Malware Analysis Report

2025-08-06 00:45

Sample ID 240403-xfxzvshg94
Target 2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk
SHA256 20976669ef5f33c2bc5e0d5126582acdd778b6603b31a442a826ba500fee898c
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

20976669ef5f33c2bc5e0d5126582acdd778b6603b31a442a826ba500fee898c

Threat Level: Shows suspicious behavior

The file 2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 18:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 18:48

Reported

2024-04-03 18:50

Platform

win7-20240215-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe"

Network

N/A

Files

memory/2956-0-0x0000000140000000-0x0000000140592000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 18:48

Reported

2024-04-03 18:51

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d12a06aa8ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{6FB5F2B8-50C9-4E27-9F75-756369A42747}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133566437143737339" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002580d68cf785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0f40a8df785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c31b128df785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000396f4a8ef785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095fed78df785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1f5eb8cf785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f1a318df785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f91278df785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd5ff98df785da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1340 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe
PID 1340 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe
PID 1340 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1340 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4508 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4508 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2440 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4408 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 412 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-03_1a213a216adae5f9062dba60e8c20155_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d0,0x2d4,0x2e0,0x2dc,0x2e4,0x140462458,0x140462468,0x140462478

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff860a19758,0x7ff860a19768,0x7ff860a19778

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2724 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2732 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4592 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:1

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:8

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff687d17688,0x7ff687d17698,0x7ff687d176a8

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff687d17688,0x7ff687d17698,0x7ff687d176a8

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3188 --field-trial-handle=1892,i,5603584412117662045,8665768605518991935,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 226.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 172.217.169.46:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 227.97.18.2.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 210.108.222.173.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 8.8.8.8:53 wllvnzb.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
ID 34.128.82.12:80 acwjcqqv.biz tcp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 tcp
ID 34.128.82.12:80 tcp

Files

memory/1340-1-0x0000000140000000-0x0000000140592000-memory.dmp

memory/1340-0-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/1340-7-0x00000000020D0000-0x0000000002130000-memory.dmp

memory/208-11-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/208-12-0x0000000140000000-0x0000000140592000-memory.dmp

memory/4124-17-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/4124-19-0x0000000140000000-0x000000014014A000-memory.dmp

C:\Windows\System32\alg.exe

MD5 3f99b3ca1e6bf660beec3f080a427c31
SHA1 5c8ed45f1c1ada496cc444c232d5f488795ea6a4
SHA256 284e71df41ba3db6ae8d3a64e20f36fd1cd32a9222c45a9153f02712484b69a9
SHA512 1577099a32aa9f346ced915deda53567202a09bc3ce93cd1dacdbc8facd854cee94d3025aaa048d7db3f8d3c467a5f570df2d243491a58c025c2da6fb043fd50

memory/208-23-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1340-32-0x00000000020D0000-0x0000000002130000-memory.dmp

C:\Users\Admin\AppData\Roaming\d12a06aa8ed1090.bin

MD5 b5ed4454e1df6c2b90187b4a18ab4e4d
SHA1 ac28a7964845d3bb9be22e20a576e6516127d40c
SHA256 80af51bcd7732047c798f3e3519ad7201949698f513114d3bff09ad42d9bacd5
SHA512 a3649d193ca34e51b74bb7154d2f58a2693f652f8dfec5b6f34cb6763629a43b243b9a8f94ee34ac1c733301dc7ab4f913a14a7705bc434a69a793956e2e9cf1

memory/1340-36-0x0000000140000000-0x0000000140592000-memory.dmp

memory/4124-30-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/4124-29-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 bc16ebe41a9fc2938c4060992a92b0af
SHA1 1719af3e339b187d984a76437eb80cae5dc50e6f
SHA256 5874dbe9583546eb24cfb2b237d58f97ef186cd72866dd224df82e62817744ae
SHA512 c78d4be86a3f35ae07375b37fd39f869d317a6ec6699d7673731e6f9b255d7bcbfacf58ca71c3f51baac1e2b2bbee7da58603efa5bd51a31162c481aab7a912c

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 556601d0d88eacb2a7791c076dfeb85a
SHA1 a102a3386a2d48929524d257ea0caf217e232850
SHA256 5dc701afd0fc6463cadbc5cab86d6829df2edfc29016dd3312925bc9e4bad23f
SHA512 29597cb5088d35b5cdf85db0bf61ef60334b55712f2283b70ca08c2e6577d3128ea01ee76eb4a7a87266351cf2293e994f86cfc0ab6bb5b545f383905394c2ae

memory/1428-44-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/1428-46-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1428-52-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 bc874265e5083040efe52e442e056f47
SHA1 7e135e3d26e47e316625508ff31e3ec4e1694fed
SHA256 11dd0aaf39396259b9a4c62f74ee43db0f5b8142411dbfa9964eb5a65d1b2b12
SHA512 2e4058fa8244d822d49bb7a5f8b693f619c355873b6af66d88bdbfb036525e2319de241d1665f3206f68c025d17026302c2242d1171b286dd8e60f03056e65d5

memory/2092-58-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/2092-57-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2092-65-0x0000000000EC0000-0x0000000000F20000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d12842fcee363fd8078c0fcaacb13852
SHA1 aeca843822ac325817f5e56d1bc7e890c55cf703
SHA256 cff4578519000f9787343659dade96b0401cb6c8c084638017c5ef0979acc341
SHA512 7015b8f54d275daedfc4e05a659b0360733019aa173d13117782c4d863513ba7deb9ac814e4c4b91afb88100051378a56af5d49f6f05deb25ee9ad55cbaa19c9

memory/2092-69-0x0000000000EC0000-0x0000000000F20000-memory.dmp

memory/2092-74-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3024-73-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3024-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

\??\pipe\crashpad_3580_VUDXLJZHKFZIOCYW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3024-94-0x0000000000C90000-0x0000000000CF0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 f1da5864bca610c2b6038327c4e79471
SHA1 2c42038026152145c1cb29db8b88977416ff523b
SHA256 50809497de94c049a044a01fb06fcc57c7862ea1e7e2bdd72553e2a3cfe9dcee
SHA512 a6ace602d8837af08b49fd9d84d9285af061700b4b7962cb76e99f336d568372a87282080c37484557156a60a82bd0a2b7868ee7644bc41ad2f7fdcae03d9453

memory/3692-99-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/208-100-0x0000000140000000-0x0000000140592000-memory.dmp

memory/3692-102-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3024-105-0x0000000000C90000-0x0000000000CF0000-memory.dmp

memory/3692-110-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3024-108-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4124-111-0x0000000140000000-0x000000014014A000-memory.dmp

memory/1516-116-0x0000000140000000-0x000000014016B000-memory.dmp

memory/1516-115-0x0000000000C00000-0x0000000000C60000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 fbc15610d189c770b5dc4727f2c1b779
SHA1 5d1b7c7b9356bdc9dc7b4b346b5639385b0b1e1c
SHA256 cce363ed4aa443e4ff3ebbb42ca2aa81bf5425fdfda938f5e601c6de1b8640c6
SHA512 9137fc3a0386adb848b031c091be3100cc8facbd1536ad626819d1f8096f35389b74ab176c07d87de9b61b49e6c541893196fa21c9111c682e84b2e01a7edb46

memory/1516-123-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1516-129-0x0000000140000000-0x000000014016B000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 1d3dec32105f7be67aab7a818595e6e3
SHA1 cc879dbfa603941ae6ff4128e540979d091078c6
SHA256 6da979a83351a935c692f84e2c79fe61e9718b5950351cfeba798fb7177a8c3e
SHA512 1e661cfd8e280b96b09a7d14a68a434db67f1de713e4db3cdc04d9151c3237591a74f55f40b40028f8b1071f119dfca02794e3948fe3e108abf762211b3eecd9

memory/1428-133-0x0000000140000000-0x0000000140149000-memory.dmp

memory/1516-131-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4344-135-0x0000000140000000-0x0000000140159000-memory.dmp

memory/4344-141-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 c42590c10b0d1c0af383a06c30b06a67
SHA1 f69a7f2151b934f0098c84590f72f117b113ac2d
SHA256 b95be128cc46c369cd06d49e09d50a55ddd78ac4ba8a46cb1d6cef0d06f844b4
SHA512 4a3d83a5eb1988e67b922a90970fac6ac52561cdbc984005914ffbadaa03f68efd8439496d64d708146ebc0ea9e3ecabcf5576a32b89b98a5732d7ba57033bc0

memory/2428-146-0x0000000140000000-0x0000000140170000-memory.dmp

memory/2428-153-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 2c417ba55ce3ebc86d79a9cbdd2626b1
SHA1 b5c8617dd8a4dd5e20023da33314f1081ba16c0e
SHA256 d7b32a29832115de47c09b86a5516ac1e748b6a22a3fd07ef4f2fe12224a5166
SHA512 8a79b9ffd2219afaffcbb764026599ffb9dd2e07b818f9cba5cb86f30cd2ef0a31385f28686787c5ad687ff506eb7af9bcc3dd4921ebdec9dcd3974a5895ee4e

memory/1856-161-0x0000000140000000-0x000000014014B000-memory.dmp

memory/1856-169-0x0000000000BD0000-0x0000000000C30000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 a17067d020a2f5d4d7d5766e50a42020
SHA1 fa2def54d4886480201795ef7eac19c1947049eb
SHA256 42c86268b2b2f79368631acd54c70849d96e3c1269dcf5f5034a374e459b8427
SHA512 28bd743704d17b7b92c19e03927fa07fc0d732054226cf717b3d63108394099f6653c2eccf5152096dc4a1a94b8f4d7012c8b466d48d76abe170fc86a8cf5b7a

memory/3692-173-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2636-174-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 a883747697b47cd8262330a8b8922829
SHA1 4f8a302d02b0913a5fce3397f6e61f551ada7c72
SHA256 4379a60228bf1ac648d45783adb8b922f76b7555a50d4c2c5c48f38a5f1ed3e2
SHA512 177ad80388bce49eed024a1bfa336f1024a374c0b1c575739269792716019ae71894283156a99527d62aa5ad1b9c1922a849edb242954d3c5e19d016d1c1668f

memory/2256-177-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2256-185-0x0000000000630000-0x0000000000690000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 f7b67e10886f1a895b18452055c08417
SHA1 ea0e37df492bc49a161ec4017b4f60d66aa09693
SHA256 64088deb27fc77dedc310f865d6f95102a275d8bd8a0bc7479e6433422b6ba5f
SHA512 fb481f34d90420ac453fb2b6cd95a6bcf0739029bc98d9968d6bebdfdddf72619220637fd7d4f80d5df313ae6f65c92f4f57e9a420d7b08372120619d989e9d3

memory/4888-190-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4344-197-0x0000000140000000-0x0000000140159000-memory.dmp

memory/4888-198-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 d0863a708ea4f415b65a3bf8c0acd767
SHA1 6b7cb2b3fd5fc737d6ff8b260f3b873ba6af6611
SHA256 e15b033dad31cb7c9659163a1e517d6d6370ccab44afe232678414b8eea9b896
SHA512 affc5f045912cafbfc3f40e77e48a64ced289a6686d5d31d075617a4436dec8431e9e133adfbb7f1bcb0edae4f8dced510ef0af1b8d77fe144754e4a225b9f32

memory/4828-204-0x0000000140000000-0x0000000140136000-memory.dmp

memory/2428-211-0x0000000140000000-0x0000000140170000-memory.dmp

memory/4828-213-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 f3cf3b67dc20cad94c9de6dbc9329dd8
SHA1 f58dda1eaad5b3f927e1883794f3c8b020969b72
SHA256 e2acb38949d2b50d624bc9b60c97195d33db5b8948033eabc50710e484d77958
SHA512 e0c88a882d664a82eaaaffca4e1f51b8cd655ba299a2b583cf98779ae69aa659935da71c091e1835437e9e1892bd1e15ce1ed63d7c9c32d95ad14fb29b12c2d9

memory/2428-216-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/4960-218-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

memory/1856-232-0x0000000140000000-0x000000014014B000-memory.dmp

memory/4960-233-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 5acec00ffa27760aadea34d7dcbd2152
SHA1 f4ace3b5d3540765412eefd5789ac01b4c41ecd1
SHA256 0e100c28e35c4bad1aed6121762fe619686561a31bec3014fc25c68639472d0a
SHA512 94130fe7fab60f4746d45a92cb79b2745f8aa9daa9732f2b09b81e01382bdf622d377eee371661b677fcb170c3a37524d33bff0fc897959cd7f61f6c0e9cb846

memory/2712-237-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/2712-247-0x0000000000DB0000-0x0000000000E10000-memory.dmp

memory/2636-245-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 522b15b969e876c1753ac42a17451d65
SHA1 bd81dab3ae8fed3d051ea5211dce0c9f92e10b2b
SHA256 bacf4d922ab77383fde9524cf2010ac379bee237f3e1e5f0922387f0cbb16b07
SHA512 8e501300802326b4bdc287a58d15164f4b5927251e7de69ab581db0ca7a56c61afe336bc585846c56289dd3940c1473fe3077a46458cd1797e0e70e4a34893e8

C:\Windows\System32\TieringEngineService.exe

MD5 2b4cbe4de540e57bfe983e6c3eead5c1
SHA1 6657c87740bbeefd4b82b0c21c9487d898d9eb69
SHA256 a95a7c3a9366f7c3fc82c8a9b8ef3a4f91c63c8e413a1f2864c577c075bf1e1f
SHA512 16887641ed36cf596c0b084ce2db925152c2d4a8b9d74bf070529a785437901d56d9f938f12fdf50adf3766d402506061eea93455c43485eb6e8d0cbeda5ba6d

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 7ad94a259f869988ffa891186ba41c16
SHA1 72422c80d14d840e5dde85630db862c72c6f7df5
SHA256 37eac798e875ea6e299a478d19c81cf951516c1650567effe955ffa309f81577
SHA512 9270ec7e1d3791da374241b5f634d71008f2e4d53830deb6588a5e72300b410661a1605a717f44e4f9580d2397ed2a70efd1ed2abd0a5c36c76d7ca7c3c6fc40

memory/2256-254-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5076-257-0x0000000140000000-0x0000000140182000-memory.dmp

C:\Windows\TEMP\Crashpad\settings.dat

MD5 bb84eab408b76ba9a3fce9253f03fc64
SHA1 56bb35588825f6f31498bcf1b30cadf778ffa8a9
SHA256 790a9ce3e7c7ce0f7c79cae2be69cdcf54288ce0f1867ac750c7c7057b5a5b56
SHA512 98582734192b7a4af9d879d5bf939071bed70bd8fa7f23439223fc067c3c8a9675903db2b2833ee74cc6b7fadbb0511faa8e7179c7293a407e65e6f7888b6258

memory/5076-265-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Program Files\Google\Chrome\Application\SetupMetrics\f8a8accd-6a91-4a81-9b12-656a1e6112ab.tmp

MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

C:\Windows\System32\AgentService.exe

MD5 210c70fcca0781df69ab2b29c6d5d109
SHA1 b13912b8965a50fa176ba6c6a7a92e02234c03db
SHA256 2a3b54d658a12d158c6e9477c2e6d755e350f935773e63b5fcbc28b6c0e6ea27
SHA512 22ecaab46c69f4f15dee2a3152afe69b2415bb94a253f04faf93f1739e002a4ed85c5f60ebdb3f9443bcb206c677eb15bac4da731ab9d993aa5418c779c9338d

memory/4888-279-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5292-282-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/5292-291-0x0000000000B40000-0x0000000000BA0000-memory.dmp

memory/5292-295-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/5292-296-0x0000000000B40000-0x0000000000BA0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 ac96a9f38eafa20a90421dd5ee82caa7
SHA1 77bc5e24177d8f2ef3fb7a5129546aef0c425665
SHA256 6a1f2fb98fe4936ae8fd8c795e58922d279c20fe772f83523c7026bc1ac803bd
SHA512 be247cc94acd16498a93c35df0464147d521b2d70ffb52cd262a9ce1766bdd81961515967fc5a16227dbc206ae5f199668e21a8867edd2ce881194332aec3819

memory/4828-302-0x0000000140000000-0x0000000140136000-memory.dmp

memory/5412-303-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5412-311-0x0000000000C00000-0x0000000000C60000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 92bfe9bb26e6fded24eee3d11664b812
SHA1 7f72f35b67cf2dc57c6c881546039fdbaec0bfae
SHA256 bb6355c7de02855aa73dd6df7a6614313b7959ed0818d9414e1de5144c26d55e
SHA512 03c537ec8c82da4c82e52235bb62bf7563b3c0ee304d46434c7aaf701f4088743379214f3575a80551e1d2397b978cf6241e66e38fd50bff1d5ef93b4240fa78

memory/4960-315-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5508-316-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5508-325-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 f19b5f78a81d94d67b0eb0c3a7435e95
SHA1 e674783dc2378f6b5d7505655256ebd8d7d305ea
SHA256 65404603ed117b9b5df84a71635daa549f58e6512c44bf92f545322bf76389f9
SHA512 a4309e3a1caf3952c4fd2f25a85602eae83888c483db2a6f4f31a3aa323e45274230ff8239a264842b01a2441252482fb87d4493f6960ceafd05e6cd3c1fd139

memory/2712-328-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/5632-330-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5632-338-0x0000000000C10000-0x0000000000C70000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 85eaca1523f2118c03273386abf174f3
SHA1 8aa4111b255393ebf75e99a629c8615ef828fe43
SHA256 71dc5554f8b47592bab6dd6c26972c33bc5902124a080119f31aef63158f21ef
SHA512 2f317089b5223887652c4dca18c63a30e857984a4edb048718da08677f250e8e99d89146ff99974ec7b7f252a0bb8c5ed1d432ed616c025c9d5533bd54df09bd

memory/5076-341-0x0000000140000000-0x0000000140182000-memory.dmp

memory/5756-342-0x0000000140000000-0x0000000140166000-memory.dmp

memory/5756-351-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 9f1352f9ea33a4fcc6b9b036091b446f
SHA1 3297d68c3a89f26b81c792855573ee5b9bff1f2c
SHA256 ceba6c41732b05036dcf5240bd9da25bed9d2fb8df0f334348895bd82cf6ae84
SHA512 3aed367679eae24223cea965f7404142555c3466987c41423522ebee89fc8ae03e5d8d7d460191ba7a9299194a1751c02d0623dab6026b4d115b62fd7ca1f86f

memory/5856-357-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 b7e3eab0ccfa69356aca8bdc9fd8c826
SHA1 a2e6686dcd059ceef3fefd5b88fcf852a68b6b3f
SHA256 270f775e3ec54abf109fedd1fcac0f23e033b14212666011e28ce1b8e792b754
SHA512 fa107b1ddd53456b46eea4ea42459017fc564df940c7ebf87fc5211dcf569427046e7d9dfa44281f62ab94a5e13132964781597bd2685dc69b852025f1257fe5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 77a6e09915ca78c24b917ca6e00c52f6
SHA1 e7ed258df03f164dca5da627a78788897bd7f07e
SHA256 f1ad64d0d5be9212bf8ca26cf4c09218177012d14d3b1ebf4b93f5990effccee
SHA512 8b21a153b5b59539685c41d78aecd5aa33d51dd675c8a4cf2df1a24a190c71c9af991d71ef9d50a53aab4817679d1421eb5576ecdbc7ebe40111e092acbc2f00

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578368.TMP

MD5 3edecd18ee6edb84a0c5cc2869b57cd2
SHA1 e291fe43a956ab29cd103e3cf39aec8a516938a2
SHA256 74396febec16fd8df1e991beca98541a5417c26fbc44246bd978e98ea81dc3b6
SHA512 30815ff00dbcef7d4b474b51c78c9d9be8ef9145e4dd6fcd8d89076a59e79c01441c62e761a91e13f9b2c03399badffb5717023fb70f6106a6ecbc943a3a576a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3a13a6c4bcce068add3fcf95c7e4d18b
SHA1 f57529d976ab5d6c91b69a8d07b5462ff72cb0d9
SHA256 dc5ec8c71fecadcec190ce75e303f84560f8e63ce843df937e117063759c4229
SHA512 a9a9ac5eda737d1a7204802114ee42b599f47d67e55d18d53593e8e8b82fa2f033d75b63f758477ca39842429ae6e2e6910e5900a285404127cce48d86469a39

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 ac7a953d56ba8fc727721bab6ff8b355
SHA1 52f5ef3ee7fae3d1d7dc4af4ec08211545c665ae
SHA256 e967568b0438aa2df4a5eee52bda6c01b865d8e102403bb53ec161ee963e307e
SHA512 d99955dbe1310ad4637380452938dcaaca46e884dff05e29ad596249801ca4fe5334bf3fcf1b18d44d590420da639a028d061eec462250dd2532fd7480439386

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3ee48dbb7a9e1dab2849044495d8a25d
SHA1 ef21a287979fbbd278e1d98e38f8a18cb1582112
SHA256 bdf4ebbb0426e224da74da30fafa32cff44c3561ab7fb04a71b24fd67c191532
SHA512 b9c288a5f82bf3e7c1a47e3c4aa8131467c77a02b4f907950fb7000beb4a617b369c455d48b85c824c2f9479dcefc88a4b6e807523acd8346f262ecb43da9c17

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 02472f13ea66ef91a35b090ef9363980
SHA1 025b69297302e526f0459d75ebdec31aa7ad4908
SHA256 d7db49148e11a3be41b8f5904e2ccb1953c097d21e79266c34514b678021c2f0
SHA512 77076b79adcc91a1dec51809b5fd8e4bac441b6b7eecd0fa294d471d270c34451cbc9a77b966f5eb52ddc8311fc39fcc273f45b3808a751a106feec2afa1c367

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 e724c612acef958360567141bd1a8c2c
SHA1 fce86c35f7dacd9fa3f5fade3baf89583695d75d
SHA256 510750b2d95d200e72b83d33bcfb3a6c49e29efeadd525318a7f9881a504f682
SHA512 0cf9861eb285bfc8ef575ce76ac8720e422e6152327673ebba65177ca7aa0523a4afddfdec7762d1d9e5d218a4eec2c5f7eb21e4ccbd30587eb42a138ffef2dc

C:\Windows\system32\AppVClient.exe

MD5 f2ed97a46799c7a6c4466550ad208f50
SHA1 6ab22f861065a022216f1241695d8ce5b032bf09
SHA256 b8719f3aae65f8b9c7f4ac7283d6d7d999cfe762e36d8a6e6ca2d604a495cae2
SHA512 8ffbb350ea6d5a96c0b0ab4b6f310d0e85c45a48fa18f6a97f320a17cdf4b1229b4d96f6b42ad0fc98e7bcd7008b2c09779e3fc0aad3db4723711840ce9189cf

C:\Windows\system32\msiexec.exe

MD5 a9f8fbbe70e90dd4ce714ea3495be4b5
SHA1 6c20855116ccc1413a4fd73ff7aacefc8e58c62a
SHA256 d07dbadb58749b30de18c862f670759a6e05ef7578fc14213faa8872568defc8
SHA512 d91861dc92cd74389cdbb818c740fc5ad0919d3a38078394363f77d98c0c138f320622eff751a766181883787b101262c7dcb7732d34949030653c438406fbf6

C:\Windows\system32\SgrmBroker.exe

MD5 f32fad01de235e1ec8f6e6ab13072ffe
SHA1 26c58d4c0ec25970ccea458f578c6f111d4daa8d
SHA256 09403b9e19bf3ea0e492eefdc16562129b2fb6aeae7a2c932ba9bcc5c3d229b0
SHA512 75dd7b1ff6cc531e206e8823b1fb07acb46fe025f0f66a2fafe0bd9389b2c18e241190faa0f36a43f4e4a301c6428842700aad145a3b592842ff7aa864c18ded

C:\Program Files\7-Zip\7zG.exe

MD5 c4633f4bed5f54d040c8c7acbf13d7c2
SHA1 fd35626468d1c1304ba75da85c5a4af8283a99b3
SHA256 654586e493522466d1b457b633bcb67929aae772f392a9682ac2808f7a9ddd5c
SHA512 743372412d6d49f67574e345c432adae6e607506ee1499452d0b7de6d596a306631b02a3636ece35acdf00c7a29842fb8800076a889449c17a2c55682bc60723

C:\Program Files\7-Zip\7zFM.exe

MD5 6c34636ef9da779009284dcb9a76fcc5
SHA1 fdba6fc3bef809f39fd25f713ae1e9a39160fb39
SHA256 2baa4442fed708f940382e1c1199b439dc3ae3f3f63deaec121407a106dd07fa
SHA512 d578e3154f509bbea42377c635de4e3706c138a552af087d3b730ee4ed778a738f5760597f5c353e7e4b6acdb9fe9757320196158efe157e2d43c4fe62070e26

C:\Program Files\7-Zip\7z.exe

MD5 923ecd5539c25053e43b4d76460ed903
SHA1 bf6abe8012660c51a38c24b0f5df7ad06a1cfd6c
SHA256 e5617741c8b8570f64256791c589480dd0b9b8eb3b5a0b71b78913291ad6112e
SHA512 75fa83c3c66c01e7702f6ea67960aaae6458f218cc736d609713f1f5e82c66a61807ea45b01a60e97013e205599f296dc3cc599b2dbc092a95492d89d6cad9e0

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 2121a7e4ccdd513bd86c76ffd710c28e
SHA1 7e0feeb3976c68f54140cf74a5960333d4789d06
SHA256 c3e9c4746d4d2658325c15181851ea03d62b8ee1f4f9c80747ac26eb5299794e
SHA512 db3a5ff78ec329804cf0dc5e94b63cc6a5303af22c3985d9cbfe8dcf6f1cac0a781fde7d4d159747ca8a635522b6b758fcf9508a8067dbdc67052ebf6d457712

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 68500fe97c678268866548d4bcbf9d2f
SHA1 77d529db74e65b3907f75a798faf13353ee66f30
SHA256 0ed6bab4e6a1f4340b82e8efb0eda575d6b7ea5403e93630ef33330a74e56d79
SHA512 0cf9320879b9572fbb2b30c09db0d5628a6a0797aa79b87dee693c246f091469a164e519fa0d559c4db6c7ee5a38da2455fd79ce373a75175b466923948b014b

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 26643a0643b0a64a88a2bc08f952836c
SHA1 f97fa284339b2f53a161d97dd576ba175a2ee772
SHA256 4c4fbeea5aac96d88599561095e7d18288c1e6c075228e24f1250ce643c7040b
SHA512 82f80ce71d2d844ebbdd6465043b0daa36fa3868480cb270a3ceac84962220a0712c52b265bc2074953688b99b4a0ef619a8a9b1fb52ad799b8939799c10b58e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 9288d37c2c0912fa1e29894580d4d359
SHA1 3f929a852343618ddd561931071d2255b5bc3767
SHA256 bf69a1f7c895825b685959a8115ce8a7207d2babaff1186064c36dc4883becb2
SHA512 da59e9b5b2b7ba53610107d29bdbe706be11f8424a5aaed65d110a402283124fd3609ba62250f0461ed91f7713853d292d00315076906dff88de2ec7aa34db70

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 d9e12d90c733ec6c92a417b7bda91982
SHA1 5b3eb088ae459f72e8d4f142430c5fe04eb26c6c
SHA256 55bd2a14d2f56051b39cf1bd3a1da09b17a299b629f9affac61233b9c414415a
SHA512 effd564f12c4f6afd5867e55bc40dc504cea38b868d0ea49f7328ea26af64478900b921ce0c0494e7cbc2fe807e38a84fef6b209037db9f6f5fc6161c97b2446

C:\Program Files\dotnet\dotnet.exe

MD5 393110641a7d54160117a240af735d23
SHA1 acdc38142ea6c9160e269406f5648bed145344ff
SHA256 ae4d2ac45f04f7ea9240cbee58591f2ce8d593f4024eb4778df5863894f82a2f
SHA512 c6ac0fa180ac81a01bfa13978e537eead745182032d525a9780b47f40e37d67a2eb414f2e110f1022fe9d988ec97e2b34288ae7c7f5cedcc833782eca6b39daa

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 734397f3415f37766246cebb03d22717
SHA1 756f3d7f400db8a66c5652eb4809146ea3499adf
SHA256 48cff3c9f38ebc53b1f9ab17a0f010c09efd9157ba1c156a19024371059928e6
SHA512 e33a3c0e8095ce65f24526b0f59962bc58165c2f4e1399402c637ae1ea39f95de3f6631830afcaba2f3ed127717b0f0a9fd14e9086ea02435d82e3ad93efd2f2

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 b05d56a09397f93cf8903079624df6eb
SHA1 f390e76fb1b6e73af89764a5b0c719ddce2c6831
SHA256 3e1bb68c82ad26bb2f8c14595790359ecba679020dca5f0edfe61aac32ebf749
SHA512 9900b0850891803d60209a6c0e156164c57a206859278154bd6ae334f793f5f85ba4bd7e9f6cb9509ce51f11dabee1825760ac350888ebb3375c6856b2fb0ff5

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 fba152b6ed6c6a400b06711429799a80
SHA1 96b4931042d6df631a4bb496f0b13355689f9d16
SHA256 ba4fde87cad0e20a3ed8e1d763fd2b10443bad84a2754bbf1b799f0f0434ecc3
SHA512 1e1b7808aabac06b4ab532f2b4e761c3329910b8f15850940b37eaeb7e68e9dd80137b3075a9441edb1fa9b6f0319ff2c0fec542b4d73fbadbe8b43f9deab029

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 ec4a9e0487803523c79638459dd90dae
SHA1 62a76e052466844b50a59763fc2ae5eb63ae139a
SHA256 9164e980a4c4968112b72f8d2feadd825ff3536c79487aa95e3d576231efd3c9
SHA512 0e3e2a385617992954919e098aa3e14cd8ba1309c4763158fa4e7c1854294ffea9111e0f29ae1d9d11d42fe4d9f982af2f6a3259c7f497e38966af696f52ed61

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 b76cd64338a72e37003c829b4c22ac03
SHA1 24206bc439a7c7db5f89001af1fc6bf224ef7116
SHA256 2812835a861e0c4b899c3b3cb2cca970ae8b26d739bf555bdbf6d7b81849b92c
SHA512 065298946cb265176f0b11b733f4a111ccd5cc3e3d00474fd32b9cdc5fcd995d273f87ebab066711d1ae1872703a155f999af2f21127ce2b2e0a6eb6faa6b1c0

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ab5fcca5736cd8bdc4a10be8bdd902f2
SHA1 12b178f6bb480a3fb60d2436df90d8acd0773ac1
SHA256 74084b7958e2b5f80f01042b73c32676df3e616785d22ccc391c1cd6e307a042
SHA512 92e60854df3ac4677332bc850d34401bb1163554c67c5ecbcf10cde7c586ffe6fd802748fe4df9cdf139fa925c28a50f799258ce9377338297a5d212a40671f9

C:\Program Files\7-Zip\Uninstall.exe

MD5 085994923d97687fe5c6f2e444197499
SHA1 8fa3efaf3ca0c8e1188b90e61623dda4f9ea84ed
SHA256 8f92c0f85e05df43bad49ec16dcf9a7f63d2e78c9503c1c68b98dc596db212b1
SHA512 e9ab6d0af50563eb645e5626a4dff917cac8bdac3b52b1e021ff63264bcf493194586800386ac7480f58be82f10a312909cd3c2869940c603f2ba16c31d87e7f

C:\odt\office2016setup.exe

MD5 d2acf91aa70f4e22d6c4bc1cd07ca8e0
SHA1 d1cbef2fce7a8b50597cea6d599d8e97fb09cd8e
SHA256 0948bcdcefac2541e55ea703f2a08d1abbd3685efea1e04010c584deaf2ad5d4
SHA512 8654f457ff4ffb876523b8dd1af87f4d5aa24417876e43fba107d8a985b9628a4da19e629a42c834d1cbf1f17ef98adb4deadf9c8f3f505c95d93a8da9f4043e

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 f74fefc0b8db0c5368b08296a3530fb8
SHA1 c43980ce4239b09c6c97d90698bea32ece0de65c
SHA256 072a238d15c75676125561e43626945fffd8da9eb88e30ae650799763645f01b
SHA512 7fce52f09dcd39e6282656a1a03e678a7b55f94b2c1d008b2fe7fa7aba036f77582954ec28668665c14af25c860cce9395662bf16d0264a748f23809ad5d72b6