f569e6ed8ec21782e240fa82de7db
SHA256 3e208ba806f8e4538dfbb833709c66ba5818d9f84eed4055aca1ad0c99cd09c5
SHA512 98195526b23619ebbf2c15734b8435a3aabed56a2c60bbc3dd0ba1597b792eb37cdd7559db15d15a1d41193bdf44657502d3ea2e197d5e2891a9ff17d4d11c79

memory/1612-307-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 83a0a219c0fa896bee341aa3a147110e
SHA1 56433fca88b3a2cc6f6710a3e5339da0bb5f74f8
SHA256 625cc7409a1e25415954443cd333454fe71d22207394ba821540b7919d438d5a
SHA512 3cd453fd1d30263f6a8047b90f7bbda5de91ffe84d938091091a0a6bd34970487745ed9f9fbe46521262f200fcc6d4fd0b85509853bc20b8230ae4a894924a75

memory/2288-324-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 66992c36f3beb4a1def802213640f19d
SHA1 42b801b94c978b195c9dc64bb1a658075e641ea4
SHA256 f9788ee4b2a658db528fee0ef98e1250d4cf3298de1e136e26826e3ad8446b8f
SHA512 e478efc67a95c52a8c5c708804f5c4c20453c54b644d1df26f0042fa55f33fb7cf49867730bed8e08a7222b662b6a4f8d6dafbc61018d1294280a0ed69e3a5b3

memory/1460-338-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 cc583366667f7000718ff03b7e041503
SHA1 7f7f082a5f249313f7a2f6d66cd3da504c5703d4
SHA256 07d1b1f0ef97b6a678815cffc88531c4a6fb5419ad2fcf60b4901aa64fe2c973
SHA512 7a2ae7c624d47b789d297431a1f5116438286219b305bac301dea2c47a68e1147c11c35786d828d74904d4da90ecd96bd89ad667ba8ddb3721158ce1a57a7cb9

memory/5112-341-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 8bd29a73ec742d4477d9d31e2f4c7381
SHA1 58a58f920991e536f79a3bc9d21924f4266032d1
SHA256 83afaae6ff4fa84c260e9acd2f0dd904a5c83c22edf23229436a9a32fa613e8c
SHA512 b6b668de8d337e0b50b822a27393e18d5c383cbea22383d06de52061ba99073f352029529e133510cee565c85725373f6f4d90d321ad1bbf6d0d26362bda0487

memory/3804-352-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 277e8e4b1a5594f4235a40b305c920e3
SHA1 bb21f9ef9b59aebb527885e8e95c0fa087795e4c
SHA256 c1f0af202b8ce07cd96ebb42141e03514be901c79424972156db6823301b251c
SHA512 e2053935c235a2e35c2a74657c4b3ab0255d802603ba6a70b20394e54efc1cb2ff86b2072e3bee8b6e84b046fcbc30309f90f2b1f108b08808780a1e8d6ccb4b

memory/2128-365-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/5116-364-0x0000000140000000-0x00000001400A9000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 a9a8c715323f70cf30bd4fd670519876
SHA1 47ddbeb712388e1246cbe3b2b6da5641046b577a
SHA256 e177c44b8a99a38af157e2a119a7cbd6360d3bcdf77fc84d508a81e2ea1ea59c
SHA512 26edbdb075c946eee68e1dd446034c283af1296f549f4ca74b4028475ae4c2d58771a459dcab2c0eb811356f6adcc36541959681a5e2fe0a90ffe3cb45006337

memory/1492-376-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1492-387-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 92290e0595c9ac8596941f75b6a45d71
SHA1 1f2de6b9ae16964e9fb0fa73f412ecf232f3c3f1
SHA256 0a8b62501b1dd076c4ac5ed11c942e44c14eb7c71a05860c06e85b15eb7610d0
SHA512 71647278028b73096b76e9069747be361c3de14f86bfa9d433df27b2c30c510bf4a5afcf0c1c3b42603fa6ae6b46d3fd31578cdb3c0dce5ff7fc7483d9b89281

memory/4912-390-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4064-391-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 02d8dfe1d16a341d514cb7596d81c2c2
SHA1 5fbe2a0e1a2e6edfa69514a0b6e9e9a17c12bb54
SHA256 061ea9810f218122c891f77024cbb3aff580e562773752271c172f9c156dcd47
SHA512 a1ea543fb0b4206f941110d8b90315221f8275e61fd4bfbdb1a07433313806146b89e338d3f11e812b63e63ea61930bba9dde323935784c660b4a7399de0b79d

memory/732-402-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/2168-403-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 e0641dcd77ad65b9f6efdc6b4f230fad
SHA1 5d7edbd1902fe85957c9b787f2aeb983cb5acf5d
SHA256 2f3c15d7e56c5f83f42d8b64ffbf17cc649d9cc07f6ec4cbedb781790c83a94d
SHA512 b8df3af88c276dfebe055c57e3fb7890639a8105fb133fcc6b21922baa53a180d5e7202c62094a54174d2a0a4110939b9cc1e86191c012bf36c328fe1b8b82fa

memory/2712-414-0x0000000000400000-0x0000000000497000-memory.dmp

memory/3576-415-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 e5728635417ddeb29e9c49d313503e24
SHA1 d822aac213aae32f33329f71da76f81555bf2b68
SHA256 1d9388c0e2a40b1aa6b24f8495f1b3e4e2f277600374dcc09b0d3191473abb65
SHA512 149a5a5c4b8403a5af479f483acb6102354d252365d6ae21f60f0261780f2eeed047ed6949a3d4aaf072ecac0faa3b0f75296a930e551aba74362a9caab324a1

memory/928-427-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/1612-426-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 79bcfd0494befdbbd311b6701b7bd018
SHA1 12ec5d92f966e712e66176677af07a9c3f14a647
SHA256 028080dd22db367a262475f4a8765999c09173eeea8639b083c5c2e5343e2f16
SHA512 9663d585ee82c93a327764b4d9e20f453660e5052166c5b2b68ca1cb690a0eacbdf073887f31e06d5ce5d1eee3737fa36029f40c8c11102deae74cf78add8760

memory/2288-439-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2228-440-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Program Files\7-Zip\7zG.exe

MD5 8bdfd9373b56fc2c725cb60a6c6329a5
SHA1 5a031ae00da9a796f0d64a5b1fa471339e849b4f
SHA256 c1603a12b8279ed64b443a3b6406b9739f0c44b0b8324a3aba6b7c7c827c4e50
SHA512 d792c734fc64585a482d32cfe655e2e912d6e3f244eb168f5abef251409a9352ef464bd038e481e13946a22f181874327bd7fa7cb560083adbbf14b9d12bd1f1

C:\Program Files\7-Zip\7zFM.exe

MD5 4ffe9aa26db99d5e9eea99e2a3f9220b
SHA1 5d3fb838b41e0472ec14b2e73ca24340b64f048b
SHA256 16624a228c1b388ba4334abe24cca9b0e6f045b4e4da509102c4078fa32a8b91
SHA512 3f679cc7d6f884da449aef6ea037e5a3379e5c1cf721d39e5a046aeb00c46724e6633d4209f11a793289e066ab8bedac76fa676fc80473f5d2fa3638b7be5241

C:\Program Files\7-Zip\7z.exe

MD5 932030b1cdc369c50ee516814e48a404
SHA1 32640c214684ca9705f384b400f23dea5a2c401e
SHA256 7f9a3271296e6c5d9266f9ae7e6aa2c5b8d8f637adf03c214ac9eb3d03838e30
SHA512 3468a25a0f2df538008cbabc58d3358149611bf883e1c4e22a487a3f4a7a29b27e97fa0f791dc024ccbe56ff1179d3653dea3b335c09a70aaf611e661227bdbc

C:\Program Files\7-Zip\Uninstall.exe

MD5 1f48bf100144297157a34665fae2408f
SHA1 c86c4f7ac50f3891728ed6c5716069924e56af12
SHA256 cfde186352831a139d114ca34fd1b330333968b71a45dc5ae6114888210aa7e3
SHA512 756a039cebd31050743b2d90a97671dfc3d726233596f7d9e5f3b4bd10fa8e870aec0b2855d780aa60610f1223f364c4836bc77b8978ca27f5f13fe0606143b0

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 bc8f255ca0e3d05605edd4000d593b2b
SHA1 2c8ae5d6ab87c81536255b99506f1156237a7ade
SHA256 11f87481d6de46df85edd4789a53db45237afdce3c3473fc7f0062270c2f4010
SHA512 874394f498984fd5850c35f4bf2310c497ca5814b26448612b10c75368a336a1c8cf6885a803ff53677247b1d3de17660786fbb00968292639236d4ce81cf9a2

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 17f0953cae3647ce5f097bc009ab2f7e
SHA1 328214b56d83f4c5139cbee6c4d62da3510d1d6f
SHA256 a05fa8c40548dc5854545255148bd61acaa2635e55f9e2b41a704136172b2dd2
SHA512 8213de991d6db9b930bf17ddf298c91e912a5bbb0e849a16af8d9311946894775e4ccab7788c6df7846375532caa7924ea139c2bb12014bfc9becb7a3410629e

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 9c29f04e8243efcd410638fe422b5940
SHA1 80207e45c2c1c7cbad2b1315534759cd311337eb
SHA256 869148a6bfcb6ae511aa4bd7680bd1fb94fc533796ab3ceae766c835515497ec
SHA512 eaf53163801a9d59f96a64612084258dc8e7da5c6790c3b89f56f9e4f7492368c1d42871d4c18beacfee2dd9996b0f21cb4a418e4155397492954c0de2c0be38

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 cda7db216cd3bf9aa8606d6a75b2b9c8
SHA1 d016b42867727fb3613c77abb53c6ba945912105
SHA256 b127c7a2180f10c88f01019ffbca9105e901e9089644cbe6bcfb93e5c41dcb84
SHA512 177e67fe0390444db76186d1217c2ea111ff23d51e0fa8795fd648c9a0fc210de15bf28fe3b61d96fe4f01f2a470b5030f367bb94b0e420a621624a8eac10e4f

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 3bb3c2d90292d9fdc4bf470d72f14396
SHA1 9a7ff1f29eaab5a2e04031389fe0603c1a49e228
SHA256 9cd729e8d607d6d10a8836282a3316e0bbe63d38716aaaff047610766999cf7f
SHA512 187fb8f6849982512bf07ffaa86ef6f3d59908842704a440c8e6b683dc5c5b47c364e1aa5e3f44a976a568413e6d0f2e421e3c9753f81dce9a4a0e74361d84a8

C:\Program Files\dotnet\dotnet.exe

MD5 2c3c32eb51ddcf3474a054ed5b64f1ff
SHA1 84c1e6f7caa61df38d8ff0607ec545c6af3db74b
SHA256 3cccfca9bf374cdb47a221924432a687f124ec7cf14d7851634bbed14302f5a0
SHA512 b8aead6bc19a9bd16b4540f10ac0ef880f29e54e191f5525dd785a6bddc6f864be919a292be7c9ec7d33ae287149193e8268a94347c8a53dcded338a2386707d

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 3213cfd974fd952e5f003c1c30e281a2
SHA1 a7d1dc7df07c0764c3b847e536f6325d57ba2199
SHA256 af5fd96e81929f28618e576f3b3cb8eb532896ea51b53e00aef7382e56747f08
SHA512 e047dee6599ddcc941d209468e9f202f085aa23bc48e027b799dadaa13ce7181488482f7b4b82269592cbddb21ac45a100a1dd33e54234698f807fb0abe6192c

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 cbddc4e4d7a8054075d908e579470cf4
SHA1 bcfdd24067235a54b533c8e99d5a137cd6ae1040
SHA256 007b18cd98d4983cd5c6b08555dac09934f94b1be9db8c008254d3fb5077ce66
SHA512 0f8a4a3a13f0612347c2a0d4b010a8a033c27e62bb91ffb866e5eb60af647c8efa540783b8d0f58e18fe599bfc815ee025138c7f133413f4447bf82fa460f26f

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 8270c53c27893dc3f3a37e62cc088ea4
SHA1 8f954f62d8618b04f6a2f297b7c1888a6f0cacde
SHA256 288ad8fb7e77e6d6fa0e3d0feac03cf8c166f12e2f5ad090943e07ef0233b2e5
SHA512 1daf81e2c8e933772760c6db7e598c1ff05e396c587fc82325ffc1bbb08eef495fdb042f73882e3ffd1777108e61417a2957e088830f6795397faee0a1fbc7de

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 15e62b253b81c7a40b6bbbbf845b08af
SHA1 d8c71e1244b971264ded4eac1aee32b0b4b81452
SHA256 b699600e90b781da6303992555567b4a0ad1781e245335815af3270a7d6b3c73
SHA512 4a3fb60ad90e58a4dd8f713df65970139a110cacd04908acb39544b8c630ded1d1d779c4ced460b68db426a191fe996423b479b670ff780b0ff637527e706cc1

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 faedac0713851b5eceda22216be24e56
SHA1 6d6a3be0dd0147a368b88a7bdc94596c9ae9fb08
SHA256 640dcbea40454ca0ab66464cd297b7cb46424ed99205687ea14c638703e0822a
SHA512 7f605fa152f8fc00dbf5c3600279a6a93fdc2a770f8dae3bc6db9f2cdbd2509455dc4e2f918bfbe9420d70a34c69fbea75f5b2622a1ee39ec00f135d65906510

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 cc1a9c12f33da77377156f306b29d494
SHA1 67d073210d61ef5463e7612173f24567a29d9310
SHA256 5953976ce766e6e87e2d1db0acd42c53cfb16fc4e95c24e2c69f2b009672504a
SHA512 d8bf8433a53ce0569269c3af5c25dcea6fd53c2aeb51464990157881a1226455e26dae9b62874f625293878d41579b2a413355e7149465ce8e5c11f1a96a5dd8

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 c788eaf2f455ebb1d86d1f2b0f2d9ee9
SHA1 2cdb6b80505d9340dffb6f0ea701540632806fd9
SHA256 4e78a70aaf7fb555a1a67576a7ea95eaad05a76c9289b68be9e4a1ba21e4d752
SHA512 c68f30fad8aaff1f78d3dcf4e27b46c99c3a2deb5b4aa04735c88a6ac7bbd2ba7bb64746a0647e4d69c87c769086ce9b3217f8ec1f51bda0267bed306872528d

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 98d012fc960383b681ede15b361df8a6
SHA1 b1101cebacc8411ac73c35deb601947c9f8b98e2
SHA256 ee9d03c04f8a290b002220176282a178d542a46aaa6d805230a2466c4ce9c0c7
SHA512 11aa16685e465acf2367c27df8ffbf7d01a46cfc99a1f8809b86d5f67433c3925200da164c87c04358858315ca149d2f3cfeeb179743b2eefc0a2754fb4f812e

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 b62b4071eb7aa707e843b43fa3ac7c73
SHA1 a2f56b690ff11693ad6525a9df993ec034661822
SHA256 57809e55d619200e4321f6d392f26b7d69d37028ba894d97ca56c6c6b2bf2dfe
SHA512 fca5db38847801dae0cc58712c0f26d39e85e6ad673fa68f9fda7a08fc6da6bbd51c076bd3dbd48251b34812da1af36aafc0f942ddb375ad7881843baa636c60

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 73f28d3642fe973bccb7650f89e0da5e
SHA1 21105fe8b1897af4e7eee20d8a69a67a7a6c5212
SHA256 009e8ff3f985e1352e40d689043a1c4514257abc69153e409878b4aeba384ba1
SHA512 9d8aa19c16ce7a14b858f16b9d8602dfeb5640b4b5a226063cc72483449d57c848f65eec8d3c71559faa43ed65dfe25491146720aeb337aa211dac01ab0d2349

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 ad190fa5c88c569b3d6129a47c30c43b
SHA1 99434492c2b477e3fdde01eb5cf6cac92cd3cbe3
SHA256 3dff79fd51345b1d51c8bde8bc36f065f55b459bf4789b3295a16118001d3c53
SHA512 51a62dee32536c05b577e6bbac3cfc05f77b766d868cabd110fe754d02f719ee9c948c11ccbdaaacaee97a67a9dbb821922d4278facfeadb86bbcd038d7515af

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 9a2e3716a18fda51e7193c1a92ed1db4
SHA1 4694e927e14b02f5e0044896e5812dcf5302ec29
SHA256 739e49abcd2ef8e86e19188ed4591c29b194343595d38e2f151f3f5efd1d1f63
SHA512 33aff75bf829c85c9122bc86046cb16bf5891cf712263e232573a2fb081724a1a023e43f5ca1fab0e1fe6dd398f3e5dafd528f52ddb8808457c5229bc23524f8

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 123f36841645f7a629de71ee5305e76e
SHA1 9f8dfba33bb5ebd11fc41022bd564b4c54c4d91c
SHA256 0b9c1daf782aa45e7b824b4871b1d4b8045a695c7d6312f157cf0a7d0f5fb3c5
SHA512 8e548bb8d62574bd3028f2cd95e6c36d107f100b3852fd3584fba2ce3c7b3aa408916d4eb0ac846db8b92cc05dc85fe4492a7a709d1f294de87af5a1b374ab7c

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 1b82c105279ed86cc763f62fb291b694
SHA1 40b24187549f021fc97e2666470f098db968ed90
SHA256 60f9e45e7036db56283439bea731760e5db69308bc9d1b763074a169af432889
SHA512 5797ed0f163a42cd44d5950fc08624b56b92ddb64a221291a06d3c5faef32289878ac5106277bad39b62acb3104d623edea4c7bb047adfbc25f7955aa18d0337

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 562fa1447722b3ec1cdfeb4664469d6d
SHA1 a0977cde7ea1f400462abf8705eff7b0a85694ef
SHA256 de23a34f062b247828aad51781b2c6234ebb7cbd9f02143587f47831ae6ad0f4
SHA512 2872d77e2e36a87fa0bbcb5a1f1c147b6cb4ae81e2b2055dce9486635497cfb5cc37ff26a1769035f727db8c5eb055f49eca01387cf8a44078c92394d68cf182

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 d4fbbd9e50d04c7d2361706b732fad2c
SHA1 8b4fdae0ca77b484d146389a75cd6c3aeb09de5f
SHA256 a24540b2ff106d95744e29278381e41922b2bfc2462b9b38fd982de12a84db87
SHA512 3eafd2dda715d76e0a1ef35dff231324cfce0c51ff8d10219dd6272432902e82ca7b793c41e02ed52de77843e073ff4500f0fa9df64941643dc4209a398ab411

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 408fc9d0606db3bcd5d2be4a2467fb06
SHA1 b0cda0a327123a2246892c1ef06f6593cb17afa7
SHA256 172453ae9f4aafab7a0ccdb1c8ef997fd41e192931b7890144ee81cfdbcbb1ec
SHA512 2d626d623c5c7b20b61a23b11b9c7f3263ced60b390518daacfb688ff67c10bb212e2713ca6bbbbf207b6ba976a05da732e8b9805f297f2f5ffd222628e42aaf

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 9a4ec9033997ec2417cb3550623fd19f
SHA1 921a1de1e12f2bcc86929d1200bc94dc932acddc
SHA256 f3c0bac050c21ec1b999d3dbc29e70cdafa53836303bac957d65251e50a7fca9
SHA512 122cc63a78dc53b3bd29138251b03c923abf24a753eba47a9efbdaeac771890eb1aa9b741d8684f1c667ccc3e332f94383c692a59fba0aaa38d82d574fbe5205

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 baf854ee4393ce2d30158bc420e1b3f0
SHA1 73b89665178b0d48484937081eba8f36dc00f16d
SHA256 3b025211af698a1c461d8f0983714ebe6f7e5fe24114665adc76c90361b24645
SHA512 7b869a46b4f2aaa55bdb69b9e1e1d3813e794bb7019d79e192b7f2412e8d936644ee8dfdac9504618fc71dec71710a49a0177aa3472fa325ea5e95361e2d6376

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 b174f1929ce1cb685f357aec6fc8ac0d
SHA1 1ed880c0a9ce1c90864c4cc7e5053b6b557bc934
SHA256 49464ad18c476bb7b644d2b5929a9cf19d90883804ff54a6b31d4394bdc49d13
SHA512 f051f26c6437a7e09c3d8b1a389ad20f04bc07609181aef288865c3a7dbb77696178671d37ec4c6c2182a50d0d4463d5efa3a333e1851643fb0c209b92d98e97

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 05328145d2cae861715f310c89e27a69
SHA1 68ea8092d6f9d7fffe291fb68a1db95f306876a1
SHA256 bd5db15889691efb9dc579539384274516b4218a7d247aed6820ff333c31dff9
SHA512 be6bce97b7c7f136bb934b7871de2f9e4af459883dca3f226f78cbe19ae7b90e23b9e97bbc76fa097a24921702cb1bc9b782e8816c53a87ee3dbaa3256d323ee

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 13e7ae70b032b4260a01c337d781fa31
SHA1 af7401d366cac4a4a9e27827d6f2c1d4f4651c91
SHA256 dfc349a443afde2965fae88ea885e0075f60e57dfc8d6bc4e367ff316d8c9a1e
SHA512 5aba85e43bde89e2d55a25d4832a10cecb3029328a633265095a6124ba49d698075da791fb9f69de3d06ecc1662a9782e8efab0db48cb2245314f3a5a820c1c6

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 1abb099844c3bc25bb0fbe8639194cbf
SHA1 51c55d417de8a8b0cd4afbc33b4a57e84c863c5a
SHA256 1c7fcb3177be3537724e5d006ebf1a993f183d0419e67bd39d78fc713553f3c6
SHA512 3e4d2c2551ee8c8d23a59b5cad7a2a10bd39ba1e4c70db5ac77914e203e999056d82d2a9e7cf24e9901965eb11052d325cd94da2f4eae78c2be4b0541df0ae16

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 442fb61a2300e14095553c5ee4dced7c
SHA1 68c196992f222876c41cf6e06013b42e2ba02d94
SHA256 439c7091caecbac006df552b421d266f1b66dfc836ad107ea5453487b054cfff
SHA512 f4f8ebedc89599ef70f2a173aaa2adf0e7eb6a3d6a23251db3c68cb67e85013b587cd9d75c698c036b433d3a7b475b969ae288aa4a060bdd8fddab80604ec01e

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 002376defd27f332e8ddfebf37d88761
SHA1 3581587882bfbdbd71b012c2e1bf485b99540587
SHA256 2f131b664d086ae0f1cb886c5bfa36a62c4f04a1d46fba446dd81c19c8e88ebe
SHA512 d5073454538a76509ccc7c98bc38f73a4fbfa42b21278015c54fd5481382db36c115ef50eb84bc3cda48994fffa612ce6543663a46b30e82f9559ed21b977eca

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 c69c6b9e2b253291cf14feb3472cf83d
SHA1 7e9fb684cb3e590a5290a4076be8d7357b084df4
SHA256 2fee67e197a33205d55e644378405d75e1d9c5501ef6ea8a81415e6c50f78ded
SHA512 6c21467b0695abcb6560cb93d51414def51aa51134d4102386170112524480e67762d4456ab1a5c35a5505def77697ba00db10801ceff9dbc0bef3ae589ea7f4

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 90b9a34daaf4e55a30d56fd2fe0b50ac
SHA1 b7f94d0a5eaac2b4baf3eec34ddc1c81f9aaf27d
SHA256 0c287319b0338dd7514e48ba9df9b0995e97c530937880528e98837ecb5ab59a
SHA512 2a0674a2709152e231500ea95b3b3b2af1e7d4aedb8af256af99aecc4be35bdc520b8566d7ccde810f5a80d92c66e3d337f2e0c118e83a3b863ebaee4ca13e27

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 af22469d57cfc3be5a8baa89fa757d3e
SHA1 c0203eff6be1b02a3965fabf84100255741bad14
SHA256 974d51afb038ca3c5edbdbf5554cd7bbee2c1c70e80bc466cf92877d1f80808b
SHA512 c2dc0f5d39998a33b0321e6c29758c1562e68ebcf7c15921b33f68d509a94d72fd63af2ef7177fe81fe2ece0239d26b665b942b00e1273994a1c2b968c5eeb41

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 03ef5ad8bea3ab4d703ad18c907cbc0d
SHA1 5b908e4c29204f43eed83d0e65d0fbb37b9c15c3
SHA256 c7e5c6a25f7adc24dbdeaca3602d412075f18968ccd63952c0770156d194d468
SHA512 bffd324bd72f934f327bb33ba34e3b21f0c0f83f712f02d4408d37e5434b62c085350888ccf8d18ca8e10b30b712ce5d3e4c7c0cebd1227a4f724df0bde18409

memory/1460-701-0x0000000140000000-0x0000000140096000-memory.dmp

memory/5112-704-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2288-707-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3804-708-0x0000000140000000-0x0000000140102000-memory.dmp

memory/2128-709-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4064-712-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2168-713-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3576-714-0x0000000140000000-0x0000000140216000-memory.dmp

memory/928-715-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/2228-717-0x0000000140000000-0x0000000140179000-memory.dmp