Malware Analysis Report

2024-11-30 02:42

Sample ID 240407-t9cz1aha6y
Target 2024-04-07_12f7e264ffff1073180001d0002757be_ryuk
SHA256 9a2ac9cd13c454164975da5f6c13d69baface82a5d00bdd3a1d1c106e5b3fe62
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

9a2ac9cd13c454164975da5f6c13d69baface82a5d00bdd3a1d1c106e5b3fe62

Threat Level: Shows suspicious behavior

The file 2024-04-07_12f7e264ffff1073180001d0002757be_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 16:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 16:45

Reported

2024-04-07 16:47

Platform

win7-20240221-en

Max time kernel

121s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe"

Network

N/A

Files

memory/2136-0-0x0000000140000000-0x0000000140592000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 16:45

Reported

2024-04-07 16:47

Platform

win10v2004-20240319-en

Max time kernel

91s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\765445e34ab059c5.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_135953\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_135953\javaw.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133569819246967648" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 860 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe
PID 860 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe
PID 860 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 860 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 1756 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4532 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 4008 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 764 wrote to memory of 3116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-07_12f7e264ffff1073180001d0002757be_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d0,0x2d4,0x2e0,0x2dc,0x2e4,0x140462458,0x140462468,0x140462478

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b3479758,0x7ff8b3479768,0x7ff8b3479778

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:1

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4608 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5096 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x290,0x294,0x29c,0x298,0x2a0,0x1403b7688,0x1403b7698,0x1403b76a8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x298,0x290,0x294,0x28c,0x29c,0x1403b7688,0x1403b7698,0x1403b76a8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5480 --field-trial-handle=1900,i,2254120955762223208,919924955705656428,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 131.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 106.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:443 www.google.com udp
DE 172.217.16.196:443 www.google.com tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 196.16.217.172.in-addr.arpa udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 apis.google.com udp
DE 142.250.186.110:443 apis.google.com tcp
US 8.8.8.8:53 67.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.186.250.142.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
DE 216.58.206.46:443 clients2.google.com udp
DE 216.58.206.46:443 clients2.google.com tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
N/A 224.0.0.251:5353 udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 46.206.58.216.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
DE 172.217.18.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
US 13.107.246.64:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 95.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 ftxlah.biz udp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 34.41.229.245:80 lrxdmhrr.biz tcp

Files

memory/860-0-0x0000000002000000-0x0000000002060000-memory.dmp

memory/860-2-0x0000000140000000-0x0000000140592000-memory.dmp

memory/860-7-0x0000000002000000-0x0000000002060000-memory.dmp

memory/2928-11-0x0000000000810000-0x0000000000870000-memory.dmp

memory/2928-13-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Windows\System32\alg.exe

MD5 9dde21bdb1c614df06f33dc4f242c5fa
SHA1 b58af293baf33522c72362b0fed91e4d544dc14c
SHA256 3f6c596e09f9f233242b21033106c81de43eacae637c96dd2a2b98370ab1d666
SHA512 43feb930e31167561a98f71840cb9fea4b77814782403950e9b3e5be93dc1f8896c8d9a987c7d74e7a97c541a10d0b094e80e0d6742d11b3370a37cd79008c65

memory/2388-22-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/2388-21-0x0000000000750000-0x00000000007B0000-memory.dmp

memory/2928-19-0x0000000000810000-0x0000000000870000-memory.dmp

memory/860-28-0x0000000002000000-0x0000000002060000-memory.dmp

memory/2388-32-0x0000000000750000-0x00000000007B0000-memory.dmp

memory/860-36-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Users\Admin\AppData\Roaming\765445e34ab059c5.bin

MD5 c532ff2f582fe04623497930f088c56d
SHA1 17030c0cc1bfa2b154e7e258095a9b9b19bca7ad
SHA256 bbd55e694c6100e6084d333293c0909cbb11b79cff91484415bf75454a21c16f
SHA512 1ae201a3b1df050d1728ce50ffe84d740370052f77fd4e3906c530c3991b2dcd84be93706e9e511f229fb52e49ab4556921223d0b16466d2d8f4ba9b39e446d5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 4a0b907083f8afcc81fd894fb6c45d01
SHA1 7161d696223d3373ccce860cf81249d7f738a02f
SHA256 87b0af1a5d48c9852603c2cd73097e27beb903aca92354231262ceba0e276e4c
SHA512 9a917882b29ac03f6af556b1c4cfb99b5e8260a4bf9a179b91cb1a1ddf47c1cd5543b8d7f008d955320e567dd4fc0236e187717d4bda748289700b3fe920aca4

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 8110fc846386fa9bbb5b671326332ef9
SHA1 be82e421bcb12f6183bf9a3918f8c6aaa3be47de
SHA256 86f90f09554e921957540ea22ff03448c54822d5760b9332bec809f2c3f583b7
SHA512 b41a9f8a39d5d7fc440b35632be52afff4f190b93438c25d5806ca6542985d69319b81c7b7afbc1b5e37b5cd0815900d889e7b113d2ce2bf27e5b3d2c81735eb

memory/4404-41-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/2928-45-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 21b36d4175e3a05e1bc3aa2d74e4675a
SHA1 75b33a2c123213726ad31b7c90eb2cb69cf84de7
SHA256 001a0aeb250fb3ee780eed25cdb673f51695b0efff35391ec818b44d863ab9ad
SHA512 c359df2bdf6f4a6a05fa932377ceae050ddfe0ffaa9733148a30e6e4be930154ae742332d347390310cc88da81de2dc065aed9369461063566dace05b5f37d13

memory/2928-52-0x0000000140000000-0x0000000140592000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 a1767fddc11b59b7cf32bb0476ccdd01
SHA1 e084ca8b7316702a87220c02336d2eafdde497ec
SHA256 84a8847f5c883f7a7da45b72f34c9971c671e84b778f02c13c73b20a94fe5091
SHA512 69df9275f269697dd6662de07770d8ce0c89bcb9b6f3478adced2ef6ef5fdcf3f57a85d8087d555d3c3ef95b215b509c289e695e6df43f9dc758e9ef64d9c4d2

memory/4852-55-0x0000000000730000-0x0000000000790000-memory.dmp

memory/4852-54-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4404-62-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/4404-42-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/4852-66-0x0000000000730000-0x0000000000790000-memory.dmp

memory/4852-67-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\elevation_service.exe

MD5 6e6a5df566516ae1a0a4deff38861294
SHA1 5b0bc225399483f469c80268097a67e4d8df2b03
SHA256 4fa95742bc87a03d6e620cd07875f8dbfa5f49f09564d8b31d9a872559727d7a
SHA512 f45ab48d2fffeb2d26910d6d2b2d40ddb6a84d13d88eebd97404d7399341b76f55d790f927258bdf5b1b2343299ba0f51db8b5ad331d3bbb785dbd683c0fd7c9

memory/4752-73-0x0000000140000000-0x0000000140245000-memory.dmp

memory/4752-72-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/4752-81-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/4752-80-0x0000000000890000-0x00000000008F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 5f6fad819ad98aaea18e7c1ec9270a9f
SHA1 eb5f4f55819c6ca5bda8c6726706e7c22bddf1b3
SHA256 c929831401be5c8d2a43a657638829fb40e734e9e3a302a1aabc5039c3baea5f
SHA512 8e72ee7187c03df63eaa3efa548414e0259195185ddb2862d9380a46a7fc36309d67f7828c493fd405bc7c9b1ea0918a39b1f53839e96c3d791ac7de54c8b495

memory/1180-85-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/2388-86-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/1180-88-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1180-98-0x0000000001A60000-0x0000000001AC0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f92c94374601a1d09bd60eabb257bb09
SHA1 05f139aa48ad967374d21b93e751329e0a18c197
SHA256 50a0f9d6fd7256f464967f0c980f834343345a960da732e1445f6fa22ed204ec
SHA512 2b65d7ce0c3d56388347c7adfdc68c29aa88336d31286f27ddd48b3c9a9c6ced3b66fbe53407e7ef505375dc6bfe7413d72527a917e5f79804e489a7dfb6a1a2

\??\pipe\crashpad_764_IXZPGJQGVENMPFRK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 ef36a84ad2bc23f79d171c604b56de29
SHA1 38d6569cd30d096140e752db5d98d53cf304a8fc
SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
SHA512 dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 d3301ec62d1053e3bc0552cd53546c82
SHA1 4be23faaa0bc70a727d59416cf2b1930e99c0594
SHA256 f24f44db0459219bf6d8015f965a7794220f1d22f49ce8d80e02fd640656e39b
SHA512 7aebd1ddd100b601fbc45dabb3e3a6779d54dd3f6039302c559976bb2075ec31d14cee5f7462176a48efaccf736d100a7c8510fbdd3ac39f893f49687affe73a

memory/5064-121-0x0000000140000000-0x000000014020E000-memory.dmp

memory/1180-120-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/5064-119-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/5064-128-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/1180-129-0x0000000140000000-0x0000000140209000-memory.dmp

memory/4852-140-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4852-142-0x0000000000730000-0x0000000000790000-memory.dmp

memory/4404-220-0x0000000140000000-0x00000001401E8000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 ea079c542b0db064b9c7d47202a21861
SHA1 473cc8b4729ebc1725059332beff1d8c933f3399
SHA256 4f5d890fef20c30d58c35356406b7a318ff065238826c2c72536902fd5d497fd
SHA512 5dc5ef81de415948e6d1ef8bb78c71ea7ff7198cfbc2c758e1ef5571fda4c43391f1233d93891506b86d21de496ed9cf481215d2769f878621c06d6243d47063

memory/5924-276-0x0000000140000000-0x00000001404F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 7b0e281ec747955fa3d30bb946e99c6e
SHA1 c679fd5af1d6c36fbc786987952e025c37959da7
SHA256 f8e2abf51b65f9f4ce84648e7e6f21832e7ccb32a7f6c848788295dcff2be31f
SHA512 8baded2b09da55012d98fdf83e08619ad5533d623d7bb46fbd6fdec7238ad30143e336ac7272f73fee5c0e22ea43d71fc7eaac4dd645cbc44a8583dd39ec0497

memory/5924-285-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/6084-290-0x0000000140000000-0x00000001404F5000-memory.dmp

memory/4752-298-0x0000000140000000-0x0000000140245000-memory.dmp

memory/6084-299-0x0000000000810000-0x0000000000870000-memory.dmp

memory/5228-318-0x0000000140000000-0x00000001404F5000-memory.dmp

memory/5320-331-0x0000000140000000-0x00000001404F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 6011cd192daa8abe22a205c069fe591a
SHA1 d417fe0469d9c7d871c0cd071ccb6fc35add258d
SHA256 34fb5e1118b52ea408521fd976ddc376e0bd1a06ffd2f30e6204991d6b0007a3
SHA512 a8f38c4a0b9dd67cf145f29c0847ae7d22cf12f67ae5c30aa6b83190e8a06a31e12755be2dc9888701e0e54fb600401cd263ea9b4cb3448c6557e44c60379b5c

memory/5228-326-0x00000000007E0000-0x0000000000840000-memory.dmp

memory/5064-338-0x0000000140000000-0x000000014020E000-memory.dmp

memory/5320-340-0x00000000020C0000-0x0000000002120000-memory.dmp

C:\Windows\TEMP\Crashpad\settings.dat

MD5 d2fbffbdedf5849cc29340ca0e6ea5f7
SHA1 b15432d75827aebac414008bb69841e5c890b4a6
SHA256 93c9e06f21a86a204d4214bc6f3980ed3eb2251465b94788dca2f4c60975fbc5
SHA512 3a554fc6035aec077626485987905ad7adb2c5da2d74ab46486b6bde7f13ca997f8f55708e64583980083442765a22f4ad4e95472cd44833b12d5a6af69a200e

memory/5228-348-0x0000000140000000-0x00000001404F5000-memory.dmp

memory/5228-349-0x00000000007E0000-0x0000000000840000-memory.dmp

C:\Program Files\Google\Chrome\Application\SetupMetrics\20240407164528.pma

MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

memory/5924-361-0x00000000020B0000-0x0000000002110000-memory.dmp

memory/5924-360-0x0000000140000000-0x00000001404F5000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 cc7c07148b44b9ffa9bc8e8c1a359710
SHA1 eb3cea3645c067606ee95758aba1d93d59eaf6bd
SHA256 b67058fc7f72051f38d7eb023cd8ac5c517b513ad51c35c87df9e8b7a278b84a
SHA512 e02719983b2932fa3a7b6385c8bd7116dba595ca7edb2f734dad4f254942da5af4a4f3fa36240375563f4195422d9707ee0791a9468e8f246835c1d2a6680935

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 02db362f43312278026e075a1ee51e3d
SHA1 89c4625d46b420aef5a9ef16d0d8926e3926f2ca
SHA256 bf8007363dd08a3aa3ee563b6b66da0d2aee3fd52ad428bf41d8238f230c838a
SHA512 2462db4e64773642ef5c3308b201d5f33115b4b9e0beaf69bd2b7bbf5a222d319a96326758a2042392ea2a20df535da0a9745d9330580c38969febab8b927c52

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57b9bb.TMP

MD5 52967a4cfc743203819fc0de12defcc1
SHA1 ed45be1b5bfb7f0f05dd9c2f1dd03172f1e85649
SHA256 7224846e2eeebb17ec177a55a26d93c9b4d4727770da01c1806be5575c241b02
SHA512 bf06df623f6a3cf980d5e9e726dedf68f9caa16c77d24c28487bc190b789a729573d507c155f2d0852356e7c77e4008805cba276841354a5a0aa36337359367a

memory/5064-406-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 df352807120dfc5f93c6cbd363068171
SHA1 1e24a46d42de7ef37979907e66bc7ca4b0b0d52c
SHA256 a297afbfbbef8c77e082d3a125af7d570c92842ee76e562c8ceb98a3af72602d
SHA512 ce425e3ab7f9fdebd737314de42866197030e4c4048ba7f55020c2bbfe6c844a7905667f44ef7a7c8cedb208c2ec624b1e4e32f8ff6187f7d552e374e7fbc9b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 ca95b77c301d635319e3c584c617aff8
SHA1 e51c8c0dad861c63099e4cf70d5516c68aaf38bf
SHA256 e0d025462ce2506064ca5ba483af58787edde871693349460bb46eb75e38fa51
SHA512 f92f51a116f3635d57640c1a0c2b8bb432f926acf994ee3bbb26213d7c3fcc482b2d4cea083290285cfc0612296d2e45758305622c5955f9dc8487b7aed0339f

memory/6084-424-0x0000000140000000-0x00000001404F5000-memory.dmp

memory/5320-431-0x0000000140000000-0x00000001404F5000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8228f4fadea24e6104571adca96cb96a
SHA1 f9486dd0dc574a6f488f4bd10dfe734dfd0ef0fd
SHA256 1bb75d3e402ad3f9623ed834b3a75c953815c92b16493d9ec034cd8dd199b16b
SHA512 7f2b584871b27e684697d4a7c660d7b327de35d9845733edd678d5d907c0f0532d3b905aef26b660eb87cf596f59a8e8dccef4594d3892ce24d9cf2d96c68079

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 89adec6b4590869a1dcfd8a7a9579317
SHA1 c9892efb112701767b28e9e4bee3cf0ef0c841ee
SHA256 63b413ff6dbe2b54a68bee92c14f58e67fc07a43df828053ac0eaa6654463d25
SHA512 9bc68ebeeed2f6f52529512f7aca17917d5635f7ceb8f269f81716966a7cff625455267269ac63237d454443075dd538f02492a0cbe3867f423ec96accf71aac

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4bb9f5e96614304356aed0d091b24715
SHA1 691cbe1a9acac5019fe1794fcb27bb84dab836cf
SHA256 db594220fea8c470c74d972146e90d39f11d35d9fe9cf62416c0a1a2b6e3eac9
SHA512 7fa59fa2a2628b3c305b07527629de76409269e37170c326230db4227897ff1ae02d3042ad0837cf6d38ca9e413be9fcd850a81075300c36c20e2d2fafd2b1d9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 c42eacc1c7e28d8c6e3e3d68491274de
SHA1 6c81c75944297285b7c9fc2724dc338e0dde897b
SHA256 1de5dc7fc28485f01b0027dcbe8221a2a1108d4bc9df36416f0994226a1ebc6d
SHA512 6d4e4fa2dd840e79e560d5853db81b9909d14ac3e045be23f72342ea5f9e828ba34cc7d5982181f134be084800cf5741ee70f32b1692eaef538ee8fcb58e47c4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 317946ecda2e3bd62b07bbe4e7d31836
SHA1 9138400cb94b6479148784b538dcf160812333e2
SHA256 94bd49fe0c4a06d7e72bd024c28ccdb074778eccd7f588e8e7a74b233e81a99d
SHA512 067e9fe6eb435993aa80c7cedb5c16bbb93befa2358b0452b94c6072b58ea741dbac7ebc9c39bdd4c89f47d1a4fa6c204217c026d8b6943baa1e827d97fa34b0

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 9dec19a78f7d6095f3c62d8fa39deb7b
SHA1 551455b4466dd6bbbe8c50286efeca068faae8b5
SHA256 41ff8224cca3923ba454804a3947067ee2921b59c5f5bd5ac8c86ee45b9fd92a
SHA512 f4923ff8c54eca11eb19b6a5f6438822f85f301e128e608e49c659641aefe1a4cce90a04463ebd39818ce7744e6d02daf0b4730f2da9365bc47bccab71d1770e

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 6c120fd1ea0e153778bf3a60ec760b01
SHA1 192a205e3eff6db09f021b8af7111d560942df26
SHA256 471ddc9e1b7ca1c10eff43a22d202bc6f3838961c87b0d45ebfd8cee074be08d
SHA512 e21a7eefdd93542052b090b1c345b28a154c920789f469710101ead316ac4a6396ceb5b625794d5a6eb8e16fbdb7cb97ec2613e1c4d2491319d15efe5ffd1e5d

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d1c66595a923c2afa9f3ff038ea5a522
SHA1 3cc50a08d94108af032be3529c16be124b9a55fb
SHA256 6c9a0278f79529bf0547c1d946cc024fe1a205183c36a713e53a8d2b42b8a735
SHA512 ff1978e3459f93ad5efd8766f36573aa58d25cb2d9f2a6118ad1200da280bb179bfaf9c784384ef14c6eebd6ef2477d8b329c2a5a31ef3ccbbc257e7280e1695

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 13ad93564d70fd394e739508a9c289d6
SHA1 6065e96e43260e3fbf09ebf2c27c6295dd62ec75
SHA256 54b609228d979cfb6219c5ccd2834b0352459019bdfd170bd2e9458b9a888138
SHA512 4a9c1f8b78d65ad6bf670595e709f4725768401944eccfc8a24af0090b036521a628b82d5249ea709183cedd47e347b6e2a6a12dc529d34c8b7f381611ef092b

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 a3faaee003c8d89e25bf5af7eaa7c77f
SHA1 f9bfa823cf90b2680e5a83b688d725072dd4baad
SHA256 c1b070ae535b22826d7bc40a470134e5de086c3b23e2c05c11cae01234302a81
SHA512 9ce3318f69fcdfb956f576ff887d937d2a669eddf1ce2a3c5b0177bf8d23b5d044557fb2521745161700fd988ed61b1d7d9e761ca7d78efe324dc8fe17d78fb5

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 765eb117923d5988eb40801e8513009e
SHA1 1fa234482260a0f5024a50697b3eddfead597e23
SHA256 5b8d5534bc255ba08d3e8e7ef6726032f2f26de100e648e0c358defa67875122
SHA512 f2b640ae0ba99d68aad244fe14d68262069d494196817cf115409bf09549dc52f540411ec74bb5829ba5b12087f7e095998ea907cb3c44e9319b53450b0effe7

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 1148c1300c70a2a101cb15d3c8622a75
SHA1 01904e1286eda717ec516eae52fe683037063188
SHA256 6b9dc25c49d08fed6815a3fccd0d1ea4436f244dc7162c5b78fb4e85b2be6ce8
SHA512 b13795c3cfc1a0cb271f7deafe00dcb1dbec3a9cdb4cdda7693e1b700a8ec32a75eb9913db2a2633f18c55dfc5a9721355f93f279ae4e658cb2b223eb4105bd2

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 dba9a7043fb6ff7c1ce109e3eb045f70
SHA1 6d9e04d1aa896e717ee59b0b9ded68ace110603a
SHA256 bf0f9f76f591672d20f34532629ef4a15cf0ac5c30356c954094d672080ba930
SHA512 1da8cd04053aa91573adda7390783af2b8f27fc30566fa35721b3ed5043df1c9934e59c103b1df9d98a9a903663ecf4fa073739a4e9e73e25cdd9fe52ca85aeb

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 909b0ee988dbd20b5ebf142175de8964
SHA1 8883c8d0320fd5d7837e2de5e1f0266cbe18471c
SHA256 527a9b6668ddb44358a9ccf5ad0d527cb550868375b42fefc002eed714b140a1
SHA512 416fe3a82d9dc2edf720712b120dcaab8b4261baa27c933b4ff9b1c3a23c9f7b68737a61d7477a74bb12b738cbfc3d6098d02b569a07aabac35e43c9fda19f03

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 1fe6378440a351772583c6a91751ea92
SHA1 27a42e68967a3883b6a22b9c02495a4fbc69defd
SHA256 43d17b6694d0140a7c7389ca16c9fd4a85c4449434f3ec76b75a16e7fc29e876
SHA512 e17d7148a61b46b24cccd292219fc51f8f5f8bae5dab7b7d33f67de75f07f97bca05a34fda5d888044b38a702c14207527dab31c47c442ab5d38ca772e58b91b

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 a035e1e078f0e20e2cecc78433c99302
SHA1 b19a21fbb0a9fe95a0c9198ccdb09961b6d33e4c
SHA256 ed12ae8e63adda051d02833bb5d96225fefb36854b32ace7e7a2500e1e0767f8
SHA512 c3470c676269ca10cff84c0c88a7fcdccbac3c66ebf014e4de8d5ab0a60cb9464ada08a80bc894d3804a15349663415c26d9540f6b9f019d6a6f0156874b606e

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 531e8afc358ac39878e620f2a06f6220
SHA1 8cccb5f789b6aece355b5268ff4e66495df501df
SHA256 6a347b66ffe250a949fab8dce5e63293e10d95b4e251f02bfbf1fa24e6b570fb
SHA512 556a3ceff649d4d06ddb4c280077475110ad2fa6538a5153a9a9edd8dbcc8c8f6a69b61390d8af5449cbbd1907610a1cc0f91038977e013f9b2b4fcadfa9cb5d

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 a7bbd2763fa1addf7a5a64736471a89f
SHA1 5c6c21b3148fccdc5b61c833cbe51b02025bdf00
SHA256 3b40decb1e9ade7ff20150b5499512f739a4f902bce2a46168b4451913d44b14
SHA512 42f5294002c5aaf66fd8e59bb033cb91d7edcc55eb97526f5eb3dff4e0e557615b7a25269746501729df47226571e63bf24c1b60cde90b35662ad297109d8471

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 cd4030662933e942ce207760027949c2
SHA1 e58ef04cdb4c606b4ef0b9e156211a2f6b6bfba0
SHA256 16aa9624c9595478af1b2ce960cc7fa3847c86d610efb197b932dce9ccfc61da
SHA512 aa78667d2022d23301cc70ae1cb706e0b498becec09cf1c9a1e9a0445d7331ee665dbe1e5c6bb5dbb24aea9ff248cd3e95594c73a4d9b83760758b214e461be5

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 77355b04029b339a043f1eeae597084d
SHA1 70aa37ff921ebbaa8c7852996d52f37e8bcb4688
SHA256 1c1f4ae802cb34650011743d09d062519652ec77919496eb4965d58435d4e602
SHA512 2eb062f61b44fd85f3945fdfb3e5e83d55efa48d730459159335a44ef53b99543553b2b91caae0baa8c5bc9605754361848447c8a49ce17befd9ed6c4b7e3486

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 111c33b2e135cf74d2a2e643b547476d
SHA1 5f612e4ec9605060af3ca7c674fde3ab5fccdafa
SHA256 51c2d07d43e1c65c8d5b62746c8bd7adbe0bf78add54a163a117b3e6c766c2d7
SHA512 6aa65ef0d96e533f8e46e5d69700f2620b7943a28864aef9edef614d8ad6efe5419bb0e5e48d93894af03d3a95a06b1193c7dc7efd04c225f478dc0d0db189f6

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 aea4305635b6f9f7db39aa2b7cbdd5ca
SHA1 3eb99297564dd73be536e6910b16c25b2ce67b8d
SHA256 626ee3e4b7932d2168797ce07b4e87355f87de3bfc70f075b7b0e8f71aae66b1
SHA512 3e57717202faf53551787cd90451c0b04106a5cb3466c0b28e98521fd0b7d7cf37745e02d9a3106c563e98f47cf4eac2066cee6ff5c055e4a0cc229eac2f5066

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 9deec8b14be397f3a5724661ffb376b7
SHA1 88f803baa8bfb40086a307bd7daddd5ca1b7d0a6
SHA256 d2d06edb1abd53e09ae643d3d375e51c1add4bfc1a4b871dab43ae815de03f23
SHA512 82c0729adf24c56f153a84145421cb2d17ee2f7c12485a89ff4ac86bf62a1d3fb35375b35cfa6b9d2e398a6f1284d846352dfca665b609131848eeec06db19e4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 efaa014bd1e6d5a27c964575448b4d15
SHA1 a769ac77556bd82135f294a1241d86bc91b156e1
SHA256 68cf89b3eac538b2087b0e00ee205290a26105bea05b1e9e7ac1ca73d1c27477
SHA512 7195f1cfc664bba615278fc99f4721fd39bc65cdb1e654a3f07a91b240885cdeb95cb924fefd205ca99ce80368b7b44392a1aa93be8230168abd038ef2187907

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 54a9c05b940f50e4fbde329f1f69d387
SHA1 a45c37a887fe727338dabef3d960db469c9c24ce
SHA256 5089c63032e75b4ce3e0ac606babfe7d5f8568d71924cc841661f6a9844dd336
SHA512 efd67e8665ca361fc8b9d60dac10eca2711f8f61a49f35995a55235756dbb2cc956d92f5f3f49875ec9bc09a50a4e61e7e3d4de8b4d46f34a6dd48cb42bcd5e0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 648f939a59a6fb3d846a7ad0d7671732
SHA1 495ed49327d53e3cac4c002754fad122537b6312
SHA256 f57fe3cf8f69b3cf4cd699ca90ccee708b91705037dfd2a2bb865bcd411a5c9b
SHA512 b0dc8c5fb1da310bcc3897460a1acd51c05e48c303ba5ddcecfe24e2eaab5b775a3da777800cc764dc968e0c1687be60b1967aae65c57dd5fbf366a9acad4b4b

C:\Program Files\dotnet\dotnet.exe

MD5 40bc0d45487acb217381fe35c5aa45aa
SHA1 1a5e795f0cfa7d0e84fd68f15367faaac6330f6c
SHA256 209a910bff0780f740d231022fcafeb05f67ed440218fba64e72f8f4167125ee
SHA512 292b69982dcea8e8b508e19b2e25b2ddac4cc63b2be091f987a932e7e96978693c2ab88cf2ee6980c87b59df54b788890ee2d0ae3278b83440581e0cfb25f4e1

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 35fb7e41ce67ee77641a987df069350d
SHA1 50de89bafa2bc80bdbd35b71f6b23d462514a0f4
SHA256 772aa0cbb9e9d4ea28d86e8719f3d845f36910ad5ccf758e01370baee63eab00
SHA512 e1c0143750cdfea7503c28259630865d49ac4be20983e46765f88eeddca27830c100f6812775351da367154cf418c8860a5d9e7cc5f081b8917ee2f6bd4d39fc

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 bcf8eb2ebc3bc7bb5c18cd649a95f7ed
SHA1 3f80325a9a58bb2750da0bf32e78afbab3d4fa44
SHA256 c33f01331347b93d943b60883e6b7d44e8848e45bba667a10ade66defc9fce8d
SHA512 79cf595883cf9d297205a7490986b62d6840c1967e0778adbdf47095c801ad02e045392443d79bc2a7b50d750801e50ad517456dcb61725a54963f2e62197fcc

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 b253c7fe7852a87e67d6b25ee7b3e2e5
SHA1 b2805c01a588a8409f1fc014d79a823fdfbdc0ce
SHA256 874900480a3830ccaa5fe6059664a26ac5ddc12708d900fd77a3ae6a78a5899f
SHA512 68eb8edbb740335d88cd43a3f021ba231a1998db66a67610b972251aa613967a89d0c77de4f89b0b82ddf372c686eddcb4868cb601d7a191155ffb2749e1fb5e

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 1ac6a1a062f12dbc49bd247f4978d488
SHA1 4a0f7809530f89fe5c8105091eaff6dbc7b08bcb
SHA256 116bf690cc2cbae16c97b975a4f5f8a4bceb0ba0ee11fa650a3b31592bb2529a
SHA512 293a0c1c8fc6958286b3670f6598df5aec3ed529e8ac1f8559621d2947a69b69380ab306519a49237a1dd0182f59d09e1133ca568bba4fcdc1b713a747bd8893

C:\Program Files\7-Zip\Uninstall.exe

MD5 11b375fe3e5a6dcb055a46f0ddb4ee75
SHA1 8b0f9df40cc229998b4a52c731149eaa21cd8398
SHA256 a074629fb9bcb203ebfd842cf3222a70cb0b9d1545ac96c54c04b9e1bfd2fc4a
SHA512 3fc0dc5a1a2be349d7b1a9a7e25d73562ae8fcbb8a1c0b03353339d509246e4700b85c0c6122fd65533a309051870e4a56ca5f9a572e2256fd2b32710a9abc81

C:\Program Files\7-Zip\7zG.exe

MD5 5235ff714217bebf85e0f35ce427b4b6
SHA1 a8c46c70b6af39f77d814ddc33ce66a2d3061166
SHA256 ce67fd1171ab77258f101099d139e19157890fb5369ed1e567d51c1fcdf629a2
SHA512 0c81de686e16de0a9ebbc687a2fd49e6261b146a34534018af5d5d137c87791e99663c26c4e1d8da2c088897e2b5ed8453595625043b4f422e3e0916f572b466

C:\Program Files\7-Zip\7zFM.exe

MD5 42f38895d00b92bd95270bae7a6626d4
SHA1 4c721d68244bd44b21605a23e14f685ea460e973
SHA256 e7f2d23eaf2fe7963e507fd58a30916011f387bc0b9f06546e864f48f3b51b2c
SHA512 b4d66eeaec991f6a38b2f2747de26cc373f3f905eed56cf1330eb0610111fe59918315b305d2a166d55bfa68f013dc6fee98157dcf655e6310089f836696164b

C:\Program Files\7-Zip\7z.exe

MD5 2f852b032a3aaa08749e1d746d9a26c1
SHA1 98e0ce34b83b384b0305673e373619d9cd86f553
SHA256 2557cc26d7117c0f5a4c37f072eb463ef2c00f79e9d7cc4fdb05a8f69c562894
SHA512 f0b388fc8e1ed57e0b7a0994dfebed3c20aed223e1d0212eeddb56726b1ceb96a91a78cff82765b09e8fa099e617476ccbe337f49cfbc9cd35a799ed09f02fc2