Malware Analysis Report

2025-08-06 00:44

Sample ID 240403-xh1tjahh76
Target 2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk
SHA256 dc83a6dbe5e84ad12476ca268ffedadaf18cc56d9791e24eb14c1049332ed424
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

dc83a6dbe5e84ad12476ca268ffedadaf18cc56d9791e24eb14c1049332ed424

Threat Level: Shows suspicious behavior

The file 2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Volume Shadow Copy service COM API

Enumerates system info in registry

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 18:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 18:52

Reported

2024-04-03 18:55

Platform

win7-20240221-en

Max time kernel

120s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe"

Network

N/A

Files

memory/2228-0-0x0000000140000000-0x0000000140592000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 18:52

Reported

2024-04-03 18:54

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\17c66cf212d07ad8.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9c45a1df885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082bc6e1cf885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a62581df885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d72fa31cf885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be86d81bf885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dace811cf885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bfa0c1cf885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f04e451df885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007135081cf885da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133566439506613765" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3592 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe
PID 3592 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe
PID 3592 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3592 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1432 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 1488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1368 wrote to memory of 5032 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-03_3b1277ffc3dfc5cbef2bf4d39d8fdaba_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d0,0x2d4,0x2e0,0x2dc,0x2e4,0x140462458,0x140462468,0x140462478

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fef79758,0x7ff9fef79768,0x7ff9fef79778

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4592 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5184 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:8

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff775a87688,0x7ff775a87698,0x7ff775a876a8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff775a87688,0x7ff775a87698,0x7ff775a876a8

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:8

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4736 --field-trial-handle=1664,i,13218716527427028562,1867566113353323502,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 249.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 172.217.169.46:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 227.97.18.2.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 213.122.19.2.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 147.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 226.108.222.173.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 myups.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
US 8.8.8.8:53 vyome.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp
US 34.168.225.46:80 tcp

Files

memory/3592-1-0x0000000140000000-0x0000000140592000-memory.dmp

memory/3592-0-0x00000000020F0000-0x0000000002150000-memory.dmp

memory/3592-7-0x00000000020F0000-0x0000000002150000-memory.dmp

memory/4704-11-0x0000000002090000-0x00000000020F0000-memory.dmp

memory/4704-12-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Windows\System32\alg.exe

MD5 93b20bd5501b62d9b60bad7ebbb25078
SHA1 2fc91cbe6580844e025b9d66bb27b39bee4c28e0
SHA256 f3120fc2ab773afebef6c37e89c8d6394630ed262dff4757baa93d4e5177681d
SHA512 e6a119ca8b15e145120da3863a5a766560dc5429291f6875dcde2f6b12a66d40683dcc2bda2141b34ddb861315a595213a3c80fb40d021af5fc9e73a78b948c1

memory/2352-15-0x0000000000700000-0x0000000000760000-memory.dmp

memory/2352-17-0x0000000140000000-0x000000014014B000-memory.dmp

memory/4704-24-0x0000000002090000-0x00000000020F0000-memory.dmp

memory/3592-31-0x00000000020F0000-0x0000000002150000-memory.dmp

C:\Users\Admin\AppData\Roaming\17c66cf212d07ad8.bin

MD5 0ebb874811545078a1a6aaa301d72a36
SHA1 64efcdae502dee5e38c378e5e3bb3f893b6dace3
SHA256 de01ad7524672ec1f3d7d16851610a6998d26542911aa6b1a46bd5e9752f2873
SHA512 088c71d3a3cdcc72e95146d9072db10e5e1ebe143a41325c6fd5f83176df016c8f57873426c14c890e849d08af739fea02e144e7f218fce80533e166dfba3440

memory/3592-38-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 99cc49358cfa3628888247c84b312722
SHA1 72df90d4341e204b5d695a65f8f0575d75d6d342
SHA256 570055b300595d9bee19cd486aec73f2e432043cc1a510b5075bc55da6b32757
SHA512 1b3f0129c396f2e582b6e1316e622f9faf71776e5878c95e71a961e4851f9aa90b651f0e3c3d406602c79f377776df5c8353578f44673359088ba16998fd614d

memory/2352-30-0x0000000000700000-0x0000000000760000-memory.dmp

memory/408-44-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/408-45-0x0000000140000000-0x000000014014A000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 1606f24197c830ca55003020ad02d91c
SHA1 d3b7c0e7392b5597b662a23d024887d2f20d0e7f
SHA256 34051a7216503129a08f0c85e7ea05e801dcd089cb58eb0a867fe425c6d41aee
SHA512 ff9b03089bb174811a3d1ca040ed3eaf7018ce907c480af57ed2cf9f970e26950b49c399058d17f17f0f87088e1fa43aba60bc4cfee57f10e448455dc4a97d9a

memory/408-52-0x0000000000580000-0x00000000005E0000-memory.dmp

memory/408-51-0x0000000000580000-0x00000000005E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 360b3a232dd89694eea94a6f5d51e5a8
SHA1 d99345b1b6062b5d326a281f5d986f380fb65959
SHA256 ec84a1957e0414687d3e27f12eefef579ad311e96c0b5d575e264deeaa4f155e
SHA512 ddaafaf6aabd158bd1a207883fd480029b947288bf866758e150f7cf78c3ddc5e769bbf751ca1783b7b53f8f61d14d1a28fcd6443f89ba48e0b5bedfbb5233cf

memory/3772-58-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3772-57-0x0000000000CB0000-0x0000000000D10000-memory.dmp

memory/3772-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

\??\pipe\crashpad_1368_WKCIKRKXBPELHIGF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

memory/2284-84-0x0000000000C30000-0x0000000000C90000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 b22454b4cea2c5e18b48e6760a772c3c
SHA1 264d287bdfc1104e8478101aea20cf54bf3c94a8
SHA256 ff1dea03dc68c32c90da0ca2beeae7850b77217a406d036325d57c4616dac5a3
SHA512 9d931a2534cbf77ac1682278d8850a674ed2c24db7426f038f12114770cd834e831ac5f61aa37348833f17715c0225eaaa409b70a9691537391b94752fa7a322

memory/2284-85-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2284-92-0x0000000000C30000-0x0000000000C90000-memory.dmp

memory/2284-91-0x0000000000C30000-0x0000000000C90000-memory.dmp

memory/3772-95-0x0000000000CB0000-0x0000000000D10000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 c073669d49e4d6e8893599093af59dc4
SHA1 961f5112b6175874915a63bbb62fe1c67a99c048
SHA256 37d9321e0a0678926b87a0b2494255008cb1272e4879a2fbe18afde25973f17d
SHA512 7e95dc253a32d753f5fef35846a76a14ea219b01b2bbb2e89211a13c0fe6c0abefe2cd3fc16194103ea8b291f3c620de7d9238855d459afb96c8ad1b5e904fc7

memory/3772-98-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5048-100-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4704-103-0x0000000140000000-0x0000000140592000-memory.dmp

memory/5048-105-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2284-106-0x0000000000C30000-0x0000000000C90000-memory.dmp

memory/2284-109-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2352-111-0x0000000140000000-0x000000014014B000-memory.dmp

memory/5048-113-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1780-117-0x0000000001A50000-0x0000000001AB0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 3a80790bd7ce6f998a6156b57d74cdec
SHA1 1f46665e0713473b3727dc17b1b71337d5edc3ff
SHA256 579c33cb3d9c8acaa22f783063042209ec666d8f8521301515ce2754d3ed9c72
SHA512 15cb1d467afd64f01358a06422829b9221bc622ff4a8f612623f2f4dd258d3cf26125dbfa2efcb457bd11d04011d64c0a00d4e30bd717c81c77c8a7868d49985

memory/1780-118-0x0000000140000000-0x000000014016B000-memory.dmp

memory/1780-126-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/1780-131-0x0000000140000000-0x000000014016B000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 5314cd9be23dfdecc44856cd24c3bf18
SHA1 d61e2edeff41bffece9153df701cb2da74ef2b6f
SHA256 e87241dec9465625793a2e3ecb75c5982c71ca5291ea9cb4aa1a29614b6714f8
SHA512 e5807cdacac02c81bce8be70ee2099c9748d1b3b0b8f68e6ca990286063f0462cac95f25e3e1d4ce76597b4edbdda4bd6916eae500318174db3a108fe96c5623

memory/1780-132-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/408-134-0x0000000140000000-0x000000014014A000-memory.dmp

memory/3068-136-0x0000000140000000-0x000000014015A000-memory.dmp

memory/3068-142-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 439b7be9a8341178c3cde95972131469
SHA1 0088a4de42b270741986869937baabb2a66b90dc
SHA256 b66a81e265d95456309f887c89fdf6af4c1d8094629fc4827b876ece9acb649c
SHA512 c46d6d200d69cd08baca259b6c5769977270898bb0aac1d6b1b2f1ad27f5f0a195c80bbf8d48e15c23d9121a7a3bc9ff4fc043e1870906ad19d5577e32602498

memory/3952-148-0x0000000140000000-0x0000000140170000-memory.dmp

memory/3952-159-0x0000000000420000-0x0000000000480000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 d74168904ab94e5353b7a47d36714c75
SHA1 1b514b025109695210b3e45e2828d0736e106708
SHA256 f473894c2ec033685bf9960d889f4d96a09f5c059412da4a85d16dccfcc505f0
SHA512 3c1c437d09ef95406d74cce113d24c060677c3230c775e802cb36f6e4987ff9f3791d15d19bfb435c403c0a00e82c94808db8401237ad2798b4d778ee85de9bb

memory/4436-163-0x0000000140000000-0x000000014014C000-memory.dmp

memory/4436-173-0x0000000000B30000-0x0000000000B90000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 63dc473765b76329ce28cca9c99c067a
SHA1 2d22e807871daee35aa47cb50e27fa73e442af8f
SHA256 3a01126b0c94566086baa0fc3dd61f1f8190973f6433fd59bbffecaf23863b27
SHA512 025e77770e74fee79cab9c3f27167d21f98baf8cec8f0f7ba973304fba73f5f39613a6720be9402607484ba08a7f0d986c14209b1b29ed4e938f378bc8e4169d

memory/5048-176-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1664-177-0x0000000000400000-0x0000000000538000-memory.dmp

memory/1664-183-0x00000000008B0000-0x0000000000917000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Windows\System32\Locator.exe

MD5 82910a28dfcb646154317e90ad785a5f
SHA1 dadaa087be9bb30d5550e7bd980f022553446d62
SHA256 82f45f7c5cf669f3830103afdac1b765c2d6d38f394f5514ba32ba7a3b4600e1
SHA512 bb63a8851488c44da367208edfcc75623b4cbb7baea1a2eea9d199e2eec533aec123f4b8cb964b16bd8e28d6f54da102046d6914a74447bbdc38e5867a979b48

memory/3732-195-0x0000000140000000-0x0000000140136000-memory.dmp

memory/3732-203-0x0000000000760000-0x00000000007C0000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 7ebda47c3c979bd7492446c4eb036858
SHA1 c6d0342a7770fa64de8d0f6c8bf69c10abd2c61b
SHA256 1f6115c5afeb410a281da8dbc60598ea98873cfccb9d098c0eac6dac39512a25
SHA512 88ad6ead53ef2f5da982ea3bc3be960ea853920429eccf886788b7a0827ea41c88085ab7fcb5bf0c7159ee51ba32cab4b96866ff5356e60cdccebfbe9415eef9

memory/3068-208-0x0000000140000000-0x000000014015A000-memory.dmp

memory/2440-209-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3068-217-0x0000000000D50000-0x0000000000DB0000-memory.dmp

memory/2440-218-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 0c5c5267f6d5df3b432d7a34cc75c07d
SHA1 b1f257b18f60f9ec9e1cad4419e5e5c6e823ad52
SHA256 16e2a7068c4caaa8c65b77ad2ee6b7147418fcef6cb3a2886a310d5b8409d8ab
SHA512 7e7e60a6f3dd21bf7b234a237cf06603228148155ca613a65eafb9eec94840eb84d8a253c433c106ea6fe5de0f03a98ea75bcab8ec331c354f191d0047fe2fd2

memory/3952-224-0x0000000140000000-0x0000000140170000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 a9234ad8c21c8355a193e81c6b5f4c8f
SHA1 7743e4bccac6859e9ff2ec0a088947080003a83d
SHA256 df8056bd81f858ccfa23d222e53b925d775eaafae422a82a6704cc5bd1aba198
SHA512 acf3973e0a56b82e578fc653cca6366281a6328fe7f1d4ecc65b3e6bfae06d60768fd479699fb83a1eaaee6dc0f323b11174877210365d7c7417aa453884afa8

memory/2104-228-0x0000000140000000-0x0000000140137000-memory.dmp

memory/2104-236-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 4bf113c65a44875071f686a2e4bc37c0
SHA1 86af661d47a308155a6373e363c10a43fdc2c0e9
SHA256 9a53c8ca113e14119cfeaef8e964058cae6087daae1c09052783882c96357596
SHA512 45533bcb8523e9df86992c38d20d82cb0ea4b3f3a5a69717777ccbf350cfbde8c3846c27148d0edeeccb84cb3061fdbaa41aeb36ebe2885016ccb6d06c655b66

C:\Windows\TEMP\Crashpad\settings.dat

MD5 a57e00e7b64144dba402c6db0f7ad149
SHA1 51a33fa8f038784838ba3a6c0fd16cfccf49de55
SHA256 26345f4eaae9348eb9da6a4c6101dc723a2cd58c0f15d93f5c1ee628b6957fd2
SHA512 a9d626fbae4b1da4d41e75520ebb2eee98cd2a4b9dfdf5f264e574b61f1acbf34c0bca6b1d3e1212ce37c8935a50817c47539b03030e1665a7dcc3a18dffa739

C:\Windows\System32\Spectrum.exe

MD5 17334b9c305015a74c8cec8b45581190
SHA1 303782eadac220bf869da755bd53a6788051d2c8
SHA256 228282d6af7052dd89dbf3a8d2fbdd0ce757d48fad41f4223e3f8f2c4f899b4e
SHA512 584ebb5fc200c6d54506c542b81a35b683497bf417a3ed8f6d1345399ecddba54433f4c140493876c0f8df8f3c9faf8d5d0466aac3b7199ab11302f2f2d264f9

memory/4436-241-0x0000000140000000-0x000000014014C000-memory.dmp

memory/536-242-0x0000000140000000-0x0000000140169000-memory.dmp

memory/536-253-0x0000000000790000-0x00000000007F0000-memory.dmp

C:\Program Files\Google\Chrome\Application\SetupMetrics\e8fa28ce-7658-451d-bd8b-e18392047c27.tmp

MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 7bc4b42f6f6a632f09b73658b6427381
SHA1 33e2fb30953eec756827508e164b3f7b9761a6d5
SHA256 f0d107d3100b567ce0ac41fce0b8404f74584d473f3b5b3a0f909934545dc619
SHA512 c7352adc45d158c1ae98f7eb5d055ba5f0079825c57b2ffa1a2bea10b6998d2336660ab7d251b4dc541a36f3e731e26973b0516fa0560e865bc59a3440b7b59a

memory/1664-267-0x0000000000400000-0x0000000000538000-memory.dmp

memory/5412-269-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/1664-275-0x00000000008B0000-0x0000000000917000-memory.dmp

memory/5412-277-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 241b5e832a4be51d735129549f4b4ff9
SHA1 44859dba1361e2a154ceab57957e81d1d329904a
SHA256 5b663d10505982d3bb90c40e788973cec21f141c49f8aca2c2543bf67bb6b283
SHA512 130cbf68e3ad1ddb5d866da30ef4f7d36990115eb0bcd3b918f4456ec143f9ebd590534b85f5d27f2458a304ca251eeb4d65adb7001135779fa70a4c1383a9c2

memory/3732-282-0x0000000140000000-0x0000000140136000-memory.dmp

memory/5628-284-0x0000000140000000-0x0000000140183000-memory.dmp

memory/3732-292-0x0000000000760000-0x00000000007C0000-memory.dmp

memory/5628-293-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 dab66f8f4ea55f274ec1d2739b445ea9
SHA1 8354d27ba62556a669c5b69c31d345632ef21800
SHA256 ceaf3d275bd04f61386f579983d4d84303dd2a054d52de254087bb089327bbf3
SHA512 2a37deacb3d705fe8cae16f8eae982a3764dc00bfb799ca58f215e51b25b631fad41ce45ab769511e1648e379a8cf46a7f6c4dae899d56bfbc0a4511b02beea5

memory/2440-297-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5768-300-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/5768-306-0x0000000000BD0000-0x0000000000C30000-memory.dmp

C:\Windows\System32\vds.exe

MD5 fce0d065e1e7e9bf68f9c5dba111e276
SHA1 779561a80ebdba8bd4d893accfa57f046240992d
SHA256 01c945304c7764762b514561ac6a8501bb0ef5967e1f03bb2970b1b6e25ad227
SHA512 4170a6073cae24042c3408fda785871447953535be9e70b7b484d9b2f51846db42f07667aa2c9a62b31c456cd0c7622404ea73fa8924c0ad36cfd7d1b8dacfc9

memory/5768-314-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2104-313-0x0000000140000000-0x0000000140137000-memory.dmp

memory/5768-317-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/5872-315-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5872-324-0x0000000000C00000-0x0000000000C60000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 05a28b300f825a8a4e05fa952d238ce8
SHA1 61c0f1fdae37d280775d6f4c5fbcd920b5761692
SHA256 00859a00844f60e0617a1d1a2b885a6c4fa1bea883f75e8bc486efb0fd38ec86
SHA512 5f5df0c9404141eca602deb7e577f62d947104e6d769aad38f779ac3bfd361ebbab2332a94755da73dcce74e696f7109cb30701a42deb3613fdf4295d2cd8b08

memory/5960-327-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/536-329-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5960-336-0x0000000000750000-0x00000000007B0000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 bab186b416f28649269feeb9a37bade1
SHA1 884689cfddbe267cf5f2164f6ddc583b0089eb96
SHA256 2c0e6ab7c57200f5ab5b4e7183763dd47b4182f6b252cadd3d53671894883a94
SHA512 e72eccef901f22d57b0849b7710dce36247ba1a0923ff98d3ce4fb4b87e0bbd30296a36d97e5fa90dabfd7ad9cfa2acba662ca40094fc7b2dab9518cd3bf0c79

memory/5412-341-0x0000000140000000-0x00000001401A3000-memory.dmp

memory/6088-344-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 c1005780a94c3840ab6bdefcdd5d98de
SHA1 2d9e88726889f4ee752e9db1bb55c76cae5760b8
SHA256 fbb1800f67931b282f89ba0f993c72c6ab9102ad5d93e9fd686d77e17e926abd
SHA512 7bc64744857ff50cb9f2ee3465f200818044dff51e06a68664f9a4e9ebae6122ed2c19071cdd11ad40de84dabaee626c326eb7488172a1f542ceb6190d60d908

C:\Windows\System32\SearchIndexer.exe

MD5 f5325867fdede938d3b9f75e083d9bd6
SHA1 f575a5a838c473a7a593abf1328e9066ca683c0d
SHA256 8c64451cb686eda593c13431959f41bd0bfa170eb7c599ff780a3cdba0e22541
SHA512 85a3b4ee569ba88e648f9896c9a8de052ccd5278c9f52e1f0d607f4c6846dfdb00139bbd61cf01dc780ce0cd17190561743588b3b520e2cfe57659b816fd3b74

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 21f34ddf1d5900de2e4fd69c27bbab06
SHA1 f5043f763cfe94439b52b4a655adc941b1439267
SHA256 7925f2bdfed2caff1e2fb96274ba3865cb164380521db221428b3343de93e75f
SHA512 fe8b5e94898b08da8f359b64621aac24be52b64c6d3558b2810d089e2d2dd4dfc866da2edb5dc9d7a5b63a5d72c4133124e2bbfe8bfa6f77b1cdf54c149d3f7c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cd68bb31fa87d9489e311cb85ac281e3
SHA1 25b53ac1935db6b2a6cc6271576c9f0590f98fa9
SHA256 16a336e04526fb5ff954e7f6d7bb3e2f861e0f9467aa727453e7dca35bfabd48
SHA512 97fc135b4124cabc2ed186995fee047a96e4cb9a2521101800f7102b31e90386b0cbfcd040fedd31e2700ca8151a1955242be30f0a6c231f3b4e499a7354bbf9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe577927.TMP

MD5 9789813c7b351abcd4b4cc4821874f82
SHA1 3c3839cb1e6fcbd66f3c6dfc092f3aa49c057c03
SHA256 899961eb96b3c34c8a0b0bed8f6e6d81c5979592af5cc0144590b71e394bf7b2
SHA512 9c8dce395a863812d3b050b5068e97301309e46ae0c69f6ee0f8539f3dd453d269bfe4865d4afc6a8518e4b85ac49f8901fc937ca19da27a1e5bd178e3774a76

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0cac178b7acce95dcdf48ccb7b24ffa6
SHA1 e1e017f2f57dfab1dbec8dddd8ab50f24f0bd5a1
SHA256 c8b4a7a057127142972ed7d9716a07bbcbe0f1d793947912e53a4f327131be3e
SHA512 366951343e06485a1d324a83f86f5fc1e0228d018c5579c37a1d92cc9038acfb8275e8ebb25a0697c6e21486e1f8fdd922b8d11022330cdd4a45d9f730f2dc44

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 fae2c59a63fc6b09e13136902ac98d14
SHA1 730dc6d361705f04b9169ed041da07aef32b34d3
SHA256 e4c85aca377becd6a5814280e05995d633d07ea88af243ed1a3de39985c11fd5
SHA512 8b853dbc6e9f8125014d2d406a82746701aa092724645bb2d8b0feda0cc1f284895cebdda7684177a9232b0f8e22b384f122233e92c5abf924fbc0b6e36a418e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 880d29c16df016558573ad68f0b7fa5c
SHA1 db4b4f2bcdb23cb6bd4b72dc778d7054afe75303
SHA256 507263f4664ec33a2537dc68536cade5c1552031e372c48f3364bb5141453dda
SHA512 b529404d00f4c8bf008a43abef0464f561744a03c41f3c012fcbd2c39798cc5981f4694a6412a9e93f6c04c089382d8c7848be5c42d81c5df719c00909f2d96e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bfaf367ef16ce0d1b955d7f574b00ec9
SHA1 9cae9d6d20d0fbad03c6bcf3ce5929b372cf1916
SHA256 20d74243e0388f9475d17f760cdda910c6256af714bbea252c772d0649e12b13
SHA512 0a62f2279ccc7c107af7cf881a93a74294de9c403b2699989e65ab869eee1ca1056b58b7ac6942abfab1b97c0ed4eb277e1ade7108a245daae1bdeee41648802

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 59d94133b299a521209ff6abc7944cc8
SHA1 1fd32d7bd7ce6c1922cbf1d9bfba764825a6dd58
SHA256 bdd1648c5a559490f63c7f4dfea70c7910cda5c5a50956f7e635112022fb1a5b
SHA512 53c09557e20ce3caea9feecb584b2437827295d5ba1228d69e4c24103b45456e25ed9646092bbc719f2c3f4de1031424cad13b16bbce292bb912c39b064e3850

C:\Windows\system32\AppVClient.exe

MD5 965953437e522de4e673f02ac70055c6
SHA1 0d776bad097d2050923608ecfcbfc625bf8dfdb5
SHA256 f680d0cf326047bf290d881167cc7e6d9729f755c3924b8be4754f0e7c8634d0
SHA512 57c5c0ee3cc9da73f9f9465b09e39fcebe8c7a6d073906477f471d54921cd98ea12567c63925f3af0efdfb6a740ab6f93bed810070f829669866b5d6f99a2085

C:\Windows\system32\msiexec.exe

MD5 e22096e3613963ab9381da50a5225cde
SHA1 93566d77b1f0072aec87d406143f8db76d281766
SHA256 83625819c9c68dc6706b2b69c4f71b3393817b40990a53551ea6f5f9ac1e48c2
SHA512 16a236568c86c4983e25c4486179338450ec3c9921028a475d8d8d82a000f7ded20b3db16f2a0f7a0a6b985a05e5d8c1066587cfe090475f51efa2d2cbf8af3e

C:\Windows\system32\SgrmBroker.exe

MD5 d3823a6e307d95963df6c452f2478957
SHA1 f97cc9ef4cbcaac512a82fb8b4f8333f1a8da944
SHA256 d94d8465c1e92917d5e04c76c1658da7d8a30769f995c881f946cc41c0779c60
SHA512 d074e2ffd7ec1d7fe75ad8c4a0732b5eb64f928357c98a1b50cb9d166b89250e5c25ce6b0d1bad0866d5febf376e3234181bbace1aff7fdb6dd66e996f7f2f15

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 583ed6653ca09b639ff027c856c0f5d2
SHA1 1e060c62cb5fbf9afa737b481b92668987fa1d7b
SHA256 11020455ebe25b5732a649512f10ecb0b281185f0effce9de0406b8342cee5f6
SHA512 ddde4d588ad03aa34e5ac2fe08f145ecc240c513d5bb4dc187db29c7ab3acd74f0b7ce3548b62e296c6ba610429871f2f1831df9099671994d6208f21dd95641

C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

MD5 17393ad59ad978ea4a547b88a2a65c1b
SHA1 57794b3535a20aaf670012fa4c6fd1af5697566c
SHA256 524039c830fae4d7abbddcb0970ec51c9b7c9f474394510844d392eee6d318e5
SHA512 58d9b6c5d59921bad0eece999055f568af0b9474dbecf239ddec777c20275cf99a6fc4613fa74b408d3f4060b437d14f9ad8bbbd28912ec0f92608ded18ff79b

C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

MD5 de60da3475aff4a8c7f6782125695aa3
SHA1 9f449a2fca3d405cd348ca927ad7602f86b9c04c
SHA256 c330383b56b7b2d7a477751d0a3c5f046fb5580dad1d87581f3c1990aa1baf4e
SHA512 d68cb5dc530add2e7a0ad09b285e54e271c859f7af3c89e4c6733681b2259d3848e017310a775bf92ee794e547bf5396a219802eedcb7c419b53c6baf169c88e

C:\Program Files\Java\jdk-1.8\bin\jps.exe

MD5 22ba4d895bf16bc9561434dda4f06a5e
SHA1 ec87612e73b617593705a69738948b7bb4d41901
SHA256 29a092596a2ade2629370de38b65354874facf591f534d708ea277a0f7d4bf92
SHA512 73d00617d614a96297ef25a00ad2697de82136df156c580d83345c51e51ea7a13ce5d564757751569903fe072bedd9547b164f6e2f205301f6b6ebeeb2613efe

C:\Program Files\Java\jdk-1.8\bin\jmap.exe

MD5 59d686d69ae10402c539c370250fcf23
SHA1 93398570d8e6f1b1c739cc35bcb8ec9e89e881df
SHA256 23457159da238754d90be73b05cc7d8f14fa7dda7c6c260622250162c579319d
SHA512 621024f2a9c0cbff6a64ea416e1a5497723e44a618be8bb03d295240d4c3506f5d994e77d14004c47b1dfd134c76d1cfb4c4fe4724deee2a83e93ae8b20be866

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 0ec71799a78b1b3cab6e4a1290b92a85
SHA1 3d41c7c0d291b0d7a0327dcb85cbb4d31399c7a7
SHA256 99a122e2eeb8adf7afdb3e8b0dd46dccf992a190d7a8e3e4c3892d8076b6f6eb
SHA512 cef268831c1f344a674173a80935bffa00b3918771c03ee344e7db1f3ed004e94090083da08a4170acb821ce6b4a927c91c2b20f19507fed14e8777bcd1009d8

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 62ce1503729641be1bf3d8d84caf806d
SHA1 1dcd32a8dbf7f5b72a7b6ade737c31606c0eed02
SHA256 b7bb9bf49c2a1d5db500f32ac3411503ce7efbd3849a99905b7bcd724544ce53
SHA512 7253564647d77b5423af954ed27cbde91a194f5728d5fcd8ad390d282afe4a1b07608c1b46cb3d778a95cf75173002937491de3df57e2071de1c3927b72bdf24

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 881cd2e3edaa4c5b676c28e9e9101167
SHA1 97a207f662d66cd66bc11d6e296dfe6ec057c71b
SHA256 77fbb37faf8be38186959ef74a743609d103e8f1a0ecefe64355d57c4ab83e2d
SHA512 b1003caa13e9a03b49e528826a2b4751e4c8bd9e97dd60103556096d98faa83b9a6af41ff3d161b94d2794bc8bf394ad46f5e9c0360da74f36d1908a449dc3bb

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 a2f383e7f03d0c06b9729b5f2b379819
SHA1 aa5710e193821d605bce88dea8cd4c863129cc46
SHA256 fef5388ed0d6ac0dc51b47fb40c084fd9f32d70e7650123086cf5e30b40867d0
SHA512 3c698e8bc83a28994184a4ae704b855e2ea826ec47600df4dadf590f4ce212a0b8360e6653992bb953f4b3897eea43b32d1cf6629cdf9cd44e2d373aa62b1dff

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 3c6d9e114ffdd6392c676ef76d2b238f
SHA1 1c400fbdd4c4a6a1a438fb6641f0430e97489265
SHA256 894a6aaa6e80990d43a743b8ab944f5beb633061ee39e04fd89986853d337174
SHA512 859eec407f2ecdd7e0602e9c3c44b1bc5e109b90607bcb8c950c1cbea519da12e5fbb64e8288a62993c4d5214bd0398f304c83e1ca2295770b3f778755d49c30

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 34f69800b9cc93f93fd2b19cbd51e451
SHA1 95a855b4b29aa8ae5c8f454aa31ceb155407bfcb
SHA256 1bb2a8c2387293fe15e114fe9eaa3056c3ef5dfc06b647fa7b25463c383ff441
SHA512 01fd1660b31f674c04274deeb2bb986072859d3b2ea9049330478f6de39ead517a93e55434d48edb61f3b8b56755d2f771beb9887e9c0b982a0449f0bf457e65

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 f5216088d50d5efe505e3624219026f1
SHA1 c9c347cf9a52943f9de3e6790c5dca6204f18748
SHA256 fd6045707e890ee2f12d461430a1f60dbb0c1c70c70e88040b1bd1e025f4d791
SHA512 f06dfa187f30d7d7c71336e7058107845aa85c956b86148aa7cd8c15b2d6851c4e6f84b6de6df1aa0c231407c4c93ea3513f68483bf672beaec60e17c36198cf

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 a29a5025c079552cd3fe781ac34fb8d8
SHA1 31f1ce762533400d448bc6488fa789c914f95bb6
SHA256 c7c3995e215842022ce2678a98422d8a617d2ccf0d4058d7ee2879f5542f3189
SHA512 3c91e5dc6e1835e4dd241a8a2e2bbf9c4710818fb1e64987f0a990f6faf21bcc753553bc23a54c9dd34a6a76fc1b802910595486e03196a007effbb729646a2a

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 2ef53c7457f19b54b6b9c071597c1b8d
SHA1 e4d73c7b7b066c3ae4aa739acc5f757ea27f2ca0
SHA256 eea126557b4e4955f7d49713dcee217dba17fbbd3efa7ceb059d3f92f5927327
SHA512 605d7ba9db8edf7c96604ac25efcf032d065b85b5010f8ba46a00acbfc9ca7a902467f2b61059ef06284ca26817bfb53500cf5068096d61efd15ba946e5659f6

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 509c88386ae0e7dba1156695b62178a2
SHA1 9c257c68c34c590228dc915f449081ccff914998
SHA256 cf43cfd45bd7972b80775a9c1280cc3cf623e43149b4b21ed4a18bec0f9b7957
SHA512 6776396598ddc4fb9c0974ea8ee9c40c85b3a398f06b010b05b7e2e90fdb786e4864cb92a976841b4daec1bc4839a974966ac883b9387119a0caecd44f30c047

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 d39d5a8f005cda9d9081e8466e7910e6
SHA1 89be85b26be3df0d467ed07c9b430b14b0e6a6a0
SHA256 5fd6c970d197d1e72785a2f2b5f2f9652255924b05471f65c2e51ee2bc51245e
SHA512 7ce23688935b2ca6ce2151361c4cb25175cb010eb9cc6a8db9074a8e334ff31d9c577408113a5ef3e21794d62a92c677e9eea8b77f60b56b05d5191712a3492b

C:\Program Files\dotnet\dotnet.exe

MD5 532924ccb33190ef0c29847666ef2b96
SHA1 e2d794f7de262200d8a5e5cf805ee22d4a71069f
SHA256 0cb2b902b0ab9bff262b5edafc3106c87f1edf9f79d1877043f570dca326ade2
SHA512 b0b6ad76341a9bb008cde32a4071733e15fc53eaa1891f1b9bde9139ee4c5fc85a48ddbc5f86d8b33ff6a9ed5ba335fd477630b28ed0c23bd012c89f4b20dd1f