Malware Analysis Report

2025-08-06 00:04

Sample ID 240223-njne6afg46
Target 2024-02-23_17512948ac977a49f9e8976a86873365_ryuk
SHA256 1260d3b23e47b2ce5d9445e8e00c90ce36630e8cd6db057f56be10a857fb6589
Tags
discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1260d3b23e47b2ce5d9445e8e00c90ce36630e8cd6db057f56be10a857fb6589

Threat Level: Known bad

The file 2024-02-23_17512948ac977a49f9e8976a86873365_ryuk was found to be: Known bad.

Malicious Activity Summary

discovery spyware stealer

Detects executables packed with SmartAssembly

Detects executables packed with Dotfuscator

Detects executables packed with Yano Obfuscator

Detects executables packed with Yano Obfuscator

Detects executables packed with Dotfuscator

Detects executables packed with SmartAssembly

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-23 11:25

Signatures

Detects executables packed with Dotfuscator

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables packed with Yano Obfuscator

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-23 11:25

Reported

2024-02-23 11:28

Platform

win7-20240221-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe"

Signatures

Detects executables packed with Dotfuscator

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with Yano Obfuscator

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\system32\SearchProtocolHost.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e3dc1126ae4ef42b.bin C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5457.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP645E.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP45D6.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5A41.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP69AB.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4CC9.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{54854102-1F8F-4A87-B3E2-57B83ACC48CF}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5EF2.tmp\Microsoft.Office.Tools.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0e5f93e4b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\speech\speechux\sapi.cpl,-5556 = "Dictate text and control your computer by voice." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588 = "Windows Easy Transfer" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\SoundRecorder.exe,-32790 = "Record sound and save it on your computer." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msra.exe,-100 = "Windows Remote Assistance" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000801ccd3a4b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Journal\Journal.exe,-3075 = "Create notes in your own handwriting. You can leave your notes in ink and search your handwriting or convert your notes to typed text." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\migwiz\wet.dll,-590 = "Transfers files and settings from one computer to another" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from windows and other programs." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-108 = "Penguins" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320 = "Connect to a Projector" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\syswow64\unregmp2.exe,-155 = "Play digital media including music, videos, CDs, and DVDs." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\OobeFldr.dll,-33057 = "Learn about Windows features and start using them." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\syncCenter.dll,-3001 = "Sync files between your computer and network folders" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10209 = "More Games from Microsoft" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\ehome\ehdrop.dll,-152 = "Microsoft Recorded TV Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-101 = "Windows PowerShell ISE" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\mip.exe,-292 = "Math Input Panel" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10055 = "FreeCell" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\ehome\ehres.dll,-116 = "Opens your home entertainment option for digital and on-demand media, including TV, movies, music and pictures." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-116 = "Kalimba" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10056 = "Hearts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10057 = "Minesweeper" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10055 = "FreeCell" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102 = "XPS Viewer" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-105 = "Koala" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2484 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2484 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 2304 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
PID 2304 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
PID 2304 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
PID 2304 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
PID 2304 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2304 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2304 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2304 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2304 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe"

\??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=100.282.200 --initial-client-data=0x198,0x19c,0x1a0,0x194,0x1a4,0x1402d1680,0x1402d1690,0x1402d16a0

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

\??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

"c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2484_HWEWRVITBBLVRQEX" --sandboxed-process-id=2 --init-done-notifier=548 --sandbox-mojo-pipe-token=12716142148990164446 --mojo-platform-channel-handle=516 --engine=2

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

\??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

"c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2484_HWEWRVITBBLVRQEX" --sandboxed-process-id=3 --init-done-notifier=808 --sandbox-mojo-pipe-token=14363932483825519225 --mojo-platform-channel-handle=804

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 24c -NGENProcess 254 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 244 -NGENProcess 258 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 25c -NGENProcess 254 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 248 -NGENProcess 23c -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 24c -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 234 -NGENProcess 260 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 26c -NGENProcess 23c -Pipe 268 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 1f0 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 248 -NGENProcess 234 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 270 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 270 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 26c -NGENProcess 280 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 284 -NGENProcess 278 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1f0 -NGENProcess 28c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 248 -NGENProcess 290 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 28c -NGENProcess 290 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 28c -NGENProcess 294 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1f0 -NGENProcess 290 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 1f0 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 25c -NGENProcess 284 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 1f0 -NGENProcess 2b0 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 240 -NGENProcess 248 -Pipe 24c -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 218 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 240 -NGENProcess 278 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 240 -NGENProcess 270 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 21c -NGENProcess 278 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 21c -NGENProcess 240 -Pipe 218 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 240 -NGENProcess 298 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 250 -NGENProcess 2b4 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 21c -NGENProcess 284 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 2ac -NGENProcess 2b4 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 298 -NGENProcess 2b4 -Pipe 2a8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 21c -NGENProcess 258 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 258 -NGENProcess 2b0 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 25c -NGENProcess 258 -Pipe 1c4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 258 -NGENProcess 21c -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 240 -NGENProcess 270 -Pipe 2b4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 284 -NGENProcess 270 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2b8 -NGENProcess 250 -Pipe 2ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 25c -NGENProcess 250 -Pipe 2bc -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 vcddkls.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 3.141.96.53:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 3.141.96.53:443 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 3.141.96.53:80 fwiwk.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 3.141.96.53:443 fwiwk.biz tcp
US 3.141.96.53:80 fwiwk.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 3.141.96.53:80 fwiwk.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 deoci.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 34.162.170.92:80 vyome.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
US 8.8.8.8:53 lejtdj.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vyome.biz udp
US 34.162.170.92:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 8.8.8.8:53 brsua.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
US 8.8.8.8:53 yhqqc.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 8.8.8.8:53 rynmcq.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ecxbwt.biz udp
US 104.198.2.251:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 34.162.170.92:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp

Files

memory/2484-0-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2484-2-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/2484-8-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2144-12-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/2144-18-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/2484-19-0x0000000002600000-0x000000000348C000-memory.dmp

memory/2144-21-0x0000000140000000-0x0000000140E8C000-memory.dmp

\Windows\System32\alg.exe

MD5 930af300922d5096cce292d9c6cab655
SHA1 9c488a007275a780d2219c58c7eeffcffbc705e8
SHA256 5437f218805d6cb53dd712b7f5175489b88b7f618d610ecdf0a46eb541d36d16
SHA512 8de5fd07af5336d11cf1b5e53b9a6e84a3be90650fd456e76dfa1ff2be78648333b3079e4fa39991fb346b7f616a67b07a712f3b0911521a53cc329ffccc466d

\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

MD5 e6e4c95a9b05f1d25dfb6f3df31ba7cc
SHA1 59f19700154df3ec28d0c5115383777e9b886cc3
SHA256 31cfb62645baa25cfd89408f28b12054176495e20f8a944ea977054f4e53134b
SHA512 97cfab3af46303a9cfab087d111999606153316eb22099ba33e5568fc6b3c3629359c3a9654216ba2a619e7efd2bfa4256bed40d760bc072624a5f4746599d56

memory/2560-28-0x0000000100000000-0x0000000100297000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 f7304a590273966b7b6bcc98e601dfb8
SHA1 ea3ec0e77919ef3c8fd11a1277829812aa08970c
SHA256 1f61edcfa59d2f863c3b7befb268d4cff826cec36befc38fc28b9e30181b0ca0
SHA512 fa8223c31017159db807ba912b52707285bab5efa20f0c2d9bb194fe1c5fc127bce8cf189461040c75975d984dc011915146d4e70565002e80b8cde6b2a0bd0d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 66791e863d086a0f6ec9ac8dc0995582
SHA1 4edbaba4dbf4fb64c927ef8395375e63f16f7b67
SHA256 a92a29b15f56531c9f31a4c952f902aff4111b593589eda5c40ef99a0a0f11c6
SHA512 1f311df6f0491c957cc5e775d4f3801908799da80e301b402b3959b7cafe4a35b45c751b551c87c2000a40b7784279bce6aab26a034532b453cd91dcbb076426

memory/2720-31-0x0000000140000000-0x0000000140290000-memory.dmp

memory/2720-32-0x0000000000310000-0x0000000000370000-memory.dmp

memory/2720-38-0x0000000000310000-0x0000000000370000-memory.dmp

memory/2484-57-0x0000000003040000-0x0000000003ECC000-memory.dmp

memory/2408-64-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/2408-58-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/2408-67-0x0000000140000000-0x0000000140E8C000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 ae7e52863d8cc7bfd8cee7b120907550
SHA1 5b20fe4b94b45bd95e122b1a052247a19f08cd2c
SHA256 5ffa7d9d02a1599b727f8fe92e0e6d19000d9a50de527b1461fefb7fdb07bf9b
SHA512 a7f1ecce70f63dbcfa403beeb6965835bb4b0f98ed923f0d1e4f088c7b7fc777b47c276f7f5492febf07955f50a706c6b24c3968afa2cb44ef94d96148648948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 9d518d753b9678e0721dc16b80bb962c
SHA1 e8e1ee57cbf3ddd32318e70f3474d6a611b8cd4e
SHA256 309d10b1a17eff9ae83b5ecfac9820e58ed1cb26b14ebe5b4813bc404e5edd58
SHA512 3d49c5284b69c43245c022b70a2624954c3027ea83b344dfdba06a719e884d624714f2babc3aec52ab786cd8804b9866926b53a691f927fcbe3b8c4e2c8ec1af

memory/1576-78-0x0000000010000000-0x0000000010292000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 3f7828587a961aca7567e1f233da6ded
SHA1 8df8036865776052b81b1aa256c600cafdd4f3b6
SHA256 8ca04ec6bf4f3d324ec77165422f187e133105de87e269698620521916b19edb
SHA512 38d3e0a42c311caf0c4a277e744abd155b89ba3476a6ff03b6b13ba650224a4ce0d236fdc2fbfc86a3f9359818484b16e5dda7ff350441169bd6122a76b15b26

memory/1576-82-0x0000000010000000-0x0000000010292000-memory.dmp

\Users\Admin\AppData\Local\Temp\edls_64.dll

MD5 065322740e91a223e07b018fb57c3e9c
SHA1 b0beb24a37cbe46111446eba01e1641df545943f
SHA256 0f03d30655da31770278a634f70d9151700e6b06339ea57db5ead33acd4a3125
SHA512 def8127ebce7465d447412f936e12ba69e0b3543b5eff2ee786c9dc87249589565de007b906b3afba674bdeb73b52be571ac266182cea550049cb99617750bf2

\Users\Admin\AppData\Local\Temp\em003_64.dll

MD5 0de13ac073daf8b1aa1083f272ff3df4
SHA1 bd4d342254a6d0199c6af4ab56f4b88cd268b4b6
SHA256 a5342cada87366ba13d79fa1e58ca4af68887e6bf10e164a9b1ce35ea12b87f1
SHA512 5fd5e660e4e06dd72b3f1f2f4f89c0f4013eb415f889c685b2b232a71b057b38003ac2335b484aa8c62b9392c96f959dee728506082143b503798a83a9527111

\Users\Admin\AppData\Local\Temp\em004_64.dll

MD5 8ade19fbba084cf416d1fa2fb59e193f
SHA1 afb9b7329ad29e37914948ff915c2ff72dedd8b0
SHA256 3c8aa0fc8c579edb516d9ac1cc55f7d2a7f820eff72e55190e3a7714967fa581
SHA512 73f3b151d97057287cc4f32df624a5f3a322621353ce34172c2aa895304cbfe501e6f021fc329e77cbe3bd2e940f24a03ffc39c5943ccb125edbcd16c4e9fe40

\Users\Admin\AppData\Local\Temp\em002_64.dll

MD5 9e114800a96210f0a0275c3cb77d2f36
SHA1 d10b990a840cb092a6fe71a548d7681d8f9b93e6
SHA256 9bc1746976378db6eb459b670b61caaad03f4be78109eedc6f9ebd1fe64b759f
SHA512 74f49f74f53eb12b1c282ee216ff194e33c425f1aa4a96b4c53d59c2b1036b7981630ef7c0b1cd192ae514f16f8f7185abb378e72317c33044ddf578255682bc

\Users\Admin\AppData\Local\Temp\em001_64.dll

MD5 d4e6f08c4ab4e19aa199bb4a36e4b147
SHA1 f86d177d0bb8ae1241329dcfac0b096ae67b32d4
SHA256 44e66de7e37c20a537f80e3675d88ecb05d03318abddf4834017847907a0e153
SHA512 8ae2e7e5127bed745005fdef803aeb3626619a08a9d5027ae2331688d3009b19fcb66e74503ac2ce298a277d7b49f63246fc67fe6107f54c1dc3b4a643896485

\Users\Admin\AppData\Local\Temp\em000_64.dll

MD5 d0cf72186dbaea05c5a5bf6594225fc3
SHA1 0e69efd78dc1124122dd8b752be92cb1cbc067a1
SHA256 225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907
SHA512 8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

\Users\Admin\AppData\Local\Temp\em005_64.dll

MD5 aac2061cefd3c7b357c73da18697b8ab
SHA1 ad79a732e63f6bbf8295a96453bd14ddcbdcfb29
SHA256 ba3c3a8f449f5478ed1c37c183969fa401174c19401b9d73d67edfce7a3f711b
SHA512 9b202389b1cbbaa873f3930300e88dd28e90e03d684c3cddb6c312d8438b02eebe3a780187975c476b9465cd93fa35844d2ca8e664381ce1dc7ec051e00bc585

\??\c:\users\admin\appdata\local\temp\em003_64.dll

MD5 dbd0b0d05a1f751ae46da8084c030126
SHA1 f17cc9c28ce7cff87984d6d1e3dd9731841d54dd
SHA256 dc1748db073a0bb128a335a024e3663f2f98634f6f4e6860dce1075e9d4e0da3
SHA512 64c8c3d016f85b4ce1125b0a1c6de5d809706f95e05ad266361b03c7ddfa08c6f63407dc4833eb6a572958c6d70e1b4ff1d01c1a747266a16f3b0004e7e51380

\??\c:\users\admin\appdata\local\temp\em001_64.dll

MD5 d222ab81ed320a76477a62b03e0a4db4
SHA1 7aac6c305348c88a5f610ce06d5de0312be04ecb
SHA256 418e7fb7e0a06852f38a06924bfba52cbab07498e9a2ad55243bceee8cf069c6
SHA512 70f1f62649c5600966c274d53751e38b05321514262fbb26780351be1fb6d9c02ea4354d66a8306649b9f5afad3a480bbfcc6bdf8ff55bf4625c94d01430cefd

\??\c:\users\admin\appdata\local\temp\em004_64.dll

MD5 f9aecc8545f2566a0b8176f7c8319179
SHA1 4d3b83fd68ac58308c647908086af5cd2d0ac687
SHA256 8fe424f1d82b67c4cab87eed37b00503e04643efd78a26f9de13f635ca6e53e6
SHA512 88dbc6b25e1646928acab4110ea3d0ae5b8f5c3acd4151a979c6da512be1dbd50a2d5faeda79c741c8072dc0e949342cac267e3f5acef2d689d09cc4491c34f9

\??\c:\users\admin\appdata\local\temp\em002_64.dll

MD5 d4672115d8156d024d545ffbb223aea3
SHA1 7888462c92c7a0f622736364e265bc1ce3eafecc
SHA256 f6e41b65ee68a7877d84913f5e28042dd8f1937e887bbfe4b7f838c3a0a4fa19
SHA512 a5d73a73cecc8880b4dc18305567bc70f87f84f8fdc458605a8f103d7dab297b87b2a6fd63484cf4bea349d4d1ea2788523838d468e0e017ab6577b5a3b61aaa

memory/2484-115-0x0000000140000000-0x0000000140E8C000-memory.dmp

\??\c:\users\admin\appdata\local\temp\em005_64.dll

MD5 6bf0bf84f77523afa7a4c7fb95dde422
SHA1 1bfb7c686b7dcf25d5f5e1418394691fe5592469
SHA256 eb64973bf8bb31e29652deaeb3ee4caebb55eae3506fe3769eb66f657f736d46
SHA512 3149907681d92858e1cfadb8e3d34872ac67586a491c8fae1a7dbd443d5a194fde1b0ce16c9103ecd8edd04e6b34b8e5712ad9143ced2627797513ca53517577

C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log

MD5 e845e9c0f45337615b3a91025b983254
SHA1 96055e02d82cd40ac167baeccb65dc70258a5a6b
SHA256 2d5ffee072a6f552f493d7307890892c1d197fbeca8024444bf304a45ee8a631
SHA512 c16b9be7cdd6d8e47572b77aca91fa34c9d27d78b4ac7f3afcd303b53d5095cde4232a14b6a969995cbbe5be112e247f27af63982aac6e90c1158638474b9d51

\??\pipe\crashpad_2484_HWEWRVITBBLVRQEX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2020-140-0x00000000008A0000-0x0000000000900000-memory.dmp

memory/2020-134-0x00000000008A0000-0x0000000000900000-memory.dmp

memory/2484-133-0x0000000002600000-0x000000000348C000-memory.dmp

memory/2020-144-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/2144-146-0x0000000140000000-0x0000000140E8C000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 1d5a0e49f89743009ca141c2717114d2
SHA1 a0cd9efc18ba35ac393934c3254a464b3e1fddf0
SHA256 db22b382bb84366f74a5084bb7c80e70dd53cc50893cf736c8e3159ed5a237c1
SHA512 e00cc71ac70318ba68d4322677db7bd6efc30dc40478c005340d4ad6a9e0925532403e5fd335feed225a5fbc39409d458ddcb0a697228721e675074fa24d3dcd

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 f72d5f8b88335e08dc080ad7bf4080ff
SHA1 98f4a04f31253173203cbf3160bb782d29a2a1ec
SHA256 96400a7d84db357f8924b50c51830ed2b5bb2a4d729f27ac6cf048b0d4b5f3d3
SHA512 2244a60110cf4b0f95f37ebc095d08aa05b38c367d424af8040422bd62716f6a02f88226126c5a5cd5de558cf342b8259df2e277129fb6af777f4090d0a0f373

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 d61fe9be6566d0d7e681e71eb30ba3b3
SHA1 8e5c99585ceca2111fdfe6e896058484e468c626
SHA256 1d946be823ce56cf219e83874173fbf1ab1acc31dc96b413670aadeb1f7ea731
SHA512 723da45b0ba0ad405a2fa647b9730b274a1924299e9fddecd169e4d6c66708a5cb308465127f5fa328c214e9b461af96baa91c294f7da80690f055c310ded6cc

memory/2324-153-0x0000000010000000-0x000000001029A000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 714e4e6324881eadb452917ad2d85e39
SHA1 285afcf9e8a3c44a84e261dc8aa4d4bad76bd5b2
SHA256 8c841f2b68399a26cf1762654459f8632360d115349b974abb78913d79310247
SHA512 d02b800d68ca400a228655fa7668e374b2e2105deb17e51605e9303d73d8c6871f25f250d1608e2f3bb37b306022fa5ede57799e7ac6b57b5b94da10808321f6

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 64066b472cea12e8d38a34f8049825ef
SHA1 7f9f5f0b597168573ab2b66ef86c0cd4f8fee4ad
SHA256 a2d6fdfc7e09edf7b61223236924f95bc15d48ceaf55b731a2c15fa0d54dd04c
SHA512 fe1cefab59fa2b9a92f592e7f6a292fc09082881f8c6163ff3207b94f38ceda63a14443ef20f2338fd7d3d1a49fca8a7d6acc713fe6e837a7e60563fbd0b2c40

memory/2560-161-0x0000000100000000-0x0000000100297000-memory.dmp

memory/2304-160-0x0000000000270000-0x00000000002D6000-memory.dmp

memory/2304-166-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2720-168-0x0000000140000000-0x0000000140290000-memory.dmp

memory/2304-167-0x0000000000270000-0x00000000002D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ec0088032bca3e0a9fdc83d0c0ac5ccd
SHA1 b63ff1163665a86daa22a907ab6952901e87f2a8
SHA256 ef4d4be7bb7a6f5bb422d5eadb242e620a2f640a2130eb46f504869c4fc8d213
SHA512 be88809629032e477ec59afaa2c25d9489226041acb0c9e4860057df7e561833af3284385a0bcd5aa761b690995a01f23a791c49a2bc0424a576060b85e1c4d4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 10330d33ffaa19a016544b326170e8d6
SHA1 bbc3f189d24dc57d22f0cb30d182e5e1aba2cb17
SHA256 7bc5ca8bc80047703bf391be244295fd3764eefa8061580113c712dfc56ea8df
SHA512 d096659217839e4e1ec8e73e15c2adc0b9a78b4f11dd925a77bfbe6b94d1403086e61aae523f9f7b3fc34ff21c1eee56ca3b803acca9e9a18264c0c358dd3526

memory/2776-176-0x00000000001F0000-0x0000000000250000-memory.dmp

memory/2776-181-0x0000000140000000-0x00000001402A1000-memory.dmp

memory/2776-183-0x00000000001F0000-0x0000000000250000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 436ad05564d2680ae332de8e49853f70
SHA1 ff5d063245ed5c1434cc2a4d92a18f3e9b00b5c8
SHA256 a8d43b2f205d71071e5cd6c5e2f5af574bb7bcb9ffd4f7c775616f3ef901a5b0
SHA512 f5f03d3145b1f98aa38cf70adeecb6574fcd270d26ebf485c062a32bc00b438d24f71b5d2d7eac900c22ff72a9e79f7f036d90f930a912a68e7af1ef6ee0eb27

memory/632-192-0x00000000001D0000-0x0000000000230000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 e7aba3172537b39829736ca6747aa634
SHA1 4bd54f2d3b4f092141e8eb32f0e97ab34e1c25b2
SHA256 9b2e154c2bce4e808d368add0ce4ff49dc0e776c9d2f500200ebf3656170b35b
SHA512 df149c8a955400b5b518c6aca354c48f0f8b1fdb5b611ba9460ea374ec2409643e07d819870d0ee2bb17ff068d2b16d64a9a59077d7eb1dde563cbf74dc528ec

\Windows\System32\dllhost.exe

MD5 62dacb577f5586cefbd43f2b7034fd6a
SHA1 13966a09f90dc1eb9938987d2335d4ef8c8712a0
SHA256 b4164d13be2a13ebe1fd2dd4e6f469b40d226ad71ccccfc39ad0f5b30cbd97a0
SHA512 0a3b3cb17f1226bec53a90bcb964cddda790f26476e8152e81d89ca9d2cb7be10c1ad125dce27757397baecaad31f638a1ca72db59215fe70963c4f32507f4ab

memory/632-198-0x00000000001D0000-0x0000000000230000-memory.dmp

memory/2408-199-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/632-201-0x0000000100000000-0x0000000100288000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 e03614622db2364058214fa22a9d34dd
SHA1 8e614fc59409f4c7da71383db238a3c45db357e3
SHA256 6cfe7dc311b1d6d59ed8af713871b92a676a3a5227a1957ac965cb9c17f2ad67
SHA512 1a1a7245869ad078530615c3ab617c5c66474bede3e4399220bbe11f958bf0b0315f89449053bb9aed40b7f21fb53a5ede93790694eb14a3ddccc50aea294ce4

C:\Windows\ehome\ehrecvr.exe

MD5 d63351016c2956d84d404c5b532b5917
SHA1 63bb01fe424d2b90f3767411b830d5f516ae8887
SHA256 b7b49356879aa2fd82835a81c6ee90277224fdf2bd56ed321ebdf8f8bfde6254
SHA512 10a918528587214fe72fda8ec5e226fbf91a367f21b4e01e1c24763bd3d4beeb5543feb4b8faa71a859506ad60851c0ffb6788cdbb8ec208d424a1e96e828dd3

memory/2484-207-0x0000000003710000-0x000000000459C000-memory.dmp

memory/2808-209-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2808-205-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2020-215-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/2808-216-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2808-219-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 3c8923c1dc5e412e30078f75d7450b56
SHA1 58ff78fe0c37d6989d5632adb158b3fcd195eb30
SHA256 cb453fc8763b47ffe7f72ac97d18fe75a784e6729c9163b7380fcf2003b05375
SHA512 1135f18b94ec5e62ad74feada08020faea9fe1b1eb09b2e7fdfca47f3bc63c466654432a6ae2b17d617d472778f9fd6401d58ce865a8aaee14c342996c355d1f

\Windows\ehome\ehsched.exe

MD5 27d0410971d87a2e2a879864d4477aae
SHA1 29368bebd5ba689c4d2f01ec83af90259527970a
SHA256 b1177b98ea52a430b7bd4ac4d66995a9451bce9e4604be9f5472aa24fedbeadc
SHA512 baa179bdf5a3e5198049082121e7f9ab8324b1b06481862115789617973ecfc996c31c70e86721379863490633c34ce4e0034558b6c7562cbf422fe238dc8241

memory/2304-223-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2208-227-0x0000000140000000-0x00000001402A5000-memory.dmp

memory/2208-232-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 647e99b01f0aa66b78a44ea041b634c4
SHA1 4ab6f49691a986d6eb8acacf874770d1f032fd65
SHA256 bff33546c92140758fc7b9f776a0ee893620794b034f11b90a638748b262a4e5
SHA512 35fc10b5a35f62af7187a3de07d80221f9285818580a5ef4e095af7bb7589d15534769701c472a677cd1a06799fa2f6389387446ba2672603ccbc825cfa1632d

memory/1624-238-0x000007FEF3C00000-0x000007FEF459D000-memory.dmp

memory/1624-240-0x0000000000C60000-0x0000000000CE0000-memory.dmp

memory/1624-243-0x000007FEF3C00000-0x000007FEF459D000-memory.dmp

memory/2776-246-0x0000000140000000-0x00000001402A1000-memory.dmp

memory/2548-248-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2548-249-0x0000000000C00000-0x0000000000C66000-memory.dmp

memory/2548-252-0x00000000748D0000-0x0000000074FBE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b036fb20d4c6f12ee600edfdeb941298
SHA1 64f112b68cf71c09bf5b7c83943c013bb6b444c9
SHA256 11cb053bde5c7bad37e4c9cb293b206ac52381df03b7519ec1389db1fd44898f
SHA512 1a9abde313c91852ea512b9edaa1bfd1efd2720eb534d8e5970c32df9233f82c0831be667dbdbcf092c1be717ea88fdcdc1d2bca82d7a3a131618c7408609532

memory/2828-256-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2548-262-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2828-260-0x0000000000230000-0x0000000000296000-memory.dmp

memory/2548-263-0x00000000748D0000-0x0000000074FBE000-memory.dmp

memory/2808-266-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2828-267-0x00000000748D0000-0x0000000074FBE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 7ae24620a5d6ff476f3c1b4beceeb861
SHA1 6e9be018a7970b4c9b2987c7c79aaef2f8ec9b12
SHA256 be6da8f50aab853b9cccf000fd8a0b261b6b7d91256eac43843b253dd0e8345a
SHA512 12f8ea342d428976a2e0bd5abe0e16f28077d4dd03db9687270ccc90c7477a6ba646afece7eea7c779a3b78dfa68930e765b6334c069200a45e9d1957d110a3f

memory/1180-272-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2808-276-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1180-279-0x00000000002A0000-0x0000000000306000-memory.dmp

memory/2208-282-0x0000000140000000-0x00000001402A5000-memory.dmp

memory/1624-281-0x0000000000C60000-0x0000000000CE0000-memory.dmp

memory/1624-283-0x000007FEF3C00000-0x000007FEF459D000-memory.dmp

memory/2828-284-0x00000000748D0000-0x0000000074FBE000-memory.dmp

memory/2828-285-0x0000000000400000-0x000000000069B000-memory.dmp

memory/1180-286-0x00000000748D0000-0x0000000074FBE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 380e545264fc0a0e1f29cc17b50542a2
SHA1 c8832702c7e9d2a276506b15efd17ec6b0a025ed
SHA256 5b79034c644588dbed5eb22ed0b788c6e8cfb85877d60d83dde39e37015a5445
SHA512 fcab87d48a94d10a12e34420a36f37a33ae11d7e762e072f67fed46d79a7ef5ba8ff9261115a068a0a0ccd636be91d38744f8e087fb669e3190bd7a32c20f5c1

memory/1624-293-0x0000000000C60000-0x0000000000CE0000-memory.dmp

memory/1624-298-0x000007FEF3C00000-0x000007FEF459D000-memory.dmp

memory/1180-301-0x00000000748D0000-0x0000000074FBE000-memory.dmp

memory/1180-302-0x0000000000400000-0x000000000069B000-memory.dmp

memory/1876-304-0x0000000000380000-0x00000000003E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 004484bbafa2431da936ae32e17237b8
SHA1 c92ae67d735ea84d7575c1ffb3ef9facbff21920
SHA256 c76e775d56a59a20bea5bf2ad73980ee1840128576e7ad9ac54ebd166b295d31
SHA512 416b9acc79679fdeabacc832029a8a8c22ac44d862e0dacaec4ad2a1aebf0f5468df84c3a565e91cb6d8ac852c5dc4c5e45ba39046bf32b2cfd8ff2aa5efaa8e

memory/1876-300-0x0000000000400000-0x000000000069B000-memory.dmp

memory/1876-311-0x00000000748D0000-0x0000000074FBE000-memory.dmp

memory/1624-314-0x0000000000C60000-0x0000000000CE0000-memory.dmp

memory/2812-315-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2812-319-0x0000000000240000-0x00000000002A6000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/1876-328-0x0000000000400000-0x000000000069B000-memory.dmp

memory/2812-329-0x00000000748D0000-0x0000000074FBE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 c5491a5981b27a5975376cf01005a965
SHA1 2acf49d1086fececf045cf0828c6d058ca90568b
SHA256 cb4fffdb4596d7be17873984b066c62c64054a593512b52571732a786df61984
SHA512 7ac0253be15a2f9575b671a028a9c5148199d57fc7126c34bfe7e0852742c81a6a7595f353b60f25196472aaef6b38c11bf4cb99ae27c7aeae37d0357575474c

memory/1792-335-0x0000000000400000-0x000000000069B000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 04ce5fe51839e33d1917b6e1ac20726c
SHA1 c045a8377cfdb84fef4f92dfc2ad3d777c0e8a3b
SHA256 1f3a748f291dc8979d0a696f6333dfbe5f116de6ce11120223f98b402f6088b9
SHA512 000aeec2148194d2ec13bf7c33fd7dbd1637b4ce6300862e8a2c04c00ff5ff4092feb70bf9f1b6c1aeee1c169097febc60c53a472ff21672cd2cfb52e45de241

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 021d1b687962d75f933aabdd3e076da0
SHA1 304beccc537cd8b2963bf1b87785ca34de0b42b0
SHA256 9c287c6ab8782302555ee6a7051e1269236aa9eacff6e946bdb23959f2b59118
SHA512 c5ae9d4eb2f721edd42a30b2272e511ed2a72c653ae5c554bb5cb3123084b178a45f2746fb104842f76b64af53e9d6d33e78bd18474ecd9c712f5ed367861d62

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 baba95d40068958cd15bb92e05d86247
SHA1 942285b098d0591b4c0d055d87be3405776a5a39
SHA256 c5269b2b57576f4fb3e89722e61e367ea4ac9a8fa7c08fc515260094a441c752
SHA512 a11b0c05f7574080b9edfe00b36ea1029ef7db3b7f03444688fa17693a6ef7764d8b6266ef87c4ddfe599de6a05398c6ffbfbb7d0b13e442e96d3be2c0c51a8d

\Windows\System32\ieetwcollector.exe

MD5 be7da5e028be26d20f783bf2a4369ef0
SHA1 7447d35c2829238ea15188aa80cf0922ad14d4b2
SHA256 bc6d2a5ac867e5ce2cdca5e7eb2deaa19d693332fe08363ab2012f850ee1afa7
SHA512 0492a0ade37d5ca379c09c5352b1cfb9e1e146baea70fe9aa9946ae18a177661dc75b25027dbc1b600ccad26645c1afcc33c64998bf4c2a293d9293eec9aa194

C:\Windows\System32\ieetwcollector.exe

MD5 9edd90e75d04dbfd64b9ca31d02d1564
SHA1 4356dec82b3ffd5c5f683511b9b73d1d73cd556f
SHA256 9a7533c166d817d580efb7c161e0c8bfeb27280ac1b3c59597171240030fb4b4
SHA512 54b350c77a979305c409f98857543ca215ff4dc0c2b624c5c539bf99b23ef32d591f6caadbc45be55b8793265b10f1c70234f35d649d894d72604d56fab40941

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 833872bdb7aaa41ca3e4544c9345b662
SHA1 c8f876e87bef1c780c27ce2b9258d7c6b5264039
SHA256 26d6b5a82d49e4c8c674b9bcad17d2905f3daae009f44bc2d280f60236abe0a1
SHA512 61a6c3c6a086912d8348aec03617dad79d2a033dba7b20b1479e539458076c9a53bc024030e7dc40666a4deebc2b5541f3ca724c531b8d2b784a4d3c99ae7cf7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 7af16ad7f66548682f7ea91f793b41ae
SHA1 c7f10982b5f38c2299dacd95890558df61597eb8
SHA256 8788541568bc94b33bd4dd48395f044e275ec7d863b748caa2ed17a66488f910
SHA512 05b332702f1097ee6c9fc7d630662a6c09a4eec8d94cc8ca0883e9ba13fd3d1d41e4d7de92a548f80f4bca7e77d525d6b6611da07c98b822bee0ca949ba38f5c

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 e4e8bd22f7cb41cb482ed6d096f5454a
SHA1 fd9e9fbb155380f3cebd918891f934e7e2b9939f
SHA256 4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7
SHA512 a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.000

MD5 7ca2da6f1e7bca562d7d9376700a912f
SHA1 67feaa004013eee76282e3b3fc196279f2577dcb
SHA256 04fd7654331261ff9ec331c31b238ba7770f082abfb817d7881813ec02084a4e
SHA512 4f2f67dee86af03dae15145649f5eb65cd158686381d26005b91aab89f017b692289050f0b1def00f8c2e724aedba4025db0baa6b55f76d402ded8006c48b38d

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

MD5 8c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1 b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512 825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

MD5 4f40997b51420653706cb0958086cd2d
SHA1 0069b956d17ce7d782a0e054995317f2f621b502
SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512 e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

MD5 9ac6f34f726484157b38ba012edbb1c2
SHA1 123d85183ec1548acc4ac7be152502f71c6c8b97
SHA256 783951c977f7b177a2102c9491a8d7c763db4f8bade364a112eeb815f8da70b2
SHA512 e66b015fd98317beec69a03c8ec7607aa95eefbb9805403f8b0f14e1c7e1d3478225bcfe647cfb409ff1cb2d8c2645a638bf1d0db22e53c5306332b15686221f

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

MD5 71d4273e5b77cf01239a5d4f29e064fc
SHA1 e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA512 41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

MD5 3c269caf88ccaf71660d8dc6c56f4873
SHA1 f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512 bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

MD5 ac901cf97363425059a50d1398e3454b
SHA1 2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA512 6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

MD5 e3a7a2b65afd8ab8b154fdc7897595c3
SHA1 b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA512 6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

MD5 2735d2ab103beb0f7c1fbd6971838274
SHA1 6063646bc072546798bf8bf347425834f2bfad71
SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512 fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 4a8870751b817abbd6e6941ba2e17deb
SHA1 05b079719e78a6bac1f994496724d6a5a05508b0
SHA256 0d0530ada79e75f87949f7038f9c3398ecbe898a528112c5ed2c8510259f2fed
SHA512 bbc5f9c4701de11d34f96baf93ee6539fc83fa272a70ec90b713563369afacc6106beebdcbd2d6a69de5a454d68290974be0f3f192ff0a9487b61482c93b596f

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-23 11:25

Reported

2024-02-23 11:28

Platform

win10v2004-20240221-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe"

Signatures

Detects executables packed with Dotfuscator

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with SmartAssembly

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables packed with Yano Obfuscator

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dc9923a9ea8238e9.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78500\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fcd59304b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000212373314b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063fa8a314b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5c413314b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005649d42f4b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff0674304b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001734ff2f4b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ce50f304b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000811f0b304b66da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
N/A N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: 33 N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3252 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 3252 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe \??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe
PID 1716 wrote to memory of 2284 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1716 wrote to memory of 2284 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

\??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=100.282.200 --initial-client-data=0x2e8,0x2e0,0x2ec,0x2e4,0x2f0,0x1402d1680,0x1402d1690,0x1402d16a0

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

\??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

"c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3252_RRJEXIPYQWGFCKLB" --sandboxed-process-id=2 --init-done-notifier=860 --sandbox-mojo-pipe-token=6426324206669266493 --mojo-platform-channel-handle=836 --engine=2

\??\c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe

"c:\users\admin\appdata\local\temp\2024-02-23_17512948ac977a49f9e8976a86873365_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_3252_RRJEXIPYQWGFCKLB" --sandboxed-process-id=3 --init-done-notifier=1404 --sandbox-mojo-pipe-token=6291107651173862812 --mojo-platform-channel-handle=1400

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 152.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 knjghuig.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 34.41.229.245:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 3.141.96.53:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 3.141.96.53:443 fwiwk.biz tcp
US 8.8.8.8:53 53.96.141.3.in-addr.arpa udp
US 3.141.96.53:80 fwiwk.biz tcp
US 3.141.96.53:443 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 34.162.170.92:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp

Files

memory/3252-0-0x0000000002000000-0x0000000002060000-memory.dmp

memory/3252-2-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/3252-8-0x0000000002000000-0x0000000002060000-memory.dmp

memory/3252-7-0x0000000002000000-0x0000000002060000-memory.dmp

C:\Windows\System32\alg.exe

MD5 454a77574613db46015cc79f50668a69
SHA1 cc8a7a52a5f74d46dee30d69f44fea64067a9fe1
SHA256 ee06b99a2a675733b26c633d71369f7efb2e3a1bd70ec89c392c41b507f4a897
SHA512 508c2fcc77c24146271beb42c7ebb99082d680d1742fdaa12343573c5b48aab6f8b2ca83f919c41beaa3e2fb322c1a9f7727f9aebecd7315fe83978e60f15adb

memory/4128-13-0x0000000140000000-0x000000014029D000-memory.dmp

memory/4360-16-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/4360-19-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/1748-26-0x0000000140000000-0x000000014029C000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 7b368fd4b2d12effd123619579b15d7b
SHA1 054b9a123c6f3afd16b9e1b36917cab44c7a4089
SHA256 cdd106c95d48593996e083ea81ca4dd35ba458600771319347b4e804c0c31f3a
SHA512 4e73967caed43ce313c79a6a5fe8540ec654d185fc8d712d1e121473c5a91ec210dac54c57a802963c587f5571231e423712fbb8f711fa629776698f6747467e

memory/1748-25-0x00000000004C0000-0x0000000000520000-memory.dmp

memory/4360-24-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1748-34-0x00000000004C0000-0x0000000000520000-memory.dmp

memory/1748-33-0x00000000004C0000-0x0000000000520000-memory.dmp

\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

MD5 915e8146d9bff8f9dd24be8c5e953016
SHA1 207809729a309f5544e72af13dcd2cdf794b893a
SHA256 589ddb46fca20d957423652416f29d82442a9fb2de509324d851912f0ea5ae04
SHA512 34ac91de5663795a6c8d8b1ee0c4b963618deb76a23ed173a4ca8b9b3e75222d386c9e68c3fc88a4a3d7e5f2582d8196da2b15c1b1a5e3258a2b392f0ae45305

memory/3892-42-0x00007FF867360000-0x00007FF867361000-memory.dmp

memory/3892-41-0x00007FF867C30000-0x00007FF867C31000-memory.dmp

memory/3892-43-0x00000197D7990000-0x00000197D79F0000-memory.dmp

memory/3892-44-0x00000197D7990000-0x00000197D79F0000-memory.dmp

memory/3892-46-0x0000000140000000-0x0000000140E8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\edls_64.dll

MD5 e9a7c44d7bda10b5b7a132d46fcdaf35
SHA1 5217179f094c45ba660777cfa25c7eb00b5c8202
SHA256 35351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1
SHA512 e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774

C:\Users\Admin\AppData\Local\Temp\em000_64.dll

MD5 d0cf72186dbaea05c5a5bf6594225fc3
SHA1 0e69efd78dc1124122dd8b752be92cb1cbc067a1
SHA256 225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907
SHA512 8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

C:\Users\Admin\AppData\Local\Temp\em002_64.dll

MD5 4247fa3a043c750081a0da8def8a7d38
SHA1 3ef146ccc895ae3a7f574adf8598016d0a0d0016
SHA256 119c572828255ab2f8f637265d92f017899163c7f474f4e12e865f996d427f48
SHA512 7460760c3b54d3e711f67087558c75c51a2f998da722e518c02c78bd08a06e963cf708d7088ea29538150d7e55e072468a613fb7c694e4d90fe9c8a3e89d3efb

C:\Users\Admin\AppData\Local\Temp\em003_64.dll

MD5 51d9b24494cef634dfe2dd5f82fa4a65
SHA1 983b98dc406481d8dba97301950db0582ba25831
SHA256 67b07ae624a41f9a8e7471ce058d5cf8ce449f743abfb491f9576e472fc17db6
SHA512 7f3acc9350ee31a48f82636b29a0fcd09e8716eaa3e72bd0dc91a82eca30b2c91ed24c2f61cd374bcd96eb90eb7d9158620a7bc291c373ddcd86aa9df80cd937

C:\Users\Admin\AppData\Local\Temp\em001_64.dll

MD5 7adcb76ec34d774d1435b477e8625c47
SHA1 ec4ba0ad028c45489608c6822f3cabb683a07064
SHA256 a55be2be943078157b7d1cfb52febd4a95e4c7a37995bb75b19b079cc1ee5b9d
SHA512 c1af669ee971b4f4a3bb057fe423a63376cfc19026650036b29d77fed73458d235889a662ac5e12c871c3e77f6fbdb1fa29c0dfa488a4a40fa045d79eb61e7c4

C:\Users\Admin\AppData\Local\Temp\em004_64.dll

MD5 a36d3123ccc058c13e18cea6b5e3872b
SHA1 af007822a98429c6ca24035937911db21c5a9a00
SHA256 3bd755beb8bf6ae76fa28cfe69996ad2d324f55f875e18dd6a62e411abe9b1cb
SHA512 942e8b188629a5886b43ab19b821a63bf6635bd62eab3c62398737ddebf79b4a5861d4fc21b26def984e966c7666985316d33281c7b2b19d6c25a85e6ab8f16e

C:\Users\Admin\AppData\Local\Temp\em005_64.dll

MD5 cc4fa910844136ea666e9fc52b49f42b
SHA1 2f4fd086b5ce80841fa4d4ffc02d03ff68af60c7
SHA256 8e00d043688b192db7c5f7e953fce551f1dd193a60c6c25250cb2fb381bde790
SHA512 8298d977dd8fa1a9a12965480a38d9afbf94f3f1f142e05e8ee20ff393f2ce36f83cc00ab37925f911783aaa058e960e0c8b1098d5416bb326f09f70c3fd2d27

\??\c:\users\admin\appdata\local\temp\em004_64.dll

MD5 726d4439d2ad0b91095df19ab265a30f
SHA1 bf5c8a1de7a941db30eb75d89e724e307c0b36b8
SHA256 6f766a8ba7084f1fa435dd055c23da00af060d6f1f35d29e4607f839e868e1b9
SHA512 e3669aa8daac48a4f12d3a9a66959e5ac5423f4cbb7bc943f75aa24561c9a8e78a5ba42c15551e5f38b8d7479ab8047ce85249e484ce0db5c4d6311b7ec1a36e

\??\c:\users\admin\appdata\local\temp\em002_64.dll

MD5 ef7ff96529345f7f477782bdcdac4d1f
SHA1 1e39fbff96f10a2d1a48739c5adba7ac62f7e8fa
SHA256 9051ccee3791ec424beaffde5728094fd72c22666912f34ab63ab3ab6557216c
SHA512 f6906ec8d4d6cf58046563b63988c4d77b12dcfaf596955139f5dcdb7199bf26a7045bc9ad41bbdad781b2032b61c6d14b712378be783c1146b19c5da592411d

\??\c:\users\admin\appdata\local\temp\em005_64.dll

MD5 51abea5120587a753d37eaa8a072fa50
SHA1 1a70878392d3cce6cf4da3710c29de96375d7f7b
SHA256 40b7562db4a5d547b5637d19b03855c37dc93ba94f09156a43bf2181f5d57a7a
SHA512 4ed1a145b530d35047d57f053beaebb1b87633004c9a4ca47a25bb651275b68b61b40ec70742e23ef81c1ef25f0738686b113af9ab6982a29aa0046fe33956c3

\??\c:\users\admin\appdata\local\temp\em003_64.dll

MD5 c403bea3068bf1407fa0b8e2ab181098
SHA1 fc3917ca84ac4bcacf7c3823214730b6816128ea
SHA256 5fdc86da6d9b17d12c8fa3e3198bdbd636795d7092d9e74f95852bfba491bd78
SHA512 9d0742b1c6e38b8d3d94d434f697f515f23a58dcc4fd14488138f1344ed378b305fe242467ed8c1b4ea971fccff5641258a238ebb590680b67997c65454d03bd

\??\c:\users\admin\appdata\local\temp\em001_64.dll

MD5 26d00a73905f9fa8d26d4f17edc58b98
SHA1 70c2575e4dbd02f243a876bf055842438e29eec7
SHA256 869abe21a6548d77c34341e714ffa61100daf604ccf68b6338f4e7a46507bacb
SHA512 bc2e3ef3a8fd813ff658a0f0e59d2cd48208fd4fbc5bb8b091ec2cd02a7cf09277a8db6f2fd81ca4af076083e3f988079d46c5447a6f626f6352355ef5fe6301

memory/2224-87-0x0000024091700000-0x0000024091760000-memory.dmp

memory/2224-88-0x0000024091700000-0x0000024091760000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log

MD5 41302b5266f8db87b3c65e7936334c06
SHA1 383e25b8c1727bf9ea8919166f38697f293d0481
SHA256 093a880b06d48ad7218e4f82edfbfabc3b48cefab99201f47f8e3b8560784f64
SHA512 4d8a790a847a0e0267223597a2f97bf35fbf38351588632776891599bf459017e91431f3557ec6151e9a07f9e5e228c54b0383458c609d31572177ee9ea9a44c

\??\pipe\crashpad_3252_RRJEXIPYQWGFCKLB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\System32\FXSSVC.exe

MD5 e5506ad9ea134cc804b012ecf4545643
SHA1 cbb0297fbb5dd486c86d523783703cb79595a86e
SHA256 e8b8faebc135aa0998e46023e1ee642c892e55e7e41e8003c405eeb7ed5cff69
SHA512 c21035034c778adba368cbb87a8a8502abaee0f7900fd61f63f3bae2768310a5d527e0c31b5e5b8316db8145ee258d530975a42d90133daf56a41cb2cb91e87d

memory/2224-96-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/984-97-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 7274c5229170355e56e349a0a86a562b
SHA1 a5ef89117fa719b696238966787dad7a7d87ce88
SHA256 a3ae50b654c082a92e227d79a8904f3bbfb56f2bbe8cab864ec8d8001f95025d
SHA512 2b0d366577a900cc54986aca19c13fc1dae0b555cad7fe0fb2e3b6da037ff53ca5522338528e97665776a19cfc6eec67b527b881abec86a7a2c3d954edce0384

memory/984-100-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3252-102-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/4344-101-0x00000000008E0000-0x0000000000940000-memory.dmp

memory/4344-104-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4344-109-0x00000000008E0000-0x0000000000940000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 a83fb9a0a86632136b44bd2261f59980
SHA1 ed4e325c3ea50aa12f0386de810052b6b76b7852
SHA256 0db65c016bc24c48d4d405d7ddf541a3c15d343c4527abde47e133a479817a5a
SHA512 3a0f80e094e1165a5964bce3fe4ab22bfedb299b3185c27c10e7a7fd497b365b3dc14c7f8ea9585815d30be50ff4b32ed426c7b312f3e34aef73f692a3ed408f

memory/4128-113-0x0000000140000000-0x000000014029D000-memory.dmp

memory/2176-114-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2176-116-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2176-121-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4360-123-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/1748-124-0x0000000140000000-0x000000014029C000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 484ee7e7d777b17de22ff631718dd8d6
SHA1 b1cbeaaa5fa31c058c26c0cc49e2870d71c65c75
SHA256 07043b1e08c994795761d506334f27293e29c7e1551f3d5a3b9beca0979a010c
SHA512 b0e9e8bad69b12858f923569615b6b76030b6dc34493455c5c4c76959fbe88704fb9ea014ccbdc1cf0aac969788788dc4b07adffdac23833687e9b9ae14b6684

memory/4216-128-0x0000000002290000-0x00000000022F0000-memory.dmp

memory/4216-127-0x0000000140000000-0x00000001402BD000-memory.dmp

memory/4216-134-0x0000000002290000-0x00000000022F0000-memory.dmp

memory/4216-138-0x0000000002290000-0x00000000022F0000-memory.dmp

memory/4216-140-0x0000000140000000-0x00000001402BD000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 2baf96af9fa90ba82e3df0758a172267
SHA1 dcdf758265ab3fdb17bc81bc70a7875bd09f5b11
SHA256 4b2bb5819859ac106d6c09a5bd31581696127135652d5d5aeffafc51502b5b76
SHA512 c434c764d2ca1982f2f5401188c3e7d850363e5b7cbc2f5a76717490dad80ef9eef305689f14905419e54eefe1174a7367f9c50d7d2e03100d0cf006ecdbcd4d

memory/4092-143-0x0000000140000000-0x00000001402AC000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 020be5d3a1281a354d9e9ea506d3d13e
SHA1 6cb57f045067598dc21eb46972657eefc57593b2
SHA256 2c5a2bab2b0c06de901c4af40958480e535691898930a3d7787da697c72b185b
SHA512 372222cc7407b540b0efd0333aeb7083cf614e614da1bfa8e9540cf7e4c1f0c41652cf9a654cbf430583e43c79f8c114557affccaabaec4b48943a506a786795

memory/3768-150-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/3892-152-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/2224-154-0x0000000140000000-0x0000000140E8C000-memory.dmp

memory/3768-156-0x0000000140000000-0x00000001402C2000-memory.dmp

memory/3768-160-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 041733bab23625b25f00f6667fc58ac6
SHA1 6a3046aa9dbf5404eddef13fd5977f818c656e8f
SHA256 adf6f14f9b2123f066e84657366b495ab381db225cd3fc2e3d900b8c318e042f
SHA512 15f72aec203f88059b4c8f70fb23586e4182618c134d138e36881209e61f710b49dd1c64860a25e4b522bcdd4f32f89c5b8cbce756a3d1980b5d19aff19a2a11

memory/3288-167-0x0000000140000000-0x000000014029E000-memory.dmp

memory/4344-172-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3288-174-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 b7230e5983b8c39291892f60157e110f
SHA1 acb148c13cbeb1229766892936e4a49723b0c7e0
SHA256 fef1bef5ac2c1f7d3c27758f116c7144d0409ed6e2da38ea852ba97845efa856
SHA512 0825bb6eaffb986a26b66f1dc443b2966a37c12f2fc092d61068fa9d997ce7a899c0bfa9406c8f1a4f4369b59b3aee0a5b8d6ce527795894e16fe06837373fd0

memory/652-177-0x0000000000400000-0x000000000068A000-memory.dmp

memory/2176-183-0x0000000140000000-0x000000014022B000-memory.dmp

memory/652-185-0x0000000000710000-0x0000000000776000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 64078d4dbb565e2d928c88444548fa33
SHA1 766cdbc44d331bd0c1e3fe57e76c7e679d35f023
SHA256 2aa0c15cf766c3cbe00742c9bb9a123684a3de1c5eeff17216dd66c717d4d767
SHA512 9f9850d6c0006d3764b5bb92b828320b910b0cb1660102e84bc9a94b097dff95835467e42f9b259521cb8ed185e13e6e0a066781a7db69df77dfed7791094ed2

memory/4780-190-0x0000000140000000-0x0000000140288000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 191bf0a786b767bb44a5b660675c12ff
SHA1 5012b2aee2755b735c453ea166d410af9da9652c
SHA256 4c3ad3e8301dabf32f3225a52eef24f3bd06c0ae86af12c75828fc9c43c2b513
SHA512 0e6763ed7604862d5eb5e1c95b7d3a97082cc4ca5059f3d80abbde9a32cff7c114b23fa8f84179add626c486b7c494caafd249ca74a06aec2561fe3b2c8005d1

memory/512-192-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 1ad4cb4dbed8b44efcd856844d709fbf
SHA1 29b447c4af34932f0f58240457c3a21bbbef6705
SHA256 309a0998b7cef781776cad7fe30d631f5a4050076a052b734e2e16b5dcb7f988
SHA512 a082b74aad958cd355da15104d4cefbd0d9ce623421a2956d4fdd339df5ae2185198fb43a92d9418183585ce3bb6e9bdc6f5917eedda794658359298ca16b61f

C:\Windows\System32\Spectrum.exe

MD5 9294563d1e4c90684e5cd0401fe22888
SHA1 b1be16df25952aea76fa225a7547229729230340
SHA256 dcb5013bb24bd16e18afab7f10a9e8c6abfa7fafa50ad85b5a279a58a566e964
SHA512 d37f02e343921d8f712761349e9a289aad36541b645dc29cb8f5fd93d04d57e240865cf54df731f96e4f100bfb39c742330495aaaae5854b828406f5e2a1729d

memory/4092-199-0x0000000140000000-0x00000001402AC000-memory.dmp

memory/1424-197-0x0000000140000000-0x0000000140289000-memory.dmp

memory/1704-200-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3768-209-0x0000000140000000-0x00000001402C2000-memory.dmp

memory/1704-210-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 80026466cca4c41583a29e061b4ec47f
SHA1 2bfa8840f2bc96be876032528fa0a05c360f2a83
SHA256 32d6915e88d1900190baf5c1006b2634766a9d1857a8eec09497ecb0ac6985e3
SHA512 f4d0e50a1329be17dad2219da1377b1c2296c231733550fa0317d9c2481b1f802ed1a6cc776a00f57c8f845ff59815f00991ddb8505d6fae3d732311b8d7bc5f

memory/1060-215-0x0000000140000000-0x00000001402F5000-memory.dmp

memory/3288-223-0x0000000140000000-0x000000014029E000-memory.dmp

memory/1060-225-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 cdbe3263d4674404279222248cd24318
SHA1 94b1e918881a0085b85456fca86a5b074291cf8d
SHA256 e6a388b46598778fed4c77785b7dee922f12fb692ce9dc491daa7033fb42ff0a
SHA512 6ba92925bd180eeb620be0464ed3b411ad9939ed4a346d1a12aa177b2981537e6183ab2ade7ca29120c843045ed28acc1fdd27fcb41646f2819e983c1289d065

memory/2124-227-0x0000000140000000-0x00000001402D5000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 7a5a29c60e27bd29dbcf45d329312f71
SHA1 9c3e9e4a69c284167b7e5c40de9416f7f753b96e
SHA256 f65573ad5cd2ad4d21569c03d342fca7f359c8c553626bd8a486befa1a7422d2
SHA512 6fc1a14a9f3770a3c761ee965f4adf4a04b9cc2bf46252774101e163237716ccf2b5d229677e4fafc09f191a0375473066d2608539395f7b188c9f79d345c98c

memory/652-230-0x0000000000400000-0x000000000068A000-memory.dmp

memory/3500-231-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3500-232-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 97166ea62662f0eac642182c7ae9b5d1
SHA1 5a0435440ab8b735814137093ac1dd833cf01c30
SHA256 c5dcc186d3d4efc80f6430bab017cb84eba347fa0d4ad1c80359d1eae5e85f30
SHA512 aee97cfe4c4654ac336b6f565eb38581c7eefb841a2665320f560a691b104e2ab0e6fdc6f26847d84e1dfd182f94cd66bd952cbb690e7b4c3fa069e3e6a2a1c6

memory/1464-235-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 1a40caa92f90933a30d8e9ddac057025
SHA1 6214d47a2fa76a15edc643feb9c5c4406f5ab512
SHA256 a0712a26c727b52bc2ee6bb8b465a8c1c29a7c186b8e36688298cc0bbaada9cc
SHA512 660b77450c0268b120253bad31970234cf69028ada6cea7e45b72e924c64faf5aee827b3994bcbe811bfd576bc881e0457827520695ba8f15349ac9bfd5fc76f

memory/4380-238-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 8e81a30c10cc18e21a8f50d0dbbc49ce
SHA1 a452234c850ce34e131260566daf63987701142f
SHA256 d0a4e2924e42bd9c526bc01d5273a40ea3b42909f70b9c016b337382cfe854fc
SHA512 6929eb7ee9b61c96e77578c8cf5610872b11250eabe59fc1d77217da3a5a5630cc81ebdb98ed6085da5f800f980ea486014ad9c63812ba293cad5c409516364f

memory/512-241-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2548-242-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 9eea4ca10e1cb6027b0e9e331e3b5acb
SHA1 70bcc3f52c8e850cf9fe114fa52f4f88623fde12
SHA256 b471cd620461fd675f5d334c8a231f17eb31a7abf6ecb0ebab5015636a4c00ff
SHA512 74d63c6f118d1f5f4226d84edfaf154866927c367d00d1b09d01eb8ea06b3da355d13306e04574d00b4bf5065b0e324978c9001bef81f2851ab1e22cf722eca2

memory/1708-245-0x0000000140000000-0x00000001402B9000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 a7cf8ddef5f2d6f5d03ea8c7b5ad0ece
SHA1 99ec52bc38589b25981dd23ef03ba76084989b19
SHA256 7f7e7393635b39b06a674b31ca814107ee21634c63a5857e9118d617e9eb5805
SHA512 fbe53a2639ee0ee6a6f06f542d686f5c7d3390731dc24e5b799a45b68a26150f9fbbd2e39f5f04c61e4f43195beae377b824901106ff8e3b776a47462b6199cd

memory/1704-249-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1716-250-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1060-390-0x0000000140000000-0x00000001402F5000-memory.dmp

memory/512-422-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3892-447-0x00000197D8660000-0x00000197D86A0000-memory.dmp

memory/3892-448-0x00000197D86A0000-0x00000197D86E0000-memory.dmp

memory/4380-449-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3892-450-0x00000197D86E0000-0x00000197D8720000-memory.dmp

memory/2548-453-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1708-454-0x0000000140000000-0x00000001402B9000-memory.dmp

memory/3892-455-0x00000197D8660000-0x00000197D86A0000-memory.dmp

memory/1716-459-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3892-461-0x00000197D8680000-0x00000197D86C0000-memory.dmp

memory/3892-460-0x00000197D8640000-0x00000197D8680000-memory.dmp

memory/3892-462-0x00000197D86C0000-0x00000197D8700000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 93dad8a22eb58c491452c3e23844141a
SHA1 c8be51249ffc606b1632f52119d08a14ae8755db
SHA256 94a2f723b5899a5218b7c850ae8adc78ede4a1c1d99dd22d0fc1f841ddef20ef
SHA512 b21ba5dfe7c7a0ee522803c008274dfca8f6592523cd1d7ad8d744c791fc633d9d91caadd30b5add163b1d36302da670b38cd1c48dd05a1858012dcf4819750a

C:\Users\Admin\AppData\Roaming\dc9923a9ea8238e9.bin

MD5 6d7e5555a5e8235a6f58e1c15dc075bd
SHA1 8282925744e0603803bfc640284d01dd8d3548f5
SHA256 0b46fcb2bd8a1fbcfa05d52b032d5bcdbedeae0653d9f48a1d0a4c1bab55f70e
SHA512 1d68ce0234da72dd99d3e13745afcff40d716053e010641028815f6d37371a41275685463abb6f3f520f12bd8350f8926d0ab90a3ece2be28113b70ac30ed05a

C:\Windows\system32\AppVClient.exe

MD5 7ee23d12f56fbcbadbe12fbc1ae09b6f
SHA1 3f0b1b93919b507e997c6f276fe482e1286d8bb7
SHA256 2871444aaa721fc9b19f66f10991f577c5ccfb186d36563e53d95daf87edbd8f
SHA512 c90aad31387f88b70dab65155b7e2b721622b55fa565dcdb0338f420d8a5416c177e2c5513a27f0797edf85c6acbaf289771a54b731e1bca6c624ac29769582a

C:\Program Files\dotnet\dotnet.exe

MD5 9a0cdf07971dbfea9d52d0dd82c7a8f9
SHA1 78f4dbeb8153fdb198cec9034155445b11448450
SHA256 6a9b38da7e8256a62d566d0a3e5daf758b5965c666e2d492246dc8c8f12c4956
SHA512 b2e7c7fa00ddc15f9ba9a2204fc890ec176f398d706e2cfba1dbd4753522edad4377b870904bc371c53790ac8e4888628c4c9a1be794cae211b9d6f00888413a

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 2ace8e7da96abca4f41735c43775ad75
SHA1 cb6c142d35b5674ecc69b51b6a296526498afc7e
SHA256 39640f9ccbe458dd2e25b6c35e784bbb4e51f32728ebfba943ad74e39dca04c2
SHA512 6ad75eba2761fe3a014fddff920f322f1ac6ffc9b76602a71efe1058057db9556a6102e53d724aaa47f2f92b98fa6995036bde69bb2d7326e65e0b1e78bc52fd

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 30b0563194fe645d4fb384d0868b5fbd
SHA1 497dc7b13f2b10bebc18279a4ca3ddad1d494835
SHA256 9884515edaa0f7e021bb44619230d6d49d893466747c6345c508e1c99263b0d2
SHA512 7f4cf1663b874acb71429eecc6909eff5edf7d9047177cff613fa2def4dac32a613f0f7523d908cae7c476a8dab03cc34f661e3d4c9ca38852f801dbbdd1af1d

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 a407e921b1a4862218b5d29ad22c8a94
SHA1 2f6de5cbc7d26c7d0abfbea294f08543b8775d47
SHA256 c67f2b068186ce06ab1a8ce4d62beae8edb993bc05454aa8b832beb0c8bc4146
SHA512 2dbb5fbd9a909ac800ca4e9213692345b35cbf9b06c42697825e7bc374819890b0e32b8ccb7033620597423f24f8ad76cdc2789f1d2f82b14bfb2b1514350f67

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 753fedbfd80e3bd9f447bf64cdf9c6ee
SHA1 e6de39862f6979ba2c806e4b1f3a90ec2f7f17ad
SHA256 d271daf9c149ca6d84f67b21ce1ff7a03ab668842cd5503efa01ccf7af333751
SHA512 87216e0a72731894d5aaa591d05e676388d927472a6acbed9ccf1e46bdae148ecd86858888bb73d5bd8e05c180e6c6df358efbf69da731a7e75fb4dba48683ce

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 83da0a240e8fa44d7e8121af582bbcbd
SHA1 ad8d5aa123ec7d6bc36970c27870b4c7faa48622
SHA256 a462f605feb24270b063694c0e7ac08e787d6c9bdca52460494df85d32cd9263
SHA512 dbc25591f4077306931c7a05e73d7b320efb0ea4d8b32cb882be12b9a69ac77030ed6789db6133687e3a735e14e5452b7dc7b486d53681be4816d9d799fbbec1

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 6d3de24d8ad67a1edb74b57c377207ff
SHA1 ad53414926c050d5e9fc362a586bbc210f30109c
SHA256 17f358227a29715313ccee1c72efd532f5523a9b4c8e0dd926f2b57cb7ba0e51
SHA512 6565d90f8b73d09618643560210a8a1f40659c731e4df65136a24bd86853c059a55c7c064ac61bca9fe1b96fdde59d724d82eddebbd477d99899b14d9ef39eed

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 8ac9b69afe0011b3586488c66969ff3a
SHA1 992f17735a05c821c714b9402a95ce646d234bc8
SHA256 fad655e17803c2d3fbd3aa25fcbe210b98b0652127ffe829ac4a9f0faa957aa7
SHA512 b4ee211c8db84874e150513439421e54b1302d03343be3fcef8e83bbab11e306b810a9096cf4b242dfc1f60d630dce53ba706a0cc2ca553d3622b96ead6d3e52

C:\Program Files\7-Zip\Uninstall.exe

MD5 515a5826eeedb40d34067a1a9deae695
SHA1 4160e686a767da344547f08db9432e360ab333f3
SHA256 d0d953117546f5e18633c13640660735cdb3e938590d8ce45d3d718c3eb4bcad
SHA512 db7df89967aac9971a9848ef4335c65b0c1fddf26a9b1e1e8a6bff7d7eb11b793c46526801ed5c9bc26aedac5776d9f250767e48fb40ae84951008f7209cfb4f

C:\Program Files\7-Zip\7zG.exe

MD5 bc06fc863029e39778315f396a2b9b8f
SHA1 f0a1b8b95cb2c148ed63bf63f50ac3aa5d59a37f
SHA256 9a91aa9ef42e5ab9d0fe69c1c831625bd2197a1fc43c81990ab621e08b537b3c
SHA512 b97c77a61844362e45221f9b8c72dae875ab466228d9dc186c7a77ae6a2838bb8968acc27864b2761d175f9b14d2ff033e46e06eb18868a8e04f7f2f562ab57b

C:\Program Files\7-Zip\7zFM.exe

MD5 a9e723fcd443b640d87485731cd16517
SHA1 6dcee9161fe0d633dff36096c730a6cf45e33dc5
SHA256 52858693b4321b2e0a14b3938f238b7022da8cf75bacdfaa379fa1244ab517df
SHA512 53daa5066e27f3cbf2359600f1ee02235be3b4bd7f85f4f9ecaed634558bf1d1fbd1e19c12148714db229b09b4fcac51a5c702d9798531c3779c850c3346992e

C:\Program Files\7-Zip\7z.exe

MD5 fb0116f12d44b56f5d20074b065f72d5
SHA1 fb672f2e08a4d439cbeda25fd3e4dfacc71aa118
SHA256 01878dd92de96573973838d9b07bfa7985947c980a89e3af035e07837986a7cb
SHA512 630880f5b3c002f09c4f6f1e042af2888b7019a22030229b942d8f5d2d24db954f886b01c7ffa5311376c2ec3686a4cc3d7449f94c38625d0e1c5211e6ad0198

C:\odt\office2016setup.exe

MD5 05e542f328f9c217a7acc273a617cb0d
SHA1 6265bae06599d2b7a3b7691a43217951b446788d
SHA256 dd41b82cd0e98980f38563e942a808f3d64739dc7f0adc2f859c95807514e65a
SHA512 eef947956e4f9b49aa1891cc3379857d48b5a73a565ebe20579fcc55911869b3500fa1fd7ab2688e4c398de0d78cc5dc72ee6818c264f06936b81613ae749082

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 1f0d8c7dd074241baac7dc6c8ac5914e
SHA1 3dabcaaec60d93b4b74629382702842d51705943
SHA256 014098ed86f0b916507213595ce79c9cb96897debfe7252c6c91edb3091c9add
SHA512 d719b841bcff249eaec1f1db9c40600064d513d340ae468317ad71f3211b1097edda5cf63d28779da1f966974660d6a3bbd19d01cae024c131f2f4f158fc0284

C:\Windows\system32\SgrmBroker.exe

MD5 b19ac2435d6b7182250dcfdb5d05a94b
SHA1 84377fb2e0b1b1e40893c2b649f1410a78e40b7f
SHA256 c46358098ae57629ffa77c2a839216a6b7654d1fe19c182fb0050e02b18a2d2c
SHA512 13f1535aed41d4286c9de7d1a2b7c72ff7821135688cb015609a1a3b448cc31d315cc88db3d046190e0eaf21cbdbf6fa6a1b938d8965a072afefad6d36f27991

C:\Windows\system32\msiexec.exe

MD5 841a14c755d80d2e1052f24a7135f539
SHA1 35ae16cf2f427e946f6fee3eca999c28c91a96c6
SHA256 a282218055d0726b5792b0269fc2392b546a07a797b7d498b2f48bc3d917f0cf
SHA512 acd228d8bc3d67464686ad6fcaa37f86f15234094f6302e22e9af7a9215292bcaa879b0452aa90387ae7ea72e3decd5179c3f988360847729ca262ac437af643