Malware Analysis Report

2025-08-10 14:20

Sample ID 241108-rsk8yawndm
Target 2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk
SHA256 e65364d8dd1047eabfa29eb8b08970d0571c03edc9cd4d0094ad11a548a98f14
Tags
discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

e65364d8dd1047eabfa29eb8b08970d0571c03edc9cd4d0094ad11a548a98f14

Threat Level: Shows suspicious behavior

The file 2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Checks installed software on the system

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Browser Information Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 14:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 14:27

Reported

2024-11-08 14:29

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\fxssvc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\SensorDataService.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\system32\spectrum.exe N/A
N/A N/A C:\Windows\System32\OpenSSH\ssh-agent.exe N/A
N/A N/A C:\Windows\system32\TieringEngineService.exe N/A
N/A N/A C:\Windows\system32\AgentService.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ca9961ba99262766.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{1E8F5DDF-3FB3-4332-A4CC-B46FF6E6899A}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Crashpad\metadata C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Crashpad\metadata C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87484\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ba8325fea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133755496559889393" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006d87f5eea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001241065eea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a9e655eea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba8c335eea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a783f5eea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006568ee5dea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005670d5eea31db01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3768 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe
PID 3768 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe
PID 3768 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3768 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4120 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4120 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 2036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4356 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3580 wrote to memory of 4324 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-08_45afb8e093b7ab1794807114d9f16653_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=130.0.6723.117 --initial-client-data=0x298,0x29c,0x2e8,0x2e4,0x2ec,0x14050ec28,0x14050ec34,0x14050ec40

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff874cacc40,0x7ff874cacc4c,0x7ff874cacc58

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2368 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2376 /prefetch:8

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3092 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3044,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4384,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4348 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4616,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4380 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:8

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5188,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5200 /prefetch:8

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0x140384698,0x1403846a4,0x1403846b0

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x2c4,0x2c8,0x2cc,0x298,0x2d0,0x140384698,0x1403846a4,0x1403846b0

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5068 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4972 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5312 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5452,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5460 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5332,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5420 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5400,i,10015731063615730663,1407726355950287850,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4708 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.180.4:443 www.google.com udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.180.10:443 ogads-pa.googleapis.com tcp
GB 216.58.201.110:443 apis.google.com tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
SG 18.141.10.107:80 ssbzmoy.biz tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 przvgke.biz udp
GB 172.217.16.238:443 play.google.com udp
US 172.234.222.143:80 przvgke.biz tcp
US 172.234.222.143:80 przvgke.biz tcp
US 172.234.222.143:80 przvgke.biz tcp
US 172.234.222.143:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 143.222.234.172.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.201.110:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 216.58.213.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 1.213.58.216.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 47.129.31.212:80 xlfhhhm.biz tcp
SG 47.129.31.212:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 212.31.129.47.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 172.234.222.138:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 172.234.222.143:80 fwiwk.biz tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 172.234.222.143:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 18.208.156.248:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 172.234.222.138:80 fwiwk.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 18.208.156.248:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 138.222.234.172.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 165.160.15.20:80 myups.biz tcp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 18.208.156.248:80 gnqgo.biz tcp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 18.246.231.120:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 18.208.156.248:80 gnqgo.biz tcp
US 18.208.156.248:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 8.8.8.8:53 iuzpxe.biz udp
US 44.221.84.105:80 jhvzpcfg.biz tcp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 18.141.10.107:80 acwjcqqv.biz tcp
US 8.8.8.8:53 120.231.246.18.in-addr.arpa udp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 18.246.231.120:80 vyome.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 18.208.156.248:80 yauexmxk.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 13.251.16.150:80 iuzpxe.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
SG 47.129.31.212:80 ftxlah.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 13.251.16.150:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.211.97.45:80 vrrazpdh.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
SG 47.129.31.212:80 ftxlah.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 18.246.231.120:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
US 8.8.8.8:53 dlynankz.biz udp
SG 13.251.16.150:80 typgfhb.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 185.94.254.3.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.211.97.45:80 esuzf.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 3.94.10.34:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 18.246.231.120:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
IE 3.254.94.185:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
SG 47.129.31.212:80 oflybfv.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
SG 47.129.31.212:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.211.97.45:80 yhqqc.biz tcp
US 34.211.97.45:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
SG 47.129.31.212:80 mnjmhp.biz tcp
SG 47.129.31.212:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 18.208.156.248:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 13.251.16.150:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
IE 34.246.200.160:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
SG 18.141.10.107:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 13.251.16.150:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 18.208.156.248:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 18.246.231.120:80 xccjj.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 18.246.231.120:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 44.221.84.105:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 54.244.188.177:80 rynmcq.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
SG 47.129.31.212:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 uaafd.biz udp
IE 3.254.94.185:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
SG 18.141.10.107:80 eufxebus.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 44.221.84.105:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
IE 34.246.200.160:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
SG 47.129.31.212:80 rrqafepng.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 18.208.156.248:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 3.94.10.34:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 35.164.78.200:80 tnevuluw.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 whjovd.biz udp
SG 18.141.10.107:80 whjovd.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 18.246.231.120:80 pectx.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 18.208.156.248:80 zyiexezl.biz tcp
US 8.8.8.8:53 banwyw.biz udp
US 44.221.84.105:80 banwyw.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 72.52.178.23:80 wxgzshna.biz tcp
US 8.8.8.8:53 reczwga.biz udp
US 44.221.84.105:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.211.97.45:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 18.208.156.248:80 damcprvgv.biz tcp
US 8.8.8.8:53 ocsvqjg.biz udp
IE 3.254.94.185:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 54.244.188.177:80 ywffr.biz tcp
US 8.8.8.8:53 ecxbwt.biz udp
US 54.244.188.177:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp
US 18.246.231.120:80 pectx.biz tcp
US 72.52.178.23:80 wxgzshna.biz tcp
US 8.8.8.8:53 zrlssa.biz udp
US 44.221.84.105:80 zrlssa.biz tcp
US 8.8.8.8:53 zyiexezl.biz udp
US 18.208.156.248:80 zyiexezl.biz tcp
US 8.8.8.8:53 jlqltsjvh.biz udp
US 8.8.8.8:53 banwyw.biz udp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 44.221.84.105:80 banwyw.biz tcp
US 8.8.8.8:53 muapr.biz udp
US 8.8.8.8:53 wxgzshna.biz udp
US 72.52.178.23:80 wxgzshna.biz tcp
US 72.52.178.23:80 wxgzshna.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 8.8.8.8:53 zrlssa.biz udp
US 18.208.156.248:80 xyrgy.biz tcp
US 44.221.84.105:80 zrlssa.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 8.8.8.8:53 jlqltsjvh.biz udp
US 172.234.222.143:80 htwqzczce.biz tcp
SG 18.141.10.107:80 jlqltsjvh.biz tcp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 kvbjaur.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 8.8.8.8:53 xyrgy.biz udp
US 18.208.156.248:80 xyrgy.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 htwqzczce.biz udp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 172.234.222.143:80 htwqzczce.biz tcp
US 8.8.8.8:53 kvbjaur.biz udp
US 54.244.188.177:80 kvbjaur.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 8.8.8.8:53 uphca.biz udp
US 44.221.84.105:80 uphca.biz tcp
US 8.8.8.8:53 rffxu.biz udp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 fjumtfnz.biz udp
US 34.211.97.45:80 fjumtfnz.biz tcp
US 8.8.8.8:53 cikivjto.biz udp
US 18.246.231.120:80 cikivjto.biz tcp
US 8.8.8.8:53 hlzfuyy.biz udp
US 34.211.97.45:80 hlzfuyy.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
SG 47.129.31.212:80 qncdaagct.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
US 8.8.8.8:53 rffxu.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
IE 34.246.200.160:80 rffxu.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 18.208.156.248:80 cjvgcl.biz tcp
US 8.8.8.8:53 neazudmrq.biz udp
US 44.221.84.105:80 neazudmrq.biz tcp
US 8.8.8.8:53 cikivjto.biz udp
US 18.246.231.120:80 cikivjto.biz tcp
US 8.8.8.8:53 pgfsvwx.biz udp
US 18.208.156.248:80 pgfsvwx.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
SG 47.129.31.212:80 aatcwo.biz tcp
US 8.8.8.8:53 qncdaagct.biz udp
SG 47.129.31.212:80 qncdaagct.biz tcp
US 8.8.8.8:53 shpwbsrw.biz udp
SG 13.251.16.150:80 shpwbsrw.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
US 8.8.8.8:53 cjvgcl.biz udp
US 18.208.156.248:80 cjvgcl.biz tcp
US 8.8.8.8:53 ereplfx.biz udp
US 8.8.8.8:53 neazudmrq.biz udp
US 18.246.231.120:80 ereplfx.biz tcp
US 44.221.84.105:80 neazudmrq.biz tcp
US 8.8.8.8:53 pgfsvwx.biz udp
US 18.208.156.248:80 pgfsvwx.biz tcp
US 8.8.8.8:53 aatcwo.biz udp
SG 47.129.31.212:80 aatcwo.biz tcp
US 8.8.8.8:53 ptrim.biz udp
SG 18.141.10.107:80 ptrim.biz tcp
US 8.8.8.8:53 kcyvxytog.biz udp
US 18.208.156.248:80 kcyvxytog.biz tcp
US 8.8.8.8:53 znwbniskf.biz udp
US 8.8.8.8:53 nwdnxrd.biz udp
US 54.244.188.177:80 nwdnxrd.biz tcp
SG 47.129.31.212:80 znwbniskf.biz tcp

Files

memory/3768-0-0x0000000001FE0000-0x0000000002040000-memory.dmp

memory/3768-8-0x0000000140000000-0x000000014064C000-memory.dmp

memory/3768-9-0x0000000001FE0000-0x0000000002040000-memory.dmp

memory/3968-18-0x0000000000510000-0x0000000000570000-memory.dmp

memory/3968-12-0x0000000000510000-0x0000000000570000-memory.dmp

memory/3768-25-0x0000000140000000-0x000000014064C000-memory.dmp

C:\Windows\System32\alg.exe

MD5 25723d8681471851d41af820455d04a3
SHA1 ac7feefef4dafb273c430a3e06e2e18c907e22b2
SHA256 a05c51a00e4eaa0b44db11cb5b69e2fa5f361ac3dd04558d6c52fc2ca34652e2
SHA512 7081f6308679d413fa9065405bd0829b32e2a46f036aaf9df99dc4b8939e26071f2cc1b0a33707787f95752f9e289f5f60c6f7957110feb9bea1aae7fc77f18a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 1fd2bcf7be677e004a5421b78e261340
SHA1 4e5abd04329ee1ffaebe9c04b67deef17f89ff84
SHA256 f539c848f584add20b43d5daefd614526b67adbf22b0c89eaa7802a8a653cd31
SHA512 929499946e38281bd808b37b362c4a86f3b6382eb1ecd5fc094410d3688906d14a114ca930a2cf38b6241ab734bc5959e6fe541270d47ca9538e82a68c99cc77

memory/4268-37-0x0000000000550000-0x00000000005B0000-memory.dmp

memory/4268-42-0x0000000140000000-0x00000001401E9000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 2b9871c20d9e302a1c680cac163c9158
SHA1 529b3102ed7c9ffff7db61f80950a4ecd57a1fae
SHA256 067b86e038dd392dcab21ad151d23d361f3261470216c0f812b3f98b5fa1bb4b
SHA512 eb3b937012f9080b8777039e3b3e3afcfb70f07fd0517903a1d73c73ab584b086a62eb10a07bc026f66d4c845db6be35acca8d56224bd715f8e3b14abca7a42b

memory/2700-50-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/2700-44-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/2700-54-0x0000000140000000-0x00000001401E8000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 0be99f3d82696e8f1c3caf8dc60dd53d
SHA1 3e0295a2fa97fd2bc822550010a59ae3abc48f18
SHA256 6088237e14f2ceb189aed353788b821c3537b76602f274189f0e09ed62c169ac
SHA512 6b00e0e5370718e9720871ad7592e77f2a71e7639b46860a13e69d619afd6df147245a627c29e88c87299749daec4aa0c210960ec24b9c7053a49a2084fb3090

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

MD5 a01743a529c7da7e40ca854a11d4d097
SHA1 2a85186facc42a5c3e32cc343f2db2c3d054fd5e
SHA256 50763fdc456abdd5a6777ab4d3db6dee121e02a76a89ef0f7c6f774944033b7c
SHA512 6d234b30c6200bf6c9d01ec9fc08e0da82c634b74011c6c103e9a05a3be54a2c8d8c7425d82d63eb260f97864261f470fba4a2021ee7ab7d27041d3740ce06cc

memory/1364-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

memory/1364-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

memory/1924-77-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/2284-81-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4084-97-0x0000000001AA0000-0x0000000001B00000-memory.dmp

memory/4084-110-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 c3508d09eb6b3d058b7c9944562b9361
SHA1 6413514bd7fa307e5af0258598b0b592b4787dfe
SHA256 b4fb47b471af499551be2baf3afb7648772a84cf7fc665d60291c839ac62cd2b
SHA512 e99f34ac40c22d16b5a36b83ee1909fac36dc3d1224a3b52f7e456abf212520dac16ee51dc36530b8a9b446e8aef6524074b10ef5a169902fd4fc6b3908c1e00

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 48069515b200b5f38f463b91ff1d3c43
SHA1 fda5ac4af8d5cd45a867cf133531dfb19cbba602
SHA256 2e3fb61fa981eb2f7a7f4d149292250bf7c0df9b47fb0d92f2a242c1e5e8e07b
SHA512 56af733a6820250131e0ad79c7eb66c2e9beead31fbfbd1f59f3a39254b786caaac9512de20d6fc73249620090635effd02dbfe83fad1036ca3074b509d245ef

memory/3968-120-0x0000000140000000-0x000000014064C000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 d1b0ea8af7f7d3996535194e93a05b26
SHA1 5cbcddc9600343b10d60ed292efe6a5cb820996f
SHA256 c5c752d6d0af97fe92577de3be4add765c38f894f434c1c8df730d7f1943e013
SHA512 75cc0269cdb09adc2622a2ac9ef2f7a3dd392564598a452a0aa9c1b73930a7ef389a79c5c9a1233b75c0b2930b141fbc1a4a9c04a9c6cc626331864d355e7d15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 a8cf54419129b874864cf206392ece0f
SHA1 2d8f78e5d6951faedba3257d5794227f34c50967
SHA256 b8a7649c907c010db609d7143f3f0601a385b9cf803f4b0bddb449c41151cc1f
SHA512 02a77857be5123636fdc44791f6cf7a4532fa53e34576be7f6ab21da51ef400fc138d7dda6a2880b2b42ddb22a803a1897e4f95ea3479487af61a199c7929a8c

C:\Windows\SysWOW64\perfhost.exe

MD5 398905c56250171cbe6091c469ffcb9a
SHA1 76c129a52ac1a8e83b32b51da36b0d984d30f78b
SHA256 432a583ac17850fa78caba048e3f75b2fb76ef80b70d07cadeb2dafdda98ac93
SHA512 661a4c86bf94efe9da0aa454d896915d8ee9616ee5caa52a1500ee7e3cf34e7bed055a67335295c30e131c716e0ac2fd3e6818df8910495dab91cc2a92bdb5f7

memory/2712-146-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/4268-145-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/2396-172-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/3116-183-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1364-188-0x0000000140000000-0x0000000140234000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 e780768b31dcd84b174735f3c5495b0f
SHA1 6c48dee06224055c13f9ea02a21eba1498ef5142
SHA256 6ce063bca04e9f4416d20dc8ac54ea6d1242db95823c298e58a315e289fbc27b
SHA512 ef8d56701e0a9b4aa80382a3565b5a62c27fe80104aca8b5c4ebef5ee0b75e570200a23f3f6709465d321305d957f0b981812b36eb12063969a4813d4f088bd2

C:\Windows\System32\Locator.exe

MD5 27cba5195c325590d0bb77926284d485
SHA1 a4bc84aea3e191179bc8846ffcfdfb17df35aabb
SHA256 6e54dbf256b1360eea25347ea1119be89bc371902096fe9442c209257c1a0ed6
SHA512 95e24ee1f3dbcb67afd2b910b920b767d879b0100f6bc198b9ca7f0102a64d816c842ab526f64e1ca200b64182ffdf131c098c3c32e09209840fc3b1b92f0f50

memory/1256-198-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/760-214-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 02d9e8ea1baa784c6bb5f0eaa04e70e7
SHA1 37c138ee4d9a54811745930e84999be3ac1a44b0
SHA256 7628e3780fbde76cc37cdbb7fef2bc36188041e73e35d0613d6e4356b271876e
SHA512 98eeced8ef3719b928c1e1cd7b4cd211bfda9dc1022d314fa4625ec50f0148aa5f4d19cd977df6538d4fec326acf67a16b8f38960738bb7b8d18577282264d4c

memory/4544-228-0x0000000140000000-0x0000000140241000-memory.dmp

memory/1140-239-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2184-254-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4224-265-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3528-269-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2880-289-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5160-299-0x0000000140000000-0x0000000140205000-memory.dmp

memory/5296-314-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3116-313-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 fa26d8603d2a9ab00d662ed99bfab5a2
SHA1 baecb7d74c0233ed0be6c9635f934d0610194ed6
SHA256 73ce9ab0b261dd120266b483824835e854030afb8c8b642736f3dbadaa3b593c
SHA512 4e3427d869aaa0a8df2137a8704e357fff999e5afd6cad01faf6518d29cbb4208823f01f1a4939a44838ad29717d4fa68c7fdaf3ca92c9bc579439e2989460dd

memory/2396-298-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 df95d9ebf5cac1945c3beffcee6c00a0
SHA1 70d4528f674891f23bb48d9b58339cb5486fcf85
SHA256 718696d1d813e004e98d6e751e9ce7cfc2a6cffc89a2d407cb08224f056282d2
SHA512 804e2d52133d3242a87da0fc00e5bd0de11bbed384ba68b98207d5d973840ecfa050dc74524d3434a6a749cc1c34756f1d07235d8ff1bb158edccae075ebad2d

memory/1844-288-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 2fe7705da14ff7bc8cdc1efadeebc42d
SHA1 e080daa2f9558303f8b49c2638f1c80565d3bba0
SHA256 ae78f59cee9041eb0148652d711ba2f6f0f5e281e3cdcdd0eccbba185f498f09
SHA512 f2c52cfcf18887b6206535f7070fea9fe4b2fd9a60b6daae000a7d028742a6af77f63bf105292350cf75d9e2164dde03963bde2b52001531acdadb212ceac05b

memory/2712-268-0x0000000140000000-0x00000001401EA000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 f6e56c858e5186bb187394d8a48d4744
SHA1 607d549d167bbe07b8d25af00a1edc5c47c8f7f2
SHA256 326d6ea746c42c67b7bfe65c775c7c7cee9388d9494436122dda256b85cf368d
SHA512 7aacbd5473b24c26368fe1a076b0d40acdbffb88199dd584b422398d1cbb2b5b3c6e923d6484d4886fb7319de4f2b480181b86c79ba764aaf77ca827eee63a53

memory/1912-264-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Windows\System32\vds.exe

MD5 0f393427b9fc585b7afe85b043edad5b
SHA1 80545afda13ae6d99c168395374644b6bea6d452
SHA256 6e8b4fda714441747d991564e6c43d34f5fba0d6e4d3943390aa6cde6bc109e6
SHA512 3bde82338a7722034b05674204d80ca983e956f566d4cadc4e26502adbf34dc32f79e3db4a5c9dc1b17058f98512a0bba564ec7c8f895ec9fc1f53f05317cf7a

memory/2184-250-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 fea81e0705f8cb5384d303662ba4e48d
SHA1 f2031cb0a16a4089b26ce35ac986d54382be7e94
SHA256 7369f1aefa536b1c9cbdf90ffa341c3e157fa3fde1e66a400fcab38378ac0835
SHA512 0ca3e36e8207674a5451923cec3e4809c55ac077c76faceb97f81908fa77cad4bfbc43fc502adeadb8632238fff88380cdba2170759a8feeb37f6f03fe22349b

C:\Windows\System32\TieringEngineService.exe

MD5 f1790e8845786cac656c23643df5c6cb
SHA1 ecd89cdfa2e04e6d9f141f021e7e65ff8a4ce0cc
SHA256 b1fadcad4ffcb357d38580ad32682cff79d79ae19d8907604269498e0d56440a
SHA512 9b54b3dd3f7423bcabf53a6cdbb7d7494008427803ca731454c02bc83a6c90b12c4dc629c4414286d41860a824b00619a4956adeac939fa4d169966304ef070c

memory/2284-227-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Windows\System32\Spectrum.exe

MD5 fbbc7b8bc8f76feaa15283bdb9fc18d0
SHA1 15f31a4585b4eb04e0638482deacc3993d44539f
SHA256 c5009bd6c0b873f3b220789f445b078b3723babe6042fa268ee78da6c3398813
SHA512 227034981bcebb3497f4799e973e0bb569e86f33aa70b036d3a26c51bb3992db6e518a4f93160b50a47c334a20e09639516cdfd84d2141cba10638fb27f40e1a

C:\Windows\System32\snmptrap.exe

MD5 928b270c631f44b96f61c9aa2e7b1df9
SHA1 2fac6da254d0fb197a9b01432a1d82e54f46edaf
SHA256 f6fcb0b7d5ac0078e3099df401a5804cd40f4bc3d00119b026924a6c74c0d3d5
SHA512 9fdada912aec8b428f7e07387ec77f8987d32952d4514304610aa9524eccd6048e49812997689b4676c1106de37acd470d37f11d6b9ac7c3279f1aaf9503257d

memory/1844-161-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1912-133-0x0000000140000000-0x000000014020E000-memory.dmp

memory/4732-121-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/4084-105-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 82fc571bce96b0bd81ff6ff90a1bf73c
SHA1 9ad96a675b6a2987383b0113908148f973b443d7
SHA256 a6f401964af5f78e72118418828c10d7784b42beca9c2705a6c1e36ccd0104bb
SHA512 29a0e4825fb5f60e766664822fc75384f4597b65cef1490ca017c5260ad258b166c3eac24ffe89ccc0e65aa525eb1dc0722fea82b79ed0b2a9542d592cea6ab3

\??\pipe\crashpad_3580_SWBTSJBMGZTIVAZY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1256-443-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/2284-91-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2284-87-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 80c66e3cd9ac21024b0b9dd136e5449b
SHA1 77f1f8dcfa976396800c97c8bdf8362f180e96c4
SHA256 370040530fc729aae45114e037edc76a0a0cc246f89fda4a846200818ec8bd8a
SHA512 004f52812275123edd45587b59abc619ea1fe7d461addb05a7763447657fc48a41a2469f54eea9ea6b488abc68adb9dd023f5092d281b5c277c8a71699076028

memory/1924-79-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1364-67-0x0000000140000000-0x0000000140234000-memory.dmp

memory/1924-63-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/1924-57-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/1924-56-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4268-31-0x0000000000550000-0x00000000005B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\ca9961ba99262766.bin

MD5 31f4c3221db62fab5636a2e94bfc338b
SHA1 f1111dad52cb7d8887e833fafda2046828a49988
SHA256 dfae48383b60a9ececf3ccf9935bedbabbdd6e26d71c0ef47b7ff4fd1ad55c09
SHA512 ca49f7c7f4edaae5f868480d5646e8068361b382cb06240fa9892d88141590d847ab70f52a0db763d586d06f2d2f46565e834cba37bd1e283b4195490a8d7bb1

memory/3968-20-0x0000000140000000-0x000000014064C000-memory.dmp

memory/760-503-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4544-524-0x0000000140000000-0x0000000140241000-memory.dmp

memory/1140-529-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

MD5 251a4e33f7f99a29c6161a2cd618961a
SHA1 ebcce900ea645b0992216e9a53f7d6576a00cc90
SHA256 3781369075b4ddc0c96619c33e87afb53349b69ba1eaa5f618ffc814a4ebebc8
SHA512 c3ea1f2dae15b5bc88988fff08dc574b8ea8a61f85713e48be7410c32e9a3df9a388f3e96fe8e54e4dbdf077900100c0f1b5ee99e9fbebcfdb86000b8397b87d

memory/1536-531-0x0000000140000000-0x00000001404AD000-memory.dmp

memory/5124-544-0x0000000140000000-0x00000001404AD000-memory.dmp

memory/4224-543-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3528-558-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/944-565-0x0000000140000000-0x00000001404AD000-memory.dmp

memory/2880-571-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Program Files\Crashpad\settings.dat

MD5 7852d94c362827c88d3dc1afaddbee6a
SHA1 37485b5394d6175a207b53dacf49b2f6ffd44896
SHA256 a5748f3d1825563a034741ca211d9f5cd8e8aa652d87be233581e12a7d4dd468
SHA512 6399b5d81fdb760a5b134032acec0ae3e3f4a3ba9c1114b9e6edacfd20a7b928f078a73d54b839dc4c3ac784bfe91c14cc16100f1fabff9696516be7ed393ee8

C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

MD5 786ee2da623825e37ede2004499ec9cf
SHA1 85f050dc5d27cd6734151df453f4d0b41d18a91b
SHA256 e91829aa8ceabca00ef0ec46bacb402d028167cd4f562155089884e2f0a9bb88
SHA512 141a078aec3ed98f4704afe1dcc3dc9192d5f795a0b57517cd2412b235013b9b7b9ad6363a9b147a71f22aeb96cd92848cf717b4e7e8e0013cc6495e3699db29

memory/944-591-0x0000000140000000-0x00000001404AD000-memory.dmp

memory/1536-602-0x0000000140000000-0x00000001404AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\scoped_dir3580_627703591\ddd54660-ecbc-42c8-ad9b-a3e9123b0802.tmp

MD5 da75bb05d10acc967eecaac040d3d733
SHA1 95c08e067df713af8992db113f7e9aec84f17181
SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA512 56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

memory/5416-614-0x0000000140000000-0x00000001404AD000-memory.dmp

C:\Program Files\Google\Chrome\Application\SetupMetrics\47f0427b-3107-4f68-8b59-e85099c3aeb5.tmp

MD5 d7bdecbddac6262e516e22a4d6f24f0b
SHA1 1a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256 db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA512 1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e2e86f8a04d0fc61aa2134ada7dc7237
SHA1 5835da7c4da846fb240bf568e69f2bc14d9edb9b
SHA256 9273438776b692c5fcf9f323db844799cc69cee351318a4058b544f86dcce242
SHA512 b52a1f47086ce830e513b42b2ff926795b973a31a935d47530c4cea107298f62ed8ba9e7648e7605a374c942ed8b1b1069aa33b9b4f11d5f040525aac19173ec

memory/5160-719-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e82e2ecd1fd6aa08dcabe27508221319
SHA1 30b0d83f9d2c1f121d5fecf29f0b8d8e916c56c1
SHA256 9530cddc3c3689fb81722f2a33a99a7884361256ccb8e7fa944678ae308ab822
SHA512 4605d5af74fd7191fd19ea9b19f60984d7619ba72d9663742ddba7f077d873755ce1edc5dcf592164761a97151793adbb648b9b1d2594f00d94684f36bee5cec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57f6d3.TMP

MD5 b48ed78fa1fb941b515f74b52fb1dca4
SHA1 6833d24d0a079eee124987150f719abb72989744
SHA256 335d3428a522b9cd6fbedc14d9664bba5b6ce573eb5d1d86e2023a22e3d72546
SHA512 845118738800dfd8449863a903f8f94927fb5c6a6cfc45e5d08ef32f62136a2df4ea6a784a2e9f95147189678b5775034234d52f6f38247a9ac371726d531c12

memory/3116-724-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 3b60570050a6821360351df62d1c2260
SHA1 f1709ad824765349b5d71b471610922e56b7cd1c
SHA256 d0e183b8eddfbb407af733808325a5aa9785abdd24d4ee5d0a0c4ffd79d85bbc
SHA512 62ce810becc070da3c9b1ce4350f2748e09a3599fca0ba70c4664b2e9821b40450f17fa2d5954e70926a66d77572254d520a8951d037a4ed985051c7be82a046

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 788cfd8afb5ad0208546ffd7a85fe657
SHA1 a63818cb3091a69f2ba56c22afd071d6b32c3445
SHA256 60166bb024344f0bcc20cc5327c8661e012fde5e76e4de0a860f25f411e107d5
SHA512 b9625fd5b1e72de3e236c4ece9400cd8df3795cfe51a585d1afc92b48e70628fd3a722d86878ea5dfc55f6eacba101836f2adb65871ae4f81769673d448e07f8

C:\Users\Admin\AppData\Local\Temp\scoped_dir3580_627703591\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

memory/5296-1015-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 090f0b9f0ee8334e561f74b4e9bd8703
SHA1 866eaac9dae014bcbc5f44a726229675cf343659
SHA256 244758b89b329feeeb0190429b7d1763aef97b2833f24b9e9036c0808b72a11d
SHA512 c3616ebdb10be140c00ca9c31389bcb8b6923af9b2795582eb5365a1de24e5f8fbd0d0f83816ff330731800120593dece7ed9daece926a28b512c66ad3801e24

memory/5124-1138-0x0000000140000000-0x00000001404AD000-memory.dmp

memory/5416-1139-0x0000000140000000-0x00000001404AD000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ec3744ccd10a15160fb6cdba248777c0
SHA1 54c33901183d2140e4a4f1c272b76be839f6733d
SHA256 cb7b597c3596d15b0b5eac5028e1bab8e905284e9603e6485c27094b4a16c7f2
SHA512 5b0525f1c34fafe31eefc7b489b1d0dbb540ab4451c13af93c53d2b5525723612d85aa68d39815687d7fad4504901385d72b4835fe6ff7b3351d51c0b7ec9547

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 22c69e3bd671374523e1d8347dd169d8
SHA1 e71531cfc5c82e72ff3a39a49048a1c1005cce94
SHA256 5aaa506485fee19f173fc31162d51393027f1d9ff4508de17dd908dbe36e155a
SHA512 a809562059d26f9d22a33e422b202e8820aa074d5be643edb2be4c57eb0b39dba5c9547cbb867b998d27e6470cc5d534c6a050c4ae18f0179dbb6dbdeb2bece1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 edf8d16da7b4dc89e47bd9465530e92d
SHA1 e43e9dbda9b7eb43de3429339df191af4b9a043f
SHA256 bf1f45dd41760cc7407ad8d5325017d4fa794c41b91e73fdaa4accddfb9ce4f8
SHA512 96feaf9f1bba54706b2c49ee87dd00384774e2f5ddb7b432e46aa24aef6670335ad813a5884ce71c84067271669bc80c83cb3209081335e774fbedf8fa206e4b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 f47776a7bb41c0c589f12fd09473ba1c
SHA1 21fd0c4328c38f8dd5402a828e7a013a83287702
SHA256 e541b518cf5cc716d2b380f3117c88ed26f4cfdf49b7cf292d4d8a3b71d1a63d
SHA512 f8608776336d14c0f93ddcda844cfcfada71117197307e4113767c83f29619fabba1e086c6b83b4e1502cc89c8cf4f9eb243ea8c6230df169ace90da4ac68ea7

C:\Windows\system32\AppVClient.exe

MD5 58573351fe249123920ad7a6ef8ec663
SHA1 f7f3e2ff5e211d15a5e1bf8c28fca4487cfa46d8
SHA256 abd44b9dadced02bcc6d8bf22d018f740c192e0c8661c06e6387b2b3fc60adbf
SHA512 043263397effcb01d3273f779e01e380b19983e7fc204e4ee04068bba106de7c8b2e173151a7216a57ce08709268697d5f3de1997d7388ff2b75eebd47fafcd8

C:\Windows\system32\SgrmBroker.exe

MD5 ee64fbf81581b06334a6f5a7666013dd
SHA1 61b3bbbd768df2697c9908a73f2deff2614c1816
SHA256 1b3f303b88fcbaec7912b2f3ce30b1b259111c3bb885095699438e02a4a127a6
SHA512 6f2297389900bdc1d7667a06a4165090abdd304c2e908936e0d2511565df61d9c062bda69c4b553cb842615e2f63bedd278a1e17eb6e1bea113de557261d6515

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 c0af5170c4de0af6dc794c9e4ffa38d5
SHA1 fa304524d92eb5727a6ca71b18ca68410db64df0
SHA256 839796bb4f797c7a0f708628a57b584b9487c8fbd58a16540eb8a55459b5ab8e
SHA512 cbeb107fb7f7ffbb9b1f5216cbac27be6fd17eba63d0315ec988b1c57db682ce6e4ac382f1ae2bfd389696106653eb285dfb908488b2caa39e52741cc8bc5dc0

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 3a988d7774e41d6bc4d0dbdb46929280
SHA1 9b4aedd49ff21333122e30be613a0fb762c8a043
SHA256 f93ec81b7b12e6d2600f0f1610c692fb72eb7a867c76f80f3b2b08717469c5a6
SHA512 4f3b9e9868b7f2ab7c3a205fecc18db683fc3b371715bad7569a1119389ada7bb710c3c8513ba9ddbd8c1be7d9d70d15e2d482613c9f5810135f05482c30f661

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 7faa4d42aea36f7fe4c870f26bb54a6a
SHA1 e3de72c890413bd0077df67b548843684fea358b
SHA256 fd46cbe4d2c82b4ab59c8ea8373d062d860e14062fb5d6f34537f2f9f3451c45
SHA512 8094a77c069210af6b231f605a28c3de9bfc329877387776f5d4f1f9949652cd02cb87253b6198bd6b1aba867f7e92a8cb005a19d7698ac8d8fda332053d18cf

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 4e0363c08b7c31c103f8b33c77eea8fe
SHA1 2917e9b957ac6f239d5837eba30d72136757f3cb
SHA256 0908984a65d67986fb7b016a34bcc8510e3483314efa3e5703c73ca8da57805d
SHA512 72e9de5374210d7bcd5e32fddeb5c79a6396049e8230187c112eefcb1cbc10820c4e3b9b3caface887d44541ce02208d23a57f8260bdb4f88f4b26425598c797

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 df6ee0e4fa3ba2a02e5b1e909e7c65d9
SHA1 16541cf78fb3f91d8bb58e744fcfec0b194ad922
SHA256 c768c666e3b82e12e9185f771904433520eefc0bcd6b39bc388e4a352ae7374d
SHA512 1fed2495870180cd28b00d4f8a1e1aa2e9ad4ace32fe2dc37e25ff1cc465a759b64c0744585ed9041a88e9da2fca941b8b37ecf5a2bc9c2ff3b28c6423a1e5e4

C:\Program Files\7-Zip\Uninstall.exe

MD5 0c7266b16a5183d841659349700730b2
SHA1 f42d74982cc23331ec1998267f91efd74f5a494a
SHA256 182bf50f049a53c100079f19b23ae60678fc9f858d5a9189d0761afc12f14bc2
SHA512 d873430336afe0c0aae9a3bb0d943de70db67e34880777fabcb5c8034e99ef2cc68ae7a2b63efe98e99116d3aea3a741a50720e19b08b20e30f30da6b8da74a9

C:\Program Files\7-Zip\7zG.exe

MD5 c86499a2b725016540530121c3f5b574
SHA1 85c460f80c0af0e1a0ce4669618bae4a3ac66f13
SHA256 04511d0067093eaac5e57b61edc96751971a4c4fdcda2a795e618e1b6781a5c7
SHA512 5d3abdfd9a0f1f7d2e2d38dbbd744bc5211afaa5252e8795473a69808512264fcffb66b42d721d1105e2253cb463e76457eba9997d857cb0965729c976a09b37

C:\Program Files\7-Zip\7zFM.exe

MD5 9199203525197713373dc8562064f3f9
SHA1 987b88a83db31a866dec024826d6edb8b3009d8a
SHA256 bebdd1bbc49ebec99d8ff83eab4faddd3a18c0b66734737bb30c3a5a9e6a90d6
SHA512 dfc6cc91e45c1425e15945318d9057c0103bfb16d9bd387a968527122913328bda82f6d8785b79e0cb1ae9e7b93189fe3e12bc256968f1c106ea8c3fbe5296aa

C:\Program Files\7-Zip\7z.exe

MD5 ee475878eab058ce725b4b60b2ec7cbd
SHA1 08f22d6d86e3f3f2483f027ec4c90c871a064e4a
SHA256 8fbeec6946efe21fdccda032f17b9b8c7fe99a921fb2a6437cf1bde200e74081
SHA512 b55497340eebd665145403fe79618d93884ab840b475cc0e316eb94d8c9419dc6c6cc9df85a6437620065c9a2e0eb2d5c6633bf22c5d64950c1d9a3c205c65d7

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 54fa7352f3ee7732acd896f590e8b52b
SHA1 71fdf83877eec2d008b2e3d856a345bf36a28d92
SHA256 29d144df1e5a0d4ea9d2e15347b0a0c307f82cef24214d6cef5a2c44e55cb35c
SHA512 044e3b277cd5126b638b39592927650269c27c337986256468b2b9e3fea32c3d64a4890ef6a7264a78967c6d5464e7130cbd6b4287fc75f75276d75967627caf

C:\Windows\system32\msiexec.exe

MD5 f6e89110aa774b0dd71241756c50e038
SHA1 bbeba3de46b3694290c50a32f7cf494cd1d19709
SHA256 5b452ba729a0ec52fc7b7629d13fbf6ce3243065fe140c69a87dae7228592455
SHA512 0e40e559392670efc2c9097dd5f21f313cb572c10f93c777362f9f1bbffd056436e5800afe89413a180ecd108b9c2adc46e5e1c19b32d2ef1ac64c1dcc1d25f1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7da20564101722979cb147431d0105a7
SHA1 cd2902b9be1cd63abaa94b26b40238659cf3b6dc
SHA256 e296edd82c9dad0b76acff6cde04dca94a9054220f858e80f0b08596072df217
SHA512 62b4ef52f91bc71bdd6db5438dacee52e31444d9a00b5751a678ac939d52d1f9e06dd907fcc842c94104bda6eca0dcb8f7d55362632f8eea3ba1bccb419f2449

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c6b0b174c35ecbb33d69e9b4cf685ad4
SHA1 600f25d3ba90efea17dd7d74ab38dbb85dd1876e
SHA256 431b6734ad461e9bfcb82dc323384673c17b9c7510b944edc129c81a53c1ca0d
SHA512 cc1ddf745875a1a981ad345df2185479cca587cd4e0edfff252190d9ed1f343e990322a588578eed37dc37022423055034588c057211fe9f81583586160ccb95

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c20a5c9349f1ca399fcba56986425d30
SHA1 d80a12e05aee231d1e3b47e0b22a9894d6dc61ee
SHA256 5569ddcc2882588a8e1286a90ba2cc4ea63f714788ab7d9394d0b516d4d6e1a7
SHA512 581b3ef9376651377754280b878ff08e91a9d48d9ded43c33fd3ef1a33731ab44793f94f98c0e60bd31ddcb77a96eb44b95ae14ad04ab5ea96a847833290fb2e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c187ed3ed89760939dcb03d15b2409f8
SHA1 5a1359058b8b4f45a3db2585f17b664528728b11
SHA256 c6d5f4a85a7768f51a508c2f49009e52ca01410f6263b7f8a08da0a5323bc5bb
SHA512 cd754f0806b78f248674b902e13c03c7ba270d8263127f21a7c5b39eccb066868a296abf5a6b1f53d028e3e80b11eed6c2f50373fe3011e9a5c48a6788e3e7c1