Malware Analysis Report

2025-08-06 00:44

Sample ID 240403-w8wf3ahe43
Target 2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk
SHA256 f9a356e424d2679758c95214b66463344b077767e591853516d6f623fa55f375
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

f9a356e424d2679758c95214b66463344b077767e591853516d6f623fa55f375

Threat Level: Shows suspicious behavior

The file 2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 18:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 18:36

Reported

2024-04-03 18:38

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\10a6ec7dc4fd1e7a.bin C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77625\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c109eb0df685da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2ac6c0df685da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6d3730df685da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c109eb0df685da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 5.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 38.117.19.2.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 lpuegx.biz udp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 104.198.2.251:80 tcp
US 104.198.2.251:80 tcp
US 34.174.61.199:80 tcp
US 34.174.61.199:80 tcp
US 72.52.178.23:80 tcp
US 72.52.178.23:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
RU 82.112.184.197:80 tcp
RU 82.112.184.197:80 tcp
RU 82.112.184.197:80 tcp
RU 82.112.184.197:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 67.225.218.6:80 tcp
US 67.225.218.6:80 tcp
NL 34.91.32.224:80 tcp
NL 34.91.32.224:80 tcp
US 34.174.78.212:80 tcp
US 34.174.78.212:80 tcp
US 208.100.26.245:80 tcp
US 208.100.26.245:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 34.174.61.199:80 tcp
US 34.174.61.199:80 tcp
US 34.41.229.245:80 tcp
US 34.41.229.245:80 tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 myups.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.174.206.7:80 tcp
US 34.174.206.7:80 tcp
US 165.160.15.20:80 tcp
US 165.160.15.20:80 tcp
US 34.41.229.245:80 tcp
US 34.41.229.245:80 tcp
US 208.100.26.245:80 tcp
US 208.100.26.245:80 tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 8.8.8.8:53 wllvnzb.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 8.8.8.8:53 acwjcqqv.biz udp
US 34.41.229.245:80 tcp
US 34.41.229.245:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 34.174.78.212:80 tcp
US 34.174.78.212:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 yauexmxk.biz udp
US 8.8.8.8:53 iuzpxe.biz udp
US 8.8.8.8:53 sxmiywsfv.biz udp
US 8.8.8.8:53 vrrazpdh.biz udp
US 8.8.8.8:53 ftxlah.biz udp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 esuzf.biz udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 8.8.8.8:53 qpnczch.biz udp
US 8.8.8.8:53 brsua.biz udp
US 8.8.8.8:53 dlynankz.biz udp
US 8.8.8.8:53 oflybfv.biz udp
US 8.8.8.8:53 yhqqc.biz udp
US 8.8.8.8:53 mnjmhp.biz udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.174.78.212:80 tcp
US 34.174.78.212:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 34.94.160.21:80 tcp
US 34.94.160.21:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 34.174.206.7:80 tcp
US 34.174.206.7:80 tcp
US 34.162.170.92:80 tcp
US 34.162.170.92:80 tcp
NL 35.204.181.10:80 tcp
NL 35.204.181.10:80 tcp
DE 85.214.228.140:80 tcp
DE 85.214.228.140:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 tcp
NL 34.91.32.224:80 tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 8.8.8.8:53 xccjj.biz udp
US 8.8.8.8:53 hehckyov.biz udp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 tcp
US 34.41.229.245:80 tcp
US 34.162.170.92:80 tcp
US 34.162.170.92:80 tcp
US 34.174.61.199:80 tcp
US 34.174.61.199:80 tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 uaafd.biz udp
US 8.8.8.8:53 eufxebus.biz udp
US 8.8.8.8:53 pwlqfu.biz udp
US 8.8.8.8:53 rrqafepng.biz udp
US 8.8.8.8:53 ctdtgwag.biz udp
US 8.8.8.8:53 tnevuluw.biz udp
US 8.8.8.8:53 whjovd.biz udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 8.8.8.8:53 bghjpy.biz udp
US 8.8.8.8:53 damcprvgv.biz udp
NL 35.204.181.10:80 tcp
NL 35.204.181.10:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
NL 34.91.32.224:80 tcp
NL 34.91.32.224:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 34.174.206.7:80 tcp
US 34.174.206.7:80 tcp
US 34.94.245.237:80 tcp
US 34.94.245.237:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 208.100.26.245:80 tcp
US 208.100.26.245:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 8.8.8.8:53 ocsvqjg.biz udp
US 8.8.8.8:53 ywffr.biz udp
NL 35.204.181.10:80 tcp
NL 35.204.181.10:80 tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 8.8.8.8:53 sxmiywsfv.biz udp
US 8.8.8.8:53 pectx.biz udp
US 8.8.8.8:53 zyiexezl.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 104.198.2.251:80 tcp
US 104.198.2.251:80 tcp
US 34.162.170.92:80 tcp
US 34.162.170.92:80 tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 8.8.8.8:53 xyrgy.biz udp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 8.8.8.8:53 warkcdu.biz udp
US 72.52.178.23:80 tcp
US 72.52.178.23:80 tcp
US 8.8.8.8:53 kvbjaur.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 34.41.229.245:80 tcp
US 34.41.229.245:80 tcp
US 8.8.8.8:53 uphca.biz udp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 34.41.229.245:80 kvbjaur.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 fjumtfnz.biz udp
US 8.8.8.8:53 hlzfuyy.biz udp
US 8.8.8.8:53 rffxu.biz udp
US 8.8.8.8:53 cikivjto.biz udp
US 8.8.8.8:53 qncdaagct.biz udp
US 8.8.8.8:53 shpwbsrw.biz udp
US 8.8.8.8:53 cjvgcl.biz udp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
NL 34.91.32.224:80 tcp
NL 34.91.32.224:80 tcp
US 34.162.170.92:80 tcp
US 34.162.170.92:80 tcp
US 34.94.160.21:80 tcp
US 34.94.160.21:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 8.8.8.8:53 pgfsvwx.biz udp
US 8.8.8.8:53 aatcwo.biz udp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
US 34.174.78.212:80 tcp
US 34.174.78.212:80 tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 8.8.8.8:53 damcprvgv.biz udp
US 104.198.2.251:80 tcp
US 104.198.2.251:80 tcp
US 8.8.8.8:53 ereplfx.biz udp
US 34.162.170.92:80 tcp
US 34.162.170.92:80 tcp
US 8.8.8.8:53 ptrim.biz udp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 8.8.8.8:53 znwbniskf.biz udp
US 8.8.8.8:53 cpclnad.biz udp
US 8.8.8.8:53 mjheo.biz udp
US 8.8.8.8:53 wluwplyh.biz udp
US 8.8.8.8:53 zgapiej.biz udp
US 8.8.8.8:53 jifai.biz udp
US 8.8.8.8:53 xnxvnn.biz udp
US 8.8.8.8:53 ihcnogskt.biz udp
US 8.8.8.8:53 kkqypycm.biz udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp
US 34.94.160.21:80 tcp
US 34.94.160.21:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
US 34.67.9.172:80 tcp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp
US 34.29.71.138:80 tcp
US 34.29.71.138:80 tcp
US 34.174.61.199:80 tcp
US 34.174.61.199:80 tcp
SG 34.143.166.163:80 tcp
SG 34.143.166.163:80 tcp
US 34.94.245.237:80 tcp
US 34.94.245.237:80 tcp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp

Files

memory/1764-0-0x0000000000510000-0x0000000000570000-memory.dmp

C:\Windows\System32\alg.exe

MD5 0cbf4f38b1c3ef3f4701b433bb8b3fc7
SHA1 ad9bfe17799fd5f60f222698a699abff1622073d
SHA256 cb275302bb357e4601474c8a6bbbb1d5d13cd3644ae9733d324a2b18c06a1dc0
SHA512 c8c47b53223cd8350e91f4547cbb3a4fa38b6ebc7479fe3c23ac2cc275a2cda06cd8cadf570057b7ab8387488ae6d4dadb3352de79cdad1d967a8fb060154740

memory/1720-14-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 9b3d350e921596067bbcbee59f41d1e3
SHA1 5bb35b478b9cf22e25c7877125a2f8f53e11e1f7
SHA256 b036012cf58e251acea83317ce364c05512ae6a1b133730899709b3d946aba91
SHA512 c75d29232649aaf98d9039e0f4b57d12039ca2f3641fc42a0de8cff2b4980a5495164dfdf508af0aa8a1cca1e0bbfaa87db0e885f5fe5efbbafd244f8f2a4292

memory/1768-17-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1768-16-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/1764-7-0x0000000000510000-0x0000000000570000-memory.dmp

memory/1768-23-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/1764-4-0x0000000140000000-0x0000000140248000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 b6283aef660df59c2bb3dce1350e6b6b
SHA1 f5f680392dabbd1549c8d5721da7dd04321fbb0b
SHA256 2d27c52d9a62126cd54722c492f849bbbfa3ffafbe217535a83c25be3f85bfc7
SHA512 5b614c44917637e20292cbd2742ede93d62098740634ea8dda42e586fe9dfb5b688955f6720af239c9aeadf4cf91e9d067c771ce34264fbafa333b425b0cdb19

memory/4876-35-0x0000000000CC0000-0x0000000000D20000-memory.dmp

memory/4780-34-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 a8aebe3cbfe5b1c14c9cfd35aed21826
SHA1 6d067fbafcabd6f5f50d2008ead4ccc62b13ebb1
SHA256 61af735fc77e0873af59ded92a3008f8753f36eaadca4727bc3be0a2c23654f0
SHA512 064746b0f6bf8c36f4ff4acc6adf8526e8cacd59d441cbc7ad6515004934ce25e09de2aff760d07bab487433d3a63191514a57de7e4bd10fc9ff502d07f2a87c

memory/4876-37-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4780-45-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4876-43-0x0000000000CC0000-0x0000000000D20000-memory.dmp

memory/1764-30-0x0000000140000000-0x0000000140248000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 8153b9f18b5609a8a29a71d0c53207db
SHA1 19f9cc4b07b2d20cb83e9bbca741a7e7e9230069
SHA256 cf043947255438dacba35be7258f7729b1818d36bb181b8d6d89744d2bdca648
SHA512 3cce2074c1e478f79df52f15e73f04432592aa646c55dc6532b0085a01e9ce0451f084b0fed2303310193cefb98609f432ff0dc0adbe404b3688341f7cbc3a6c

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 c26bd97a3cb9cc699e8efdaddca92f42
SHA1 c351d3cc3480fcf1e8e8af474d8ec6668f23cd09
SHA256 75b587136c50c96976b096154d9f3e5ac6e4c83d1a2edb73f1e8672e3f165658
SHA512 ea7f9489d75f41113e925f6adbd87b7d59bba46003653f575890325374fef4240e4eda3cdac1753739068ecc6217d3e6a950d42721b0799bedc5f4196198dd1c

memory/3112-50-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3112-55-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3112-48-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4924-60-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/4924-59-0x0000000001A90000-0x0000000001AF0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 50064179213ac4e38688fa5097dedb36
SHA1 fa87e098cb300597ca91f6d661ad746398ec2768
SHA256 effd7df3882ba8942e30f3a7d174e996d1abb16ee5b955c20f6384911e7b07f5
SHA512 fc4965b378eaad4cc8e61ca68d7c7ba6a1bf0028394d78dff06979f19464326b051c9b36ce5d7e79b8d91dfa04061abb3de42bbad9b7643b9f16b8c83af4a5ef

memory/4924-70-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/1720-74-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/4856-76-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4856-75-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1768-82-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4856-83-0x00000000004F0000-0x0000000000550000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 c284b839e228ab7a307f3cc0fc88e660
SHA1 099918c1b8d4be58f17b10f05d42e5df35c497b3
SHA256 15f8610391a58ed91814f89d822e9d770968e00361b95b14d94b4228b137b0e2
SHA512 7a6c5aef08718fd3ebde83a3a97785cf788b149a491765e9fdb37a8e2f0fffed5ad457e420831d23b664bd7617cbd8c68e4cc7d6aa3e87704eb8cb26d18ab96f

memory/4924-72-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/4924-66-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/4876-244-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3112-245-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4856-248-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 7e9e5ee7b0793b560664a06d66e9b07d
SHA1 43c00d93a35ac698303d8f472bf53f66f7030e1e
SHA256 082d928a2bc175bb2b052a7e934bbd613eed878ae8bfd15e2aee0884390ed3ff
SHA512 5a00904bd80c3b0888e6cba502328266fa6aa9c343bb2be60af6d463632d12f5795ece11a242c9685911b4a2c813652d62dadf49837c34a930f98490d7d75138

memory/2284-255-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 c8c2785293cfab7b062ca714f4ec6119
SHA1 159bf4a663bba52f1f8915dfe470624341f2c1e2
SHA256 80e6b416767464ca5abe447d15d6aaf3b03e7f3df65bb331eb0989d4538340cc
SHA512 75d4e0c0488ee88e95375285556a702b14f77d28a149a737ea6525f47e5e367674dd60a5415f5849f807c62acb91206489ffbf4e67b46a143aece0a2eeac2308

memory/4824-261-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4824-262-0x0000000000BC0000-0x0000000000C20000-memory.dmp

memory/4824-269-0x0000000000BC0000-0x0000000000C20000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 5e8853b7d390d2fafb6e5fbb4a51cbaf
SHA1 0413055508c916e4c0efff5954b5017dcf91b251
SHA256 dd25caea01806a1afe3fe074d705e5787608d128643e1a020b8a26c9df217594
SHA512 a17cb2aadbe670f6ef9f67a3a16f4d2b1c15d21da9230acaf64585db67ddb7a3956ec8a408ced62a6795bf6d5233c08a491f1720e27f8ebd6469cf0b0af4f846

memory/2240-273-0x0000000000400000-0x0000000000497000-memory.dmp

memory/2240-274-0x00000000007B0000-0x0000000000817000-memory.dmp

memory/4172-278-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b66f593c63d7ab11b301eda8a6e2fad8
SHA1 31a55fd3288578d4b89ac9094fb04e8beaaf8238
SHA256 4c4a4de3928fee834f2ff76b46aed164180321524ddf6431d219746a237878ff
SHA512 b4364d32fbad410be7d1434ffbdfe1601ebb8de0d35044b079c3f47c24e3caba52844ebc91625b77a86dc1dca61fec76cadc773dbabb986efc97bc6ff5381b8b

C:\Windows\System32\SensorDataService.exe

MD5 6943a03ef9e48da1bc65e077d1905b29
SHA1 52a8569105b962a4b09453999b428edce39ac0fe
SHA256 7434cd7bee14015b65015e4983533b78b5c8af04849a6dbadf5adcfe6c6f48b3
SHA512 8913e26c6323f2955fbc70df0ea7cb4a7dc7376f52b0690bff3e5865aef3e30dc621e815bea87365fadff1ae87aa5b5c3f2ce37cd64306c2dbe1694a4506d1da

memory/1200-283-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 e4e1b14736dc2d10e912264e6933ef97
SHA1 3ee25d56cfd941fd04b399c8a70f86ab8f5d15ab
SHA256 dafbda1bb4600ce02a270b3f31eb55b5140756628ca327f278bf644a100c2304
SHA512 0bc8c116fe5069f28818e3e1a7ea87110c0f69d10f37d48e36ee4741c6824f08ba72d0b27ffb8d32b9fcd34c196b5759f21bc1c49cee65515a56f3617c427dff

memory/4048-285-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 d3f003e982382b627c5a7d0bbf962dff
SHA1 a8e5989a85ccf0eabca50d2c87c5e7e6c5953385
SHA256 3911b65d3f92ef8b1e8af0b554dffa9701631640ba3ff07f83109599e5f7ed49
SHA512 0b3b3e27740c42c5518cb439a2acff05f91d5bad1e23d7a0a50b1a030d25dc2cc27b7f3ca87152e6d09cee616f56b0d301521fd002dfae880c03ef3d5984f478

memory/2736-288-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2736-297-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 f7807766a92dbc189aaeb5eed5f8a4ba
SHA1 7b0cad7836e066fb1866b8e30c3a905e768060e9
SHA256 71dc5ced54c2acb359fc81b1ebfde923c307b001390af6c64509259b884efb1a
SHA512 ef48835c8a5f630c76b50e0e109f74273c181806fc590ee8a0024e6feb39d7ed1239bf8051e61c4c301e381220feea6b39066a01e54ba9f91b57b44920ca00cf

memory/4704-301-0x0000000140000000-0x0000000140102000-memory.dmp

memory/2284-309-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/4704-311-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 97fb7b67df0d244b9d8a4e5914401883
SHA1 aef98e4c6464290b3b8495caa38099d26ac44f37
SHA256 bc37ea8dd9daed0c1df04e35f2376bec1ef73afc2d97f8005bb4e44dab244362
SHA512 a59bf1669c0308cd4e6e935ed0ce718565aaa1afac687c1559d9445b168db50b0ac994aacc477a6bb0c05124f596223a91503c720fe8633164e4368d3b5aa41e

memory/4824-314-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3952-315-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 e2a72f9d741e3feb20b7efb472aa5c2a
SHA1 4d474650bda277583e8c643e7f2ce1357fcd8784
SHA256 72ffc2d8b12a5faa587cb46089df3e17ad7dc3f62c5702defd4f04d69290cd53
SHA512 c7bfe9e9bcba0cfc4ea83d529559aa153400b90198d5710dae47da017233d39a9e26a90ed10e52f8d833345c1d32e1c45bfeb6ec1c3e280338bc038a1a5f6229

memory/216-318-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/216-320-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 ab30f5db1bbd3fb53508ce87db4c8d86
SHA1 4399d80dc8cd35e904d0bf95e453cbac4c986a25
SHA256 440c50289a16d979804af435332adb2cb7674142153226d5a739c102a7549f61
SHA512 d24cc8823f94077e9d3d0f7ce4b39b7024a8715d381582cea87d7c342965e85737b6d63b7f858ca3265f505a8186c705351ec6d38c1b98c32123799382360c9b

memory/2240-322-0x0000000000400000-0x0000000000497000-memory.dmp

memory/4552-323-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 251ddc44398eb888888638a6fe809566
SHA1 dae182dc9a01ce81306c2e416842223fece477b0
SHA256 3818fd4709104b646e3526a3a870cfddd8e0f17efd506b7e78f37db6901a4227
SHA512 e00a31e5739510494ea4c84d1ef379a447690faf9e4a3fa630dc40ebcf6eede57f4ddf1b2da39d2237fa2796098c91c399b6362bdd86d58619f4df1bba68350a

memory/4172-326-0x0000000140000000-0x0000000140095000-memory.dmp

memory/1976-327-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 a39800931f293bce1da3fd6332a29891
SHA1 a8924a5a8bf12edb4ae60ae5f86f7f59d0af1b40
SHA256 805da778bbebd3ceecc928c62e34142ffb2e3f9bb51fd99de035755af3a5d3fb
SHA512 fa981cc515215a112fc7ded9deb3ecf38033d456482ad22d4b4460d2108dc55cd934d2657fda4f966d9c8297199c158f2322558019672e9fc05699e4cab8c8e0

memory/1200-330-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3036-332-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 996de9b20cfbdc62d68695c0702ef64f
SHA1 91ce7b896b5066b05f43a1631301bc6c3fa158e2
SHA256 d651601cf29871e97931c5bafae57f68512d83860819a2124cc73200cc7f3ef6
SHA512 12d08199a2e68953231bfd6f09b2002fe4fb6139084f1cee60fc4ebb679bf5de9372229e99728826b7f63e239ef8053527a32e92af468a53f6527170b35e6f6a

memory/4048-334-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2232-335-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 efbbfd3fbf6ea2b1fa32be990300c871
SHA1 ddcf2b40e1136cb36aeec68212f752d283edd549
SHA256 649925a3fc0f108d61f0f10edc8d859f387aa72709d906ffbebe5b3b0821673e
SHA512 5b9ac55323f529189a71aac616dc6c07e0f5b44aba352140f517bc39004832ace45e4df74baee2efe0c4f3b9cfafb3b2b7b1c0ac99f426d1cfb47f7143d1cb03

memory/2736-339-0x0000000140000000-0x0000000140169000-memory.dmp

C:\odt\office2016setup.exe

MD5 63e4b258ef395c212e3fab62ef06a06b
SHA1 13cce2c213e44d9fd13b17ac214a914bf9301a08
SHA256 94a3b65fdc05105fc29b13c884350006466ff6d8f527299b9727b3911cc97403
SHA512 7fc8df74bf663f63d53c2b4ee0646fddf979089f92b2d348b8441277ceb78b6d5ed857068f7f9a14e90d6aef2649daaa47fd9704f8099715b24ca0f69e01cd10

memory/4008-340-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 da9a6948fb7beb76ed361cf3d1c29f1d
SHA1 fb96a68814e47ed44d68d65ff56bb224bb9565dc
SHA256 de7b43be946087deff71b17e77869224f5bfd2caab7938731d008c8b2ebcb426
SHA512 742fd3b0ed4a39f8615ab60baaeb70744383c7c592743685f7c6791f5b9d4c86a5c8d4fd3d2afedc129b04a5112e6ace8cbed113ef13a0beaff5318b0f3914e8

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 6c176f099a10b50dc3b122ebd1918158
SHA1 37bf7435e0b8cb3b1f589ec04b15379f56c07007
SHA256 8fa9f7107b646bc36bdbf33580c7e5bcb04089d6f18d6c73452020b826e88b67
SHA512 3350ce63ac32b0d7cc54eaba1be2ee1cb699442956f6d43cc07c558af427791e216c8682590fb8c296c703830e4b0c1fa13b7a4e005eb1d14024819fa4c61c42

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 ad190fd198c3ed66200c0de48c09a5df
SHA1 da98fa8336b4304bdb81c7fe3eef325682add53e
SHA256 ad6d11fed99447a48a28f97ee6d45526ef0e2df097614448f94ca4a74d1550d7
SHA512 8931f90f4d722bf643b731c3ee37f062e168fdef8ff6099219a8470bdf106ad12e344f6bd3f9e3700c9f9f66d461cb27d064369a9933a724b32a9f1589bddca6

C:\Program Files\dotnet\dotnet.exe

MD5 d292db942290136134e507aaeec82c82
SHA1 3ad7967fb9c878204ce0f0537b65904f18c582d5
SHA256 46e3bbd2f2332c895bdc98ecd342f2c2bdf0efcdb2c2bd400f52bdbd7ecde77f
SHA512 4dc5b779dc94d1b24612d1a1f2c537a6f0d49ccb17dc6d02c5236a572383066aed4eb63b287efa8e69dd6c06e7f8f40232d76f829965b272902c589731efd045

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 e73f55531776468f6e2bdcb73d70b0d9
SHA1 04ca8c5002c50c217d8e2e9c8703830af3717301
SHA256 066a4bd4a9ab60d701fb75217d9e133e224cd03d2e955dfbf2119eb7f4a37342
SHA512 a6a9635b37e5f30576475ca8117a0f8eda5cf800a00686d164bb5f1a95e21b12409503e13f97a358ee6cc731ad091eb00035dbb43a298f3564e0830733318ec0

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 eb4ef863a5be119a2e747e4d91b97de6
SHA1 c16b8fc39c46ce69875184ef24df8ea46c01eb7c
SHA256 4e647882c63f7f5707be659537c2374826a2a82c1a8c78ced90eb7113d982bee
SHA512 a006dfc412505ad36b829d97506a6676bdb810c8fc790caefb9219d292119f4d5ccf7dc7f6417f46352e4114423fd17a3f8e0b3a2fdf59e393290e9ec046fe7a

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 bd7c6345441f7f164cfe75162e80c04d
SHA1 53dde782b31941ac77ad973df78bb91d43f524ad
SHA256 8172459428d2c191a09bbe35b4b2b5965b788b48c96d3dd9c5c7c09bffdf302d
SHA512 bad44266cdedd2958317a11908297c04090eefa91649a8cf903d12bedb4698a8724f9de6207db02d29f4517559c9afa2ee724f8c7763b2cc41692fc1d8d7128d

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 49395e3e5d336a36bf5bed809a194fbf
SHA1 88917f06e88c83537ad89c00564bf1fb705551e5
SHA256 3a4ef259f338b746be420e5c542bc3746a1bf58a441d7c78157cb40257b00948
SHA512 2beb030e82d7ba0938853bf529e356885aa2b1577003bcd8338fafbafc8500e9bcde2a3b558084926395ec85cd055600fb20cc89916cecceb5cbcac6261e8f3a

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 6a686f51995b3ea2e584a598c5ec7368
SHA1 8d1d438cc5a3506ea638bf215be569ad36da529d
SHA256 9a15850e435d78f9d595fdfa91e5821cb82f2ce5b2ce12857c586efc725b5177
SHA512 8f22a26aed38b7655d7797f026f88625b7ead728e9e1859fece6db434e66d96b106540aa6abf055ff4556aaf670e508510a8c2fc8d28c8cec3505e4e88e71205

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 479cebd94b10bdbfd085578da940a46c
SHA1 7bd3b4eba3d12a6b87888d24518555ff73d3616e
SHA256 acde231cdd025a43d5a50a2750f5e6325903e80a3d27a775e481cf9f4f72de75
SHA512 f9a2ed00300ef21529675d0f0727f6b5d7899016baa0f5c41d830ec49261b55d406fd05df1039e41ff73197a6dd6202621e061743c5a2e04eaa5af2e01b4c5d3

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 b8f3a402c8f6583fbaf05a33f5ded86b
SHA1 f51fa0f2f1f2db9424c28718a5192b61cc1a02ec
SHA256 2f61ca278f1fd84524c028426a402444d8be994aaf9fde3f92a8f024bc6a6c23
SHA512 77d76c2b2f435d0b6223441acd04ba26f16109daae00b6e643695d847ab15c727ce6cb894f7409e1c11ced8b6f212e6c9d7435da070d2b7cb041ca434955797d

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 647fa41a290f7e698efbf7af54c59ed8
SHA1 5985ac75e666d9a33a890713090c96e922b67067
SHA256 065d9240b4080c416e9e03c0926c901650132d6659309104d54c57a47f842584
SHA512 6ebf60acb87114cb645b24ac736533d47391b8e3a68492d93fcefe78bd5e32237682ffb3ef26a7e91a34fa122db4f1d90fbced46b27172074456f52ebbe99729

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 64aea77504f14dec42e59d018f0db061
SHA1 d2df58e22d1b89b350389769c52702ed62f76253
SHA256 bfe37c05a3e9d25a67d15ac0b7c9c94f465ddb693e208360625d0a44bd4c77c8
SHA512 3f6a65b51e7fdb1ab7229133c8adbaed0d3b479ea8a235d3978ebd242a3fe82e2baa7cab06ebc4a54807ed2340d05ea32663a3b50c6dd543d357d78c9e752c52

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 ba084f4b593944b51d2218826efca866
SHA1 c7c31b54be8610037a26f0f465eb7bc96607d51d
SHA256 a6a4a9e7f50f6d41d805bcfb05b96cceedd25b5768587903f4ed6198c9141a44
SHA512 275002e2b2bab747e2393b91cc020ca11c58eddea87fc270fb16a4b13faa96e5fb12133e1874208c866b399b4d1b145cfd4be4b275e2d31f295bfc521cd1bc58

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 c7400e98d90ec3d7e741efdaedc0461f
SHA1 b09917a8c1fa3c2269299f12634d14806fd90fb5
SHA256 5accc4fb6ea84f0b3916c46adb7755cb5fb0e5032d6af2961aa8825687356fe8
SHA512 a85464e074796a1e1d82b270028f99d7e77d7431505b3426bfe0032eda49bdc07d76c5a90c1e9c604d82ae6443b47df682137ca036ba89fd4dcca74addf232d3

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 ee1e8990aa1af69510941714f3b02c80
SHA1 f2a15006e8e79d470d6036d2146c30a94a2379fc
SHA256 3a0c3227d8e892e3777b360c5089952428561b1c756c8a871164b67045e3ddc3
SHA512 2ccc9d4144e547a828477cfbf67341afeb2ce9393b0dffddf93c62503e804481609b636f2d53b5ba9070eb81e4ad7a92a792c5478bd97b598fb7302578f9aaf0

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 f9cb0efb01406858dd8f4b11396cb940
SHA1 2f60015fb819c4a54d922044821e8fa13403fa40
SHA256 6b7db4a15398920bb251fbd3cd3e5c122c49c91e14b3b234df78c8d4d9d28906
SHA512 a772699b70a537479a9aba31163b35163123305b2ccba34041938b2ddafd0fe1a2182555e78bedccc90fd1b1b2c7c18432ebcf00e5fcb832da1efb674e62df70

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 eeeb102f91fe9578f784eefb4e2e0573
SHA1 0d83ed81b5befab6e1328a8223f1a3e6548578b9
SHA256 95fe046763b1bbc45f1b78934d425b705295c2ed4649e43c6d74e24eabb2ae38
SHA512 cfe1f6f7558c0311271b2eb0f763b39160ec55f8b626a9a677e169e210c9ce98065c1df75df7b408c6732e7905c2adcea987aecce6da7bd2f5d5da62fd91abe4

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 62fa30e5bab199b41a6f9e5414aa26d0
SHA1 3eccc2a40f7c42507f8a2c1d281df5323ac1beef
SHA256 02e654f9262253416a69e3240d76e8171f1999180fc4823ecd1795cf09d0c74c
SHA512 bbd69d9c3da922874b53409d7fc0b27acdefc57833b24b00f8e6ef1927a94625ee14bd88d30d347ec6aa718f53a51553d3229e47d075f43cac61ee16a46e0f00

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 163dcf8eb7a93a89d60e2b1248d9311d
SHA1 8dc4496c6267f847329bc82c30232f0b6ca1d072
SHA256 e65e12a6a11eb7851c00d2c69ada75ed8c963eee38d722a1303da9149eefb920
SHA512 55c2b6d4ee966b0bb4e8652520812875b8f81eaae26f72223594497f8456a3701b2646d5fb30aefb2a6c79e33083e4596d0bedcbefda6dac310a18517ee8b284

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 81641502dd7ad6a117f5b4386c584759
SHA1 3b8ab2da5f18be843528120607d0461eb0caa68e
SHA256 68ef259ea9a6a934c11f39c1f7f0aa5ec3e1965c782529b243d3cef61abdabaf
SHA512 5e100f723e732a5b4e6823ea3c22e84849f4dc0fb253d60dd09b41e53cff543cb6b391db7028c85f453c3e9e807e93ee404a6473ea16854e873fc36eb5256cfd

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 5826a15e756890841e247e62711e0327
SHA1 c9aef1adfe2cb47a9bbeb0d3174d37252b7fc6c6
SHA256 97f4b52d562d4fd011a5e357ec2a977d3888d426122b4b0591a35f18a468eb94
SHA512 8ae1834dd59be94ba08a53c9a0e16519616006ee86b0d5a6bfb432582055b2b642223fc70c97be90bfe7df198c7511eef9940f0cbae0faa265fb6e8de4a1bf62

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 036e0069245b5748abfb1cb786558f42
SHA1 a4959ae684ba1e34122fc7321aefee24c198f831
SHA256 86f050b556dd622d5c45e94d843843f3160d3eb4ee5122d4c9d1ee2c147e7b00
SHA512 c2be3c6b14c7a28df6c3d5bb60532ac05923741189323f5a9c8b1e0e362fd678b2124c59b8c4df9f61e850f0ef96ce158b42595fb2929432d82c47fabae3d53b

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 5dcf5642c98e6a0462724031f1402959
SHA1 302ed0b5fb7afef60f27544ef96cffee299ab439
SHA256 7b06006545d23aed7cbdb2873d611ce7a140b7031fbc662a3dfe8bb939c9a104
SHA512 5bef2d9ddc45812e0fe4daa8b76c5a565a99b8127b090b661e54f091f091a4c7de27e4aa95cf7e2cdc89d05a5f95e22c063bc60587fb9daff341d8269a0ea69e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 315df9b652677414e079ca04da8b3942
SHA1 0d2dcaf676cca5e97d346f2634c86ea09eeb44d0
SHA256 1d7f17b1c5e5f50b20b42d08c4288a18c8a14fd91e9a1177f2c8696c1cb8775f
SHA512 b9139061f3270f0e03e8c5962451a06adc9face6da2c339bb5a7d874ea3860dbd4e005897f36eb5350d8c62f116e4989fa9f051b7cc09106ea06b6c5bfca77c0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 10eff540bb41f3d2dd23826a9b56ca8a
SHA1 8763c3296fd3b2f50f4a840464f33f60ceaa9c8d
SHA256 4dee3e5d79a776e4da99b5c2f01997c421c35b2150b0f6bf4c5ef2b811147251
SHA512 04fe36f913c001f197b61d03231a3bf236808c5f5e5395187fd61665e347f40b485d22aa9e317af94a4c5f4cd445be010cc2e0f9100e913c32990dbe0801977b

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 c51dbd874a539767c52168ea358ec0ab
SHA1 2f2ddabd5411fe1ad3251114b4100699a8b40e35
SHA256 2883a628c67f9a20d30bc5a06c4d06081711d8502aed4fd2ce9fe29bb52dc338
SHA512 807fec3389b0f8870dd38bc408db82a090cc880c946239f1c306c4f9ccb9dba31d06f14093c3c0e8f62652720054816776130eed3e7883bd09550a3d95d7df72

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 05f9252f38722cf67ed282f2a075727e
SHA1 a611d969503492fb08b7d407858348dded1367ef
SHA256 b21200a011a530dc4d62764f0b115c7aa9968f90e82a2346d7f61613b671074d
SHA512 bcc5059afa3ca0b3fd1f5006278bc37c88efd4fa1b19c1f9325a631552a0df063b2031c81575e0d514a51094795a1bc5133690cf7868f6c2aac1e04c3fb24561

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 623216710ad9d888c353c6aeea30ec25
SHA1 dc310ba97fe7c2348348642ba1940680ffd52591
SHA256 d401d05c32ee582328120edb28c51d5f1321dabe5f59283dc839f1de9dd39503
SHA512 2f0f129afb2c1dfb0143af7be1c883536c8aba65930900a80763f663629e66c2ead42b484468ab1da4093bf0b3f3639321cb741a2f39b462dcb26f7c59c14a3d

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 a862cb059648d3ab4ad18a290834c682
SHA1 b1df6f97a70893d3d431da4df8c38318be0edebf
SHA256 f745c4b6f6788c4217d2a37bf00814b7e6a82e0480a0b24d9392618457914035
SHA512 215b4fdabac398b2ded4f099adeb508ed167a584a07187835c4e8af73507f63ced329dc73e72e836fe507a020418984aabea90100296ded5c9a3447e87ef7f1d

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 4083db405e4a688ec043bdc0b9e49d3e
SHA1 4b1216e41bf7103371202d1c073cb3f06a42b058
SHA256 a4656dcfd08fec1561a373e27cebaebf662c2af1db43b5debf81d4382505b11d
SHA512 05796f63391b7f0af60eef3c0b5ac350474beba1d0b59bc09e225a8c284605985e7be8ab22c9bcfda93c10b8d8b93cff52996d0fcdd6540cd277584d0ea8cba0

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 7844e6b0e50beb362342b1ef39cc648d
SHA1 e6493e98a6445e8c11055cf1042530b37e33c779
SHA256 493c06b9c2133376c264ac289c66cb2dfc3839af6eed1185f2ac78547cfefcd6
SHA512 a208e1d8e0325647acd5d34853b678f37aa3c266fea740a8889a5dce1b89bdf04f6b62afdfdd76a7ee8b5ab90defa562dfb1e5564c9db69f28a890209af178d6

C:\Program Files\7-Zip\Uninstall.exe

MD5 96f4f072e9d7a0dfe9abc6b3655ec02a
SHA1 ba21a18f0a6d6825a4182a87815c1fea437218ea
SHA256 15f71201c6bac123a4a0c5e7b00bde11f0085c899888bdf7af625c45a91412ee
SHA512 8d8d893b06442249bf0b48113fcb0344cf2b92e8a48d693e930d8414d8fc048581645edabf961ac6e10f16b1c6ae75c03a97acfbe7d98fa4db9c4e0b8243ea4a

C:\Program Files\7-Zip\7zG.exe

MD5 755c8520eb201021c0c350e5d2a70740
SHA1 890d42af68540d4ca23873d33583b65f57c30aad
SHA256 b2b712e87daab58302265ac97d2c206f6bb747b2e138c7251d7f53e26201dc18
SHA512 1becd4e9e379a7615daa5a205fbda447d543a3075592dca0b415e9134bb3efa1ba0bff0ae89127471ad1c52467eb8bf1e475322cec57b4840afab892ab6419c5

C:\Program Files\7-Zip\7zFM.exe

MD5 a07949f5d57bed5ba7024823254c86ab
SHA1 10c26cddf2ae9e58dad4ccf92debf54efe5d1639
SHA256 d5f0ca4e0fbabb20e4c57214be7f5feb661e7ec018be9fbead6f6ba5fed1b927
SHA512 55d7e600c5e1d9248c3d453a2515716bbce2f72a230ce449dd8d03e49a4c8931e3700469843001767fbb9f1c1872509da0a1a04aac04b55a96e4013d77e2b8c0

C:\Program Files\7-Zip\7z.exe

MD5 8c62cf0d7f7813a295c33ddd86c5cd6b
SHA1 2dc177eaa04ce0cf2be690facdac4b68f3155f1b
SHA256 cfc4c9a59c5e212561df393785426ed9ed33abce2e9ef15326cc4fb04eeb8b28
SHA512 3bc7bef4198e8b41d4d118da7565bb07ae6a82874e89d061fbb7c580729493261fbdb69b442e942968bcfd6a9cb6b0da69df15ecabab03990372f341dd71980e

memory/4984-423-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-424-0x000001947C610000-0x000001947C620000-memory.dmp

memory/4704-433-0x0000000140000000-0x0000000140102000-memory.dmp

memory/4984-435-0x000001947C640000-0x000001947C650000-memory.dmp

memory/4984-434-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-436-0x000001947C640000-0x000001947C650000-memory.dmp

memory/3952-439-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4984-440-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-445-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-446-0x000001947CA40000-0x000001947CA50000-memory.dmp

memory/4552-455-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4984-456-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-457-0x000001947CA40000-0x000001947CA50000-memory.dmp

memory/4984-468-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-469-0x000001947CA40000-0x000001947CA50000-memory.dmp

memory/4984-470-0x000001947CA40000-0x000001947CA50000-memory.dmp

memory/4984-471-0x000001947CA40000-0x000001947CA50000-memory.dmp

memory/1976-472-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3036-473-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4984-484-0x000001947C600000-0x000001947C610000-memory.dmp

memory/4984-485-0x000001947CA40000-0x000001947CA50000-memory.dmp

memory/4984-486-0x000001947CA40000-0x000001947CA50000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 18:36

Reported

2024-04-03 18:38

Platform

win7-20240221-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3fbe63741a27db999db3d93df77c3bad_ryuk.exe"

Network

N/A

Files

memory/2864-0-0x0000000140000000-0x0000000140248000-memory.dmp