Malware Analysis Report

2024-11-30 02:43

Sample ID 240407-t58acahc38
Target 2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk
SHA256 0f43ea770c1f04c5b14224d53b65a1ceedf2ef53a65b88acc3466d767bac015f
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0f43ea770c1f04c5b14224d53b65a1ceedf2ef53a65b88acc3466d767bac015f

Threat Level: Shows suspicious behavior

The file 2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 16:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 16:39

Reported

2024-04-07 16:42

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe"

Network

N/A

Files

memory/1896-0-0x0000000140000000-0x0000000140592000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 16:39

Reported

2024-04-07 16:42

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\58421d9b205991d4.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77375\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4af4b370a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ad2ce370a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c8a25370a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a7cb5360a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9d652370a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000139b76370a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe114e370a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c2ae5360a89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4792 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe
PID 4792 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe
PID 4792 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4792 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 1376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 1376 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 3716 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3828 wrote to memory of 5080 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d0,0x2d4,0x2e0,0x2dc,0x2e4,0x140462458,0x140462468,0x140462478

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdf329758,0x7ffcdf329768,0x7ffcdf329778

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4520 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:1

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3744 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6d8377688,0x7ff6d8377698,0x7ff6d83776a8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6d8377688,0x7ff6d8377698,0x7ff6d83776a8

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:443 www.google.com tcp
DE 172.217.16.196:443 www.google.com tcp
DE 172.217.16.196:443 www.google.com tcp
US 8.8.8.8:53 131.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 106.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 196.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
DE 142.250.186.110:443 apis.google.com tcp
US 8.8.8.8:53 67.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 110.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
DE 216.58.206.46:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 46.206.58.216.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
SG 34.143.166.163:80 typgfhb.biz tcp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
US 8.8.8.8:53 oflybfv.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 34.94.245.237:80 tnevuluw.biz tcp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp

Files

memory/4792-0-0x0000000002090000-0x00000000020F0000-memory.dmp

memory/4792-6-0x0000000140000000-0x0000000140592000-memory.dmp

memory/4792-8-0x0000000002090000-0x00000000020F0000-memory.dmp

memory/408-12-0x0000000000800000-0x0000000000860000-memory.dmp

memory/408-14-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Windows\System32\alg.exe

MD5 f6c5661662f61d84a5acdacc56cbcc54
SHA1 878eba212e155baeb7d50264f9efbcf56418ab45
SHA256 c9b09a2a491b8ce96dc427755c25dfcfd9188a2deb0d9e5ee42a94bd5fd5c9e8
SHA512 2dbb7f9e931ee3db933960aa36553aa8d8607556311d3a00fcfa2f1a6626e6f4cc0245042172b56ab83ccb99b34a0493a3368edbfeda374331055c0b5cc31b28

memory/408-20-0x0000000000800000-0x0000000000860000-memory.dmp

memory/4640-23-0x0000000140000000-0x0000000140191000-memory.dmp

memory/4640-22-0x0000000000720000-0x0000000000780000-memory.dmp

memory/4792-28-0x0000000002090000-0x00000000020F0000-memory.dmp

memory/4792-34-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Users\Admin\AppData\Roaming\58421d9b205991d4.bin

MD5 d56994eac6cfaefe6a040bf63de8e54b
SHA1 65c65a8d66ab0889cd1f2f4857ea9e646de708a1
SHA256 a08986a9115947ec5c02a04c85b3166717518ed3df4aa8dc7739990198052a04
SHA512 1ea1fd611086f98f3a39c3c280f7cd7276d06944e8f6e52f454ee9c606947ede1bb54bddf7e7c61019666e30a87a818d1443407488e25287ff572a9ee655e87a

memory/4640-36-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 d98a862745da89fffa1a305d578048b9
SHA1 59c750081af110ad27f4a360bef4ef689b0fa519
SHA256 2d1a2162f435610d5e0dd4650a8e71211f1a25d879a94d11fc06c111c69a23ef
SHA512 d7885a29a75646721b631f736bab26191a0c79f7b32b1e2c7d1cc79507ba80a598d9bb9e967a10cb522d6f8c65c1a8eddfd96d75ccb0914947c09566c7642dec

memory/3552-44-0x0000000000690000-0x00000000006F0000-memory.dmp

memory/3552-45-0x0000000140000000-0x0000000140190000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 932d4b693757f9f71d1e0f1cc14ebabe
SHA1 653e044600e4b96d754b2116f4823f6a277ccb76
SHA256 a2da85493ad32ec684fcfc1936e3c5f159b78a9f7c385331560d705dda2017f8
SHA512 d4ff51c81883799078b240480923a3a0be3824786fbf2a688e2ba52200f401416a19bfe0889bb699cfb454bf2ecfc7003a9bd88a8ef75039575f989aee6d8383

memory/3552-53-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 ce431ebd7bd4baf918a04b136276b581
SHA1 3bfa5ff5d63b7cfd2cfa346db76ef0129e7fe4b2
SHA256 5bf90aa258cd806456239ea878a12d70afaab9250530075abff7f7d1dbe84436
SHA512 0e09d60d29dd554b6f52b279863b81d5597c80b0e4006b16d7cfb0103404feecb1437ee5920876cc42fe261731b753b7e1b9de64cf9b432e1bc30548f6d30725

memory/4240-59-0x0000000000730000-0x0000000000790000-memory.dmp

memory/4240-58-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4240-65-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 636e36130476965b5eb4398eb60f0097
SHA1 48a7f51b046bdb8d38df129488ef74f86ec4ffa2
SHA256 6095b64f38812307f6adae7872b16157f4451f6c0c7fde0f05708b7b85507321
SHA512 5495986707dd4dd50492b6487597bf3a1b429bbe5e54ad3948621eb4bd1a7b870fe1486f903f91677f6dad614e3730dec8e72a55e2571d499748004843bff1bf

memory/4212-69-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4212-70-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/4240-72-0x0000000000730000-0x0000000000790000-memory.dmp

memory/4240-77-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4212-79-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

\??\pipe\crashpad_3828_AJKANOFJTBYKFORJ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4212-100-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/4212-103-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3736-101-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 60831d13733a8df4976ed2bbc2cc1426
SHA1 15070c0ffd44939112ca25c405cdeac63220305f
SHA256 946fb8465e863f9b94e495a4e20e113aec9a7c2e318c028f1894dd1c22b7b1d7
SHA512 1e2102d9491894601b107f745076175e5edf719658b4d215adabb797601ede9d8887ea4b370136ef5d385b8483ed0956ec56e7e7533149199b87596a2a426d81

memory/3736-98-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3736-108-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/408-110-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 9eeeb03b787bb83dfa3c6a3f26433397
SHA1 71ee01e3d8d4993536c0f226faf98507410422e2
SHA256 319a327f941585512a072d10844e2556a9ad24d7cd161425007e873d5854931d
SHA512 6e43b147d822bd7e197af4192db90738e1cbda5376c08d614ae305f00fc8bba72bff1aadc763098c30777cfa3d34a2c28579800c74d8caea2075fbed4c330323

memory/4640-115-0x0000000140000000-0x0000000140191000-memory.dmp

memory/2760-117-0x0000000140000000-0x00000001401B1000-memory.dmp

memory/2760-116-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/2760-125-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/2760-132-0x0000000140000000-0x00000001401B1000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 fcd82f93a74b45bf11e8773cf1526365
SHA1 31b3d6999fba74702e273d105a043ea7e35bf51e
SHA256 527470671ec89e4db85110e117bb255e0fdf69311e9a7a9c7cdcaee0458a47bd
SHA512 1609d675416809f20cb84e209d82a11f7cfa9519b847c68180c12811f4b13877c7ea62573d4b3f9ec3280118efdf270aa4594a1bea124f6e90853f4ae7bcd27f

memory/3552-135-0x0000000140000000-0x0000000140190000-memory.dmp

memory/3148-136-0x0000000140000000-0x00000001401A0000-memory.dmp

memory/2760-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3148-145-0x0000000000770000-0x00000000007D0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 bdfc2b859403181d74fc7824df2eb8d0
SHA1 5d242d8799ae7740f821b37e678d2bc8d88d6970
SHA256 1b66989b9702e618fedabda07e9f51b0f806c0a106e2619d1ba9aad484d59f4f
SHA512 1beaf763b0fa2b97f2381e566784c6ed3e663831dfd3ab989e36bfc97fd600a48abcc1af02c34d66f126c3fa8982c695748d77cc7a2739ebc6c8a1c60388bd83

memory/3392-159-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/3392-167-0x00000000004F0000-0x0000000000550000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 ed5ee6daa0ca12d21a5470df9d4b737d
SHA1 b348cb4ab422fd4daa66f1e6ccd6851130454b07
SHA256 4feb7443de41ce6ed30a6221f5c4653ce93d834233bb13cb911e3dfed0257645
SHA512 6f79ea04c7c7fe24a5e94a1a8f463889a0fc15702068de12e87e31793a4351dc2b2a894c2d288926d45a803a809fc0fce80b4a331f2333604746e99c66656ad1

memory/2412-170-0x0000000140000000-0x0000000140192000-memory.dmp

memory/2412-179-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 149be38f867a8c11288633a2618e6be7
SHA1 58f38e1cbbcbf10fae625f97ec865a1828a65a33
SHA256 86c6ebab5bd5aa802fe651a2edb790604abc3cdc03ab561bdf9238f2b8f5ec91
SHA512 1689360eebc16373d486e610ee81d065b04a841bd47fae397f6fdb83d1a83ec4593e45dbac4fd00ab12526c4886f86fc439154f09ba5400324ede4f14584c119

memory/3736-182-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1280-183-0x0000000000400000-0x000000000057E000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 75d8d50bf5252ecd53192c2e419a5420
SHA1 a6be45e0e9f3f49af5692d62abc7803149b318b7
SHA256 1d2e7d240c0722a447cac150b4f200484979a4e489f2752cffc08b44392f8552
SHA512 519a90488d00158a905b8a2fafb27436c218aae57b7732c0aeb02219dea932b62ad39ae0da67955ba90ec4b649d791134709e721fec2558b20bec55202c0d793

memory/3936-187-0x0000000140000000-0x000000014017C000-memory.dmp

memory/3936-194-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 5852220f485bc1ea34511840072be800
SHA1 9e340e64e6e041629950b62ea67655113941a5b0
SHA256 53ffeb90c0048cc0b3202ddf3bc7ce5d834d4e7099f0ef8a0ef947e6ad3c1e26
SHA512 d3eb68e8c1729eca355015a0add6df199b27e95dd0b9d76531e20512d921107226c0566041d5118e14c5fa20ddc73b302ed6c5a300baf24269119a95f1bcf656

memory/8-199-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/8-208-0x0000000000740000-0x00000000007A0000-memory.dmp

memory/3148-207-0x0000000140000000-0x00000001401A0000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 8645197a4d9c2bbbeb58812ae79cbe3f
SHA1 10a06c9378efa1e42f44201b54512a193ef0d696
SHA256 fe9d0dc21eecab76ffbbe465cff2d37a76d7b9f0bcdfe8a8fe9242e5b56b6b1c
SHA512 ff43b8c5b25d0629da309119195457b4c5c3efd5e3d2979c22e3af38c51f73ac1fe6dad9e79199ad55c2b3d4d4351f85b429a1c562f1bc2102f8eccece769239

memory/4984-213-0x0000000140000000-0x000000014017D000-memory.dmp

memory/3392-220-0x0000000140000000-0x00000001401B6000-memory.dmp

memory/4984-222-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 6fc0a79669887a5dbcc4874808809866
SHA1 b08dbd727759d45c4f418f1597503dce41c431d0
SHA256 7cd482cbe48929352e1b967262f1b55c9a798883ce7353a9c673acf3bda7fc5b
SHA512 ef79854962c7c86ea1d16f5b0ec1665df6e3790e32f22f5b586894e26aea90fd05038a8eea272ad20502ccd05ff1c35c7016198a5d45abb33989cd20286318cd

memory/1800-225-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2412-235-0x0000000140000000-0x0000000140192000-memory.dmp

memory/1800-236-0x00000000004E0000-0x0000000000540000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 e02391510892a7dbaca87c82eb241876
SHA1 39b089e91b6b390509d3a9e1d082bf9d34a0095a
SHA256 27c6f220ba7f539742b579a712b325be3427853e0ce3446424b9532cac36b9e3
SHA512 0913c52b614482e84e2ea551df28b5260270c5806da5bd1b100bcc73e87bc55b0bace18141e37da0a820af4d9312c64a3a7958dbceb79cf3fa983410ee8fe80f

memory/1080-242-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/1280-251-0x0000000000400000-0x000000000057E000-memory.dmp

memory/1080-252-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 053a8f8dd182e7c31d39d5497080ced4
SHA1 c60b92e6bcc99d1062396beccd2af218a705b337
SHA256 8e579eb066ce046f1c499e4f29603d4a27ac8ded80993eed52526531e5e2c94a
SHA512 2ae03802e6dc0f7736494a82231275130488a105e79ac8470808b08daff82853e36b0b6f436acc96a7dc8f3b5df7c77dbe57e1bf02904b8170ee1184fae85767

memory/3936-255-0x0000000140000000-0x000000014017C000-memory.dmp

memory/5172-258-0x0000000140000000-0x00000001401C9000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

memory/5172-269-0x00000000007A0000-0x0000000000800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 b141b968c66d16955f3f307583275f30
SHA1 9e9a24db3bd4c911977f8229c71c196f5cb471d1
SHA256 0a5b8829118e2c9efe7fb5e3b9214b9f3494a2ba8e6776e32bfadd3c89bd9c98
SHA512 168a74b6a1ffed13d031a90b70ae36a20c8632789dd421613584c9ab9d4a26fe2af82b4e6c0afbc35aeddeb25ba893dc2e532ce550bf4fb97d7122df37fbcb53

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 8223b9663543291df728bb785a0b1f67
SHA1 fa73a74ee10769b2cddad3eb5e13c7a314bd0ce1
SHA256 766e9046b831327596cf7d46a428ed142d8ff5b3906704d8bd72ca768968ca3a
SHA512 3c0bd45e65ec2fc0ab55b13792a546696b370afe4c21f54b8cd2074219c3fdd1389e673526fd799961edfe57811a77b11620d6a8af28515bf01ec1efaafe824c

C:\Windows\System32\AgentService.exe

MD5 8e2682a027080bec38e81550ba21e56e
SHA1 3dc79eb4e2bd79bca189f79df838a8c8fae3b091
SHA256 bc106b5fd03545b5b544d881c39e42ae9e1818b2188690dd87f04e2fb34a4a2b
SHA512 abaeadd73e8ddc2de1dcda68b6b6ae60a39f38a743abc7d1c24323866d992a7937c3c0ddeed21133a387cc0634326732b8e577d2dbd9511c511dffeabd250c02

memory/5412-280-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/8-277-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\TEMP\Crashpad\settings.dat

MD5 2f356fd7d6ab9640c82881fd6ca23617
SHA1 2850cee0903aea112835caa614e340663d5e004d
SHA256 cab65df1c84361a06e3db00485b191bfb5231b9ae9203a34aa713dca7180eefd
SHA512 a84c1335dc783b68295ff907fa2ce5b55c13b54645e0266109fc2612d6287b7445b555638cc8bf5282d4037dd9fca9891f685410e7c477a2b39ff29e6d31541d

memory/5412-291-0x0000000000B30000-0x0000000000B90000-memory.dmp

memory/5412-295-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Program Files\Google\Chrome\Application\SetupMetrics\0fba51f1-4085-4ef0-a08f-5248c9985e43.tmp

MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

C:\Windows\System32\vds.exe

MD5 f9e86ff597ce60883386ceedc2c7f4cf
SHA1 b63218ead7b51804153a7c68ff52e9a645374e9e
SHA256 4e42abcf43fa9a0313310a04dfa88e7e4bd85623aa0be90f7bad8e33d18372a6
SHA512 b55343230ee93100206fbe947b7c1461183525aed61fb82a085bae3b7c4334795b2d13830acd3173504bc414b38e240db93be59750009d1c4c844277dfc02818

memory/5412-298-0x0000000000B30000-0x0000000000B90000-memory.dmp

memory/4984-307-0x0000000140000000-0x000000014017D000-memory.dmp

memory/5588-309-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5588-318-0x0000000000B00000-0x0000000000B60000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 2ec9e5edca26c558869d2e3ac8fcc889
SHA1 98abbdeb9ca237a6aea7914e584f0a8361bc9728
SHA256 c8f60dd3f0a10124425a9d94cec00212a7b5dd3a3e19a4a48a621cbc82fb52a9
SHA512 53ad6ae89e09f4d9c7678b0d9f5b5328cfff0604578c6182ac2984866dbed773492661f8dabc1cdbf40d8a87c526a8476b43bd74955f1ca36fe0b08b1f424a39

memory/1800-321-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5852-322-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5852-331-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 39757697d47673c564a842094ac8fcfe
SHA1 35d94424554d2cbd7a96ef1eedcc50dfa2e3311d
SHA256 1d5353fc299b33434fc80c0a4454af3cf033d4f355ba653a50f60e8c3fbb3314
SHA512 7ae8c895cca12b299fef751563fda8d5ea6c7fbcc448e2a32b805475127dc3f64371c7a3aa5a1aefb3eabe0bd28e2788c0c57a48e277ae69432d725a28a1eb8f

memory/1080-335-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/5976-337-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5976-344-0x0000000000AE0000-0x0000000000B40000-memory.dmp

memory/5172-349-0x0000000140000000-0x00000001401C9000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 3e53acee892d734dfa270127743b0ba6
SHA1 99ddffcba167b3b9b2d8330e9fbac89d4baf4ccc
SHA256 92aae7d30a12522d65e4b90c7e42a3e2054ad4a44f67141f2fd0a4c8607f2ee7
SHA512 3cb82f75adfe788c0dcebefea2fdc7ff4e5abfb6e26b43f30b2c96cdba98fb79f57a51723b237d180abaf41c19d53fb836c24b933613b0822870993f7c30f041

memory/6116-350-0x0000000140000000-0x00000001401AD000-memory.dmp

memory/6116-359-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 23604ff244e97d7ab7ef0063e7b36907
SHA1 da8eafc53128fd683835dea27464714bcf8ae4c1
SHA256 e125aea996a333811187d7cd7a45039fbde5d76b2eef5980a1b9757fae7881be
SHA512 35d87d388651bd6437e35483f54774412f2a56bc451605abd2a228fc528efaad2af06b8dab686dab2d17a55e747089b1ccfdf118873e1ba082d18825d4da502a

memory/3560-364-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3560-372-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 dd7f50a3ad435ed34ff31c5190bbf8ea
SHA1 97831ce71e11b4bdc0fc68a6270618d8d0fb42e2
SHA256 59e3dce8984a217789c58f2e6861828c561556b5fb093715728c76eb11a0539c
SHA512 085a943a578f023085764b156f34a179dd57fba4cc48aa713175e61d824a65dba109b944308f66ae04f01108902e591217541da526ec8a46f029a62f4d8b6efc

memory/5588-568-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d7502dc78aad35f62c3fdc24adcbfacf
SHA1 6bb1addb0983402e6fd8d406fea635221803c967
SHA256 b515224fd4ff3bb867d617c908ba59d9e163a3ccc32eb35afccf3a8cbbaa5f4c
SHA512 f5bdba8938b29082be70fcca6a42b08e8228cdf6e25fa22001c8b5ee34081f357efebaf9e4e824f55b1d596056757da4683c80f19f73aa5bc0d8da7c18ac40a7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe576254.TMP

MD5 29e97ab941f5c82421dd16c25e9a6087
SHA1 c2e54372210cd01a8aac728f18e01cad1877e6df
SHA256 434f74e38c83f9ef23934cbf9477d3bb9e8f40cf5adaca89b96fe15a283793a4
SHA512 de4ebcb46a9bed711439e693231b38961e7958069986bb0f485781dd8ce4ab410612d5d5d9df8c89b534b7b0c5231b3e29aede00dff940e12c76ab2fa78909bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 1b0bf27fbdcb3f920bb84cb6fe3ae4ef
SHA1 40853ae7129d59e964344799a995e4dd6e2783ed
SHA256 bf9905bb8175ea374cbbfd9399f48ba5b651a8dc15afda51c14327a7550a2e19
SHA512 e6566fe1a7ced0dc50f8bcef82fccdb9fdc679badb2890d8dfceaaa58e094aee0c00bdb24eb1230c4bc1cb282cdb79a746067cf265b1de0809989bb1bab13239

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 d572808d3f78c411c734efa03fdaa0f5
SHA1 14bb5f7975af83fb67dd24e2fda30464f4f5c1f0
SHA256 c566950899664e21f11059d8ef3521f6b687a2185fe8cb49c26b7894b598b5d9
SHA512 a130c1f33988f40347eca2bb28335af20d4f46a49b8ff4558999dfc95a918a09f8374cee24e6fdef43d8bdd2c2980babffb789530172b511b1953003d595ad10

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 08a4232d0b8761306a8b93d2dc1c8824
SHA1 9219ea1eac0e13f0c6ce4b9b7d60d8359f9cbb81
SHA256 6d65d141d4bea28c7199aef64673f2c2cae9c89fbeae6c79911bafe0c4fc7055
SHA512 b120d642c7342d9ff94d853ce0b52018d7041adb1c9075f6cc6fb566e18db97e834c3595e3b907e77c658ad727eb1df1a83065eb58e3021d4a6223fc8bc7a043

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 274d36d238a3bcb404cb4e81c8e16f87
SHA1 9791999e279cba61ca24ef3932035f91a7b5b638
SHA256 376421208b607de6806b6dde09124333a3fca5325aa84e8356e9777a46577899
SHA512 24bf04224cc94cb49004c47ab5ceeb8cf96b4bbc701d802864e8c02894556cdf1a3e6574a230b8bb302f3d027cffa42cebea6cc0c989f054b010513b02b28590

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ac575053-e5b7-4a05-b3b0-631b76490879.tmp

MD5 a6140abe0e32372b2cfd34b4fd42de76
SHA1 5d397a41dacbadbb4df7f64e4d3ccec9f308e24b
SHA256 e6fc03fd2a0cfbfe1e13b7d288cdb99177ce643028eedb2c483d6fe7968a5257
SHA512 7d2b9b13756536b16743a75d8320daa84d8d1f68402f918ae5738f370f4dfba0fe48d63d4563ae79569bec0d09c5a0ea015c73ac9a369dded8945835ee008cfc

C:\Windows\system32\AppVClient.exe

MD5 5fcf7c1b36ca56608ecc69530670d607
SHA1 3543954ee580a6f3066f8b51ac78e2c56a50f1ba
SHA256 d4ad7341f98d6ee7847fd61fd43dc43287ea00d9ecaf6827b6d95c80a2bc671d
SHA512 e63591540764f76f03f54a28085695a58e0bccdde20f117b4c8d4cdfc414388a37ea13f44a773fcf1a858a6f6c507e9bd2ffeb39ba80d133964d26eddf144ae7

C:\Windows\system32\SgrmBroker.exe

MD5 579dbf39c16b69a22fe812db7d4efe84
SHA1 0eb64ec5999312fa6ea343a93b236a01749eecbf
SHA256 9cee4edcf81d996b35a4e0aaea49dbdced24ddf530374f83bb132bd4b311959f
SHA512 3871deea340a12896b7d9ce2b8ba45d7f94bd0e14fbae713a17226e801f746a75770a95256ac33c0a904788c5d326124e510dab7a418cb5dfcd227fc5965e1a5

C:\Windows\system32\msiexec.exe

MD5 f56b7624bf5e97078bbd87d62e001b3c
SHA1 6c5bba6265a984465765e3b2327dc1f32d9123a3
SHA256 bcebe2bf589fa981d599dc6c1c2a2a35e9a5baf142fb0a4a944d6b8672f121de
SHA512 ecc1eb1fcc612d3b921d9ac977ebb7901aca9736d07ed237324c91bf42bcb540e7712ce4e35fa46839b1bd813b12b08eb4a30414abf1fc6513b450a5e7b59b97

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 70375f6111b57611fb30fd24d24b8754
SHA1 d7560e77e71a30daa105f518a9e9a22737f1fc2c
SHA256 3f340bb53913ca9181f7d7b933237731c9b1f5acdb73d1c5501e57d05a0ac501
SHA512 403e774242b78361f91df5cc7f3b34cab4f13c848cc471ea1ba89e7ea610d0f555c16e5a09e4b14f5f6406382e2c3998f6fab6033f8bd8c9923ab6e0e35fd6f3

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 b12af62874497c4b7684248ee1a592cf
SHA1 5b2570936f9ddef8ae678b49220cc77eea0e694c
SHA256 a28237afe5095818f345b37ebce8f6a271f9ca34aad1d5412ba91b4f0641f42e
SHA512 c5d89d3bbecd8ac16f33331094cf97c2f020beadf6a42bcdeef52ab5dbd40f4fb398897578698d4cae5abffc3137d0482e9e4c170f356e69983f7f1816965cac

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 39390f98c74cb458fb0a8df74427fbf1
SHA1 fb59970dc9b3eaecb38330f7e4335e46eb96b713
SHA256 544d28edc8e111bedd6913ce8de6b40b78cbd3403f83b80857f22b1504905af7
SHA512 a9f2839f85d256a59dc70176be9db2fb56851669e170c0e47bd75f9a217294386484511fc1695200227ba07eb28754811f118a9d1d9276e84b1a89e6ef50df16

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d32ba7950c29ca6b99bf1c9587e62628
SHA1 36f50d04a21966c9dbc2c0146cb17102b4a0a8df
SHA256 43710fec0f5c88a9c750639810b23bf6e7e6e69c1bdba810c97a7a2d4d73090e
SHA512 7d1a6240ddab626fdd6ab4d62ca6cf02f24e6e89138f978086a88d44b59c7a21a9062e3f0c50cce10982f57eaa813feb906754d701685c72be042fdaead11464

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 555d75045ac160b6011d9a77355e2027
SHA1 71aafb9277fac50c4520178fac0cd54188a5fbdc
SHA256 7c1dae18f1df626d329834776f9cb871628346ef36b31e0d7834ffedfceec9e5
SHA512 39e168f96a736ac635e571709073fceb659889c9bdbb8b2f5bc00c1bc076e7801dbd0395715e5aa9a25af8b2a96aceb48c8000b442e3769e3fe219ab3ca16c50

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 f42fcd4d52b0025633e3b6d1bb682d68
SHA1 8dac7b716b9830e06cd38cba3a8e50cfbc879d11
SHA256 2f367187d7d6de6dac313b9f464bab58af2530c3cf2806eb96bd9ba4b8234df8
SHA512 2c5e612ff8ac12e9882e3c29cd4c9029e0f453fc482b55f1002983f1ae18aaf22c01e87e79efbb62ee3a8651716d52578fe428c3a6b49038230a5ddfa9ede468

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 b0ad481d66645ed136cac4487e0970e0
SHA1 5f0bbfedcc5f7d05e6c038f09728a172b3902971
SHA256 84316c5f07d1340d7af0b6f862d1ecdc1e917e56edf5deba600a8db6437178d8
SHA512 f4652580d5d2096aa634cb159100edc11c51a5059ed49fc0a6e0eac476d361a3aa60c2f1ae909255b5db7cb64fa9573cf52d1c0aa811b846fe1538ccf9008739

C:\Program Files\7-Zip\Uninstall.exe

MD5 7d32cbf653c7385c6cd35c40062de537
SHA1 9cd5408261111dae32adb026d8cd6e681d403c23
SHA256 c3dc8ea3a4b715269f14b409e73f0f8793dede4c487980c6e577928ad959e88e
SHA512 81c663c45b4b9d10878dce1c9cece4e193f6ba60fb24d74fc2131f224c9606b523411d542689f577efcf7351ef21870c0792614a1ac47bf350c9b835de153404

C:\Program Files\7-Zip\7zG.exe

MD5 5e8467f8300a12727fd2814b04938ef8
SHA1 b15d39df33e6b1b1b1cb32660cec2c5d743f4de6
SHA256 b883087182e285bb0ce26011980dfa043700501eb2548ab5567567ca2736d7ed
SHA512 fd8250207200cecc6a83f72087c591841d8668fe88378f9a099674b59e9bbc1064fe118ec9ab605e296e962ebbee9237987cebef59e8e573a7c67b2afc692fd9

C:\Program Files\7-Zip\7zFM.exe

MD5 af4bdf9fd0a4bcd0f72dcb8de4753927
SHA1 3c2d6975a51647e7359920de55984a52e15ca5f9
SHA256 66298beacd1c4c13ed109338b1da18df978c7d7149074ccd369a31f96a08074e
SHA512 d589db0894de6b431837f4e52f408799760dac0a60e99dd408874d449eec6826174d28c60b9778c37a5ba01dfde3f62deb9bec8dba77dbd54a333b40287ecaf4

C:\Program Files\7-Zip\7z.exe

MD5 5f0f4d4eb4a4eafa027760df4512b02d
SHA1 3a96ae2c3b0d6998d3b9e962b367cea122dd45cd
SHA256 0f456752645378ddc029de608409e9f055f8c130c27ef392dd63944bceeaa49d
SHA512 4a4b83d27cd3debe790d13cc3f3b019b112991fba9c4dc08d876eaa42d5cccb701c6440c2941d3594b74b55481e7876203ad0f1e767c74d3ee1f84634cbc9574

C:\odt\office2016setup.exe

MD5 1563e2e09eab9bad0e315c54e485c3e3
SHA1 6187f80b8a14b4b849b0411b8f718fb08eb78341
SHA256 58ec4e22733fe8d771d8cf7971c8c1a260cd14b31c9ba3f36566fd2bb2721ac1
SHA512 423931876ea4937757b06bfb3f5c2c963a1950d7f0fa05698fae5fc91cd4d97fc8b62b46ae96b78c1fd0c82fce00dd167e56ade80c59c9a364158634a5683856

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 35a964f4cb19f836c06505957f822dbb
SHA1 7dd8a0e09559a58809980c04e0f6cc21ec29b0e9
SHA256 6069535ed2f557fcd9549dd0e61156c0424c4b23f549997ffb77a966e6774b23
SHA512 cc0679979b98d61d9a8aa7b82a8acfc3fbc199475e6ff472d972eecb280681161704f79eb9ebbc9b9878f7aefa4b1e864092744a56cd68e2092cf8cc79f4201a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 8ad184e8e13da54d76de47093bb7c4a1
SHA1 1653dd61074ab765c2ee73c80f9164ec8f1f394d
SHA256 50508117f7b1c0a22391d4f9e67673136222fb5316480e3255fb34e1094d0e23
SHA512 97bca752cfc0283bca9391853af663d08a8ad3ecb444365f1935c086ce25825a6feb867a6489b55690616f1f9ff470b7aaeb1453083f007f493b70fcf61f0860

C:\Program Files\dotnet\dotnet.exe

MD5 f0f1f2eefdc371b4de129f1bb924b795
SHA1 82b3b534dbc1dd19455289e4c4211f98a903d67e
SHA256 01ea75f58e84f682a97a37b627d2ebbdd81aff0115bfc5e1b206a91306f0d83f
SHA512 f3dbb7cd238a21055c0008319ef24f433596aa77c15e45edc5a3a5382bc225aa13eca4080f1fd9e91d9577a18a372950dcdf0dcf89123e5fd1fd4b7fd3abb3d7