Malware Analysis Report

2025-01-02 12:03

Sample ID 221002-f1y9zsbddn
Target e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6
SHA256 e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6
Tags
bazarbackdoor backdoor discovery evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6

Threat Level: Known bad

The file e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6 was found to be: Known bad.

Malicious Activity Summary

bazarbackdoor backdoor discovery evasion spyware stealer trojan

BazarBackdoor

Bazar/Team9 Backdoor payload

Disables taskbar notifications via registry modification

Executes dropped EXE

Reads user/profile data of web browsers

Windows security modification

Loads dropped DLL

Enumerates connected drives

Drops Chrome extension

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-02 05:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-02 05:21

Reported

2022-10-02 06:27

Platform

win7-20220812-en

Max time kernel

152s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\syswow64\perfhost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\locator.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\alg.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\joghilbg.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msiexec.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\SysWOW64\bggmmljc.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\syswow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\SysWOW64\enaodnmd.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\SysWOW64\genfaofd.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\lsass.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\ipfoceej.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\mqacmhgb.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\ggiqmomm.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\alg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\svchost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msdtc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\alg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\dllhost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\dllhost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\locator.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\alg.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\ieetwcollector.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msiexec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\fxssvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\system32\ieetwcollector.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\svchost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\svchost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msdtc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\ekdlipnb.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\dllhost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\alonmhlh.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\lsass.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created \??\c:\program files (x86)\microsoft office\office14\iamnnknd.tmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\iddmjkpf.tmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created \??\c:\program files (x86)\mozilla maintenance service\hlloaokc.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\program files (x86)\common files\microsoft shared\source engine\ipfbnapj.tmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\program files\google\chrome\Application\89.0.4389.114\dacjbhah.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created \??\c:\windows\ehome\qacpgeab.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\hicpilko.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\ehome\ehrecvr.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created \??\c:\windows\microsoft.net\framework\v4.0.30319\jloidffn.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\microsoft.net\framework\v2.0.50727\jgfmdbco.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B2B5F54A-F2E9-4E57-BB2A-B2032EFFA19A}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\ehome\eemadcqh.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\ehome\ehsched.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\microsoft.net\framework64\v4.0.30319\bollabni.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\microsoft.net\framework64\v2.0.50727\oldolmal.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B2B5F54A-F2E9-4E57-BB2A-B2032EFFA19A}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification \??\c:\windows\ehome\ehrecvr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created \??\c:\windows\microsoft.net\framework64\v4.0.30319\ednepigo.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 268 wrote to memory of 1564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1624 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 820 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1332 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1332 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1332 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1332 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 564 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 2040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1644 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1552 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1552 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1552 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1552 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 268 wrote to memory of 1444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe

"C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 1a8 -NGENProcess 1ac -Pipe 1b8 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 234 -NGENProcess 214 -Pipe 230 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 234 -NGENProcess 1a8 -Pipe 1b4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 220 -NGENProcess 214 -Pipe 22c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 23c -NGENProcess 228 -Pipe 210 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 244 -NGENProcess 214 -Pipe 220 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 238 -NGENProcess 234 -Pipe 1ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 240 -NGENProcess 248 -Pipe 228 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 24c -NGENProcess 214 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 250 -NGENProcess 234 -Pipe 224 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 214 -NGENProcess 250 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 250 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1bc -NGENProcess 1a8 -Pipe 234 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 248 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 270 -NGENProcess 1a8 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 1bc -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 274 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 278 -NGENProcess 1a8 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 1bc -Pipe 214 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 1a8 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 27c -NGENProcess 1bc -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 28c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a4 -InterruptEvent 18c -NGENProcess 194 -Pipe 1a0 -Comment "NGen Worker Process"

Network

N/A

Files

memory/1672-54-0x0000000075201000-0x0000000075203000-memory.dmp

memory/1672-55-0x0000000001000000-0x0000000001280000-memory.dmp

memory/1672-56-0x0000000001000000-0x0000000001280000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 bebb3b56edc633e0466cdbbd01da4bb7
SHA1 4c0765c11680b3b3582965f81f4a0e325d9cda0c
SHA256 bc793a5ed02fcf60102c219d2acb4bfdacdce39f482c80626f8cad0fc043308e
SHA512 d706f3468b1407c5d8d8c4b02cb304744f86c8f23a5b60b72bf48cc084b35b4090d3d137d1ce054f35767ffd11670013a4b497afc4d8addeb409000f56752feb

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 bebb3b56edc633e0466cdbbd01da4bb7
SHA1 4c0765c11680b3b3582965f81f4a0e325d9cda0c
SHA256 bc793a5ed02fcf60102c219d2acb4bfdacdce39f482c80626f8cad0fc043308e
SHA512 d706f3468b1407c5d8d8c4b02cb304744f86c8f23a5b60b72bf48cc084b35b4090d3d137d1ce054f35767ffd11670013a4b497afc4d8addeb409000f56752feb

memory/1532-59-0x0000000010000000-0x00000000101CD000-memory.dmp

memory/1532-60-0x0000000010000000-0x00000000101CD000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 99a98c8bcbb383ad865920a0e4528485
SHA1 bdd86153ab6444583895846c7a2820f755b8ffe1
SHA256 869f2e3587a9c6b08adb533e53dd5fd5ed314ae90c447cf90ff9601e963fa21e
SHA512 8297ba24606d576cc0fd24cd9119e42647f25706d64996f99cdf4742cea851a1f932d2b4f06deb3236d814d02d263def7d46d2e71a9fb36658cfb4d7559db9e9

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 99a98c8bcbb383ad865920a0e4528485
SHA1 bdd86153ab6444583895846c7a2820f755b8ffe1
SHA256 869f2e3587a9c6b08adb533e53dd5fd5ed314ae90c447cf90ff9601e963fa21e
SHA512 8297ba24606d576cc0fd24cd9119e42647f25706d64996f99cdf4742cea851a1f932d2b4f06deb3236d814d02d263def7d46d2e71a9fb36658cfb4d7559db9e9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 99a98c8bcbb383ad865920a0e4528485
SHA1 bdd86153ab6444583895846c7a2820f755b8ffe1
SHA256 869f2e3587a9c6b08adb533e53dd5fd5ed314ae90c447cf90ff9601e963fa21e
SHA512 8297ba24606d576cc0fd24cd9119e42647f25706d64996f99cdf4742cea851a1f932d2b4f06deb3236d814d02d263def7d46d2e71a9fb36658cfb4d7559db9e9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 99a98c8bcbb383ad865920a0e4528485
SHA1 bdd86153ab6444583895846c7a2820f755b8ffe1
SHA256 869f2e3587a9c6b08adb533e53dd5fd5ed314ae90c447cf90ff9601e963fa21e
SHA512 8297ba24606d576cc0fd24cd9119e42647f25706d64996f99cdf4742cea851a1f932d2b4f06deb3236d814d02d263def7d46d2e71a9fb36658cfb4d7559db9e9

memory/960-65-0x0000000010000000-0x0000000010202000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/268-68-0x0000000000400000-0x00000000005D6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 f555e4bbf67ece3393b601c172af772b
SHA1 5962b661c9eb226ff341bbdec5edd0eb4df5b035
SHA256 927dc917cd30ae696f1030dca213be667efa2a7224a61fb066dc4e44cbedf5d9
SHA512 d00e2c06b5cd3d18757a071e1a6cd2aebe3d89e709d4a6241fae366095eec4d543502e49c41e94f0ed8db61155e97314ff509d5db2b3ba41b68eebcea52e4938

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 f555e4bbf67ece3393b601c172af772b
SHA1 5962b661c9eb226ff341bbdec5edd0eb4df5b035
SHA256 927dc917cd30ae696f1030dca213be667efa2a7224a61fb066dc4e44cbedf5d9
SHA512 d00e2c06b5cd3d18757a071e1a6cd2aebe3d89e709d4a6241fae366095eec4d543502e49c41e94f0ed8db61155e97314ff509d5db2b3ba41b68eebcea52e4938

memory/392-72-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 f555e4bbf67ece3393b601c172af772b
SHA1 5962b661c9eb226ff341bbdec5edd0eb4df5b035
SHA256 927dc917cd30ae696f1030dca213be667efa2a7224a61fb066dc4e44cbedf5d9
SHA512 d00e2c06b5cd3d18757a071e1a6cd2aebe3d89e709d4a6241fae366095eec4d543502e49c41e94f0ed8db61155e97314ff509d5db2b3ba41b68eebcea52e4938

memory/1564-74-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

\??\c:\windows\system32\alg.exe

MD5 1ef178f89b082cf8d175a8b05359ebf0
SHA1 ccd491860fbc9d4d15c2bb16b1afb6b1bacb7303
SHA256 6349d33229e59bfde160410d42dc23758f7f389b5b2218aed96564c21ef38bcb
SHA512 d09f22fbca8c918d7924b94334e751669b5581335ccd03916519e1c46287ce47c2d50c9676b91cf36cec7c3f835916582905de3b6bff251d9b079108061a9537

memory/1564-77-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\windows\SysWOW64\svchost.exe

MD5 47cab9a6a18fa5fde289b9ae0aa641a4
SHA1 2ce19c2fd6eed4805842bc092f02536add4296fb
SHA256 d76cc5659bd627a1c84ea7c798f89f1bb0e058687a0fd36b1df333283585cec3
SHA512 9eea8d832dc3b3639f1ab3764678e84244b9dee74ad894dec633a7ab73c67dcadd3430ffaa5fbc74ccaa4803a3ed927e23d8685595d5e53c7351138623b906ac

memory/268-79-0x0000000000400000-0x00000000005D6000-memory.dmp

\Windows\System32\dllhost.exe

MD5 45195d9abb720006ed98f20d492ec9bc
SHA1 303a73468b1a5848fc8f20f99f34e494965dad7c
SHA256 2ae0f318b1bb63f13ad7d406a20ca2c41d0c4f56a1afc4e81ba2ec81d66ca47d
SHA512 24a743b8417997058a2b1703477494089e824c2071397a5c518d06d804f135c11015707768d52ca6b884bbdf386f4c718b9df567521f23368b9688ac32e8141d

C:\Windows\System32\dllhost.exe

MD5 45195d9abb720006ed98f20d492ec9bc
SHA1 303a73468b1a5848fc8f20f99f34e494965dad7c
SHA256 2ae0f318b1bb63f13ad7d406a20ca2c41d0c4f56a1afc4e81ba2ec81d66ca47d
SHA512 24a743b8417997058a2b1703477494089e824c2071397a5c518d06d804f135c11015707768d52ca6b884bbdf386f4c718b9df567521f23368b9688ac32e8141d

\Windows\System32\dllhost.exe

MD5 45195d9abb720006ed98f20d492ec9bc
SHA1 303a73468b1a5848fc8f20f99f34e494965dad7c
SHA256 2ae0f318b1bb63f13ad7d406a20ca2c41d0c4f56a1afc4e81ba2ec81d66ca47d
SHA512 24a743b8417997058a2b1703477494089e824c2071397a5c518d06d804f135c11015707768d52ca6b884bbdf386f4c718b9df567521f23368b9688ac32e8141d

\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

MD5 b1364b278283ca4545f4fd5cd2f6442a
SHA1 f1a2490e5cb3d95becf60ce3cc8ebe3ccc336aeb
SHA256 6544da6214421484a7ceeaf97d3876d61f89f255ef0aaaac0fe86c9b101a6c11
SHA512 1d6776592dbf2b1e241ef092f4cfde5a2bdb3cdc0c7f43cd94787ee753ffa595496d086a3df73430f7b85a5538cf5632806a98b40aaf26dcedd1edbc06e3635e

memory/392-85-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1912-86-0x0000000100000000-0x00000001001F0000-memory.dmp

memory/1564-87-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\windows\SysWOW64\dllhost.exe

MD5 6579510651d5155d3e59f6d41d58bbd1
SHA1 f04d1639b26d25175e6f3ee0992034345a31debd
SHA256 12fb85514c5aa3239f3c0f8dc656bef512063b01544ad976f3f98cf32dfda5f8
SHA512 2a777c3f77f45e8cd7ab6e37ed1b96df7bc469daa16bf1efaeb7431bc2caffa79c081dd3063d6b1acad7b6809b004054d2211981fc113f23fbb93458f011f748

\??\c:\windows\system32\dllhost.exe

MD5 45195d9abb720006ed98f20d492ec9bc
SHA1 303a73468b1a5848fc8f20f99f34e494965dad7c
SHA256 2ae0f318b1bb63f13ad7d406a20ca2c41d0c4f56a1afc4e81ba2ec81d66ca47d
SHA512 24a743b8417997058a2b1703477494089e824c2071397a5c518d06d804f135c11015707768d52ca6b884bbdf386f4c718b9df567521f23368b9688ac32e8141d

memory/1440-90-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

\??\c:\windows\ehome\ehrecvr.exe

MD5 3791b7859afa775028b5b3ed14dd9df8
SHA1 3d35d35fd78f1885f19c5b6fc831bf31e55182de
SHA256 dee86dd8554af037d88846ac3202f692902dfdb7ab27576e437a9906f7b4f384
SHA512 421f5972484a3b0df01f7709748658b89405ea0fd024d61b3dbd4e50333e4deb9aec59bd2e4718ae6451e0ac3ccddff050091299107b4798f0aca598de6a7442

memory/1440-93-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\windows\ehome\ehsched.exe

MD5 846fca6e907f53eaa13f7968d6a6c57d
SHA1 60d81357dade5032c1f8d44baa4fefde7e3f0607
SHA256 7c1d3d39f0f23c95d0221f0b52857fba1cfddec1b6575a119ac22ad00a9f4a7e
SHA512 506b7652a99a0cc9a95f4813fa5e5fd0df6a388e887656674ad27f2504eddc319e41fb9d1e17c70d732ef196894fd52742b832e6f0f954be78914aa420a0a305

memory/1564-95-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/2000-96-0x0000000000000000-mapping.dmp

memory/1440-98-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/2000-99-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\windows\system32\fxssvc.exe

MD5 a400c300dfe5fd2158d731ab781564f0
SHA1 4edc3fc9573742f1680334d2f3319b98856a2801
SHA256 a0c8aacc6233017edfece92673cb7f1e81f417e972a7532768c67e20a546755d
SHA512 4274b74d36bcc535b24a452f4cf244deacecff5b3b0c6e5ffdc9002682313befe70f4320bd3b48c4f278c1f0a1d1ce5687a2d967da6df6b26bb18c4abf1d8a4e

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1624-101-0x0000000000000000-mapping.dmp

memory/2000-103-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1732-104-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1624-106-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe

MD5 a62f102ac9beb4379a221984537c7c46
SHA1 d48e41af63ed106dc66ee6e62fcc2d9c9bd61243
SHA256 d2cc24983c4b5f3550bdeddfea34f1d7ae1db37dc90221aa63b31a50ac2bc13e
SHA512 af8a8abab3886b90bea26ff62a5fff0558199a951967add71d7fbd13df31c2e0d57492cabf0025e2e4d9cc0d857dd4e820ac6371c6a679d05252c848406a0756

memory/1732-108-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1732-110-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1460-109-0x0000000000000000-mapping.dmp

memory/1460-112-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe

MD5 9a07322eea81e04bfd21f86ab37fc7e0
SHA1 f8d8295e396d204fdad156d47758b52f88b0cbd6
SHA256 3b49694a4d529f26813445639a7888714baa8a8bd6424ddecab15d5d6a89980f
SHA512 c96846021c4bda383abf0226734f8cc056802f8ef293f1dcddfcd753a1f757725567d2ee05608768b99e1a5cf1a92edea0dcc5e08353d4d373b63dbf7861005a

memory/1912-114-0x0000000100000000-0x00000001001F0000-memory.dmp

memory/1460-116-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/820-117-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1460-119-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/820-121-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1332-120-0x0000000000000000-mapping.dmp

memory/1332-123-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/564-124-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1332-126-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1676-127-0x0000000000000000-mapping.dmp

memory/564-129-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1676-130-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/2040-131-0x0000000000000000-mapping.dmp

memory/1676-133-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/2040-134-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1644-135-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/2040-137-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1644-138-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1744-139-0x0000000000000000-mapping.dmp

memory/1644-141-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1744-142-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/684-143-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1744-145-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/684-146-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1552-147-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/684-149-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1552-150-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1552-151-0x0000000005690000-0x000000000574A000-memory.dmp

memory/1444-152-0x0000000000000000-mapping.dmp

memory/1552-153-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1444-155-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1712-156-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1444-158-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1712-159-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1784-160-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1712-162-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1440-163-0x0000000000000000-mapping.dmp

memory/1784-165-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1440-166-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/2016-167-0x0000000000000000-mapping.dmp

memory/1440-169-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1652-170-0x0000000000000000-mapping.dmp

memory/2016-172-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1652-173-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

MD5 d6addbdd84f246a7d04cb43146d12c3e
SHA1 74949dc9026d175346dc7bab9c75650d4e4591b5
SHA256 7b1b7f9b84fdfbbd994c7f2cf0d5e92edeb30f9ebd3b2db0674cd21aee96728b
SHA512 e586fd12fbc4040231658fa1c241cae6dd3e105b1da283f450ae9de67ead49c61e4f49e32f21030be55345748040570d79531e743fae5033ab831a2ef266d0fd

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1872-175-0x0000000000000000-mapping.dmp

memory/1652-177-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 82615b7a6cca761252a603fc8aaf8abc
SHA1 25349ddfe326281820bd008b19f00e9d3c068660
SHA256 110865f59d95e3c91c9c102a2d1bc9e42839dce581bf7b79e93174b7dff87941
SHA512 e877588e1313eecfa8789cd64b4ebf407f09ed65082e3dd8cf06f22db85b6bff874e36b9de2d758185621cc1290b5bc4a87fa85b0eee9cce80c0cbcc83ae2062

memory/1352-178-0x0000000000000000-mapping.dmp

memory/1872-180-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1352-181-0x0000000000400000-0x00000000005D6000-memory.dmp

\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

MD5 999464654e1f74ad17b80515f173a8ad
SHA1 44f9f6966aa3616ba56d75772c5e97ec662cf0a6
SHA256 b0149fc344601438c2331626e7d7cbb1fc199d9476d1b1b87be54b44dd36e940
SHA512 4150cfa58aafdf25e756f14d405b0c968cf65297f9ebd8e2ef6db97e61aa6f2f8958e49483d1647c829aba835a121b98ed7adf30d9e91f2e7feff5548ad3de67

memory/1352-183-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/1320-184-0x0000000000000000-mapping.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 be6609b1bf2b1143fdf1dc951a07e7e9
SHA1 294c078ced78aa66e33f69dc218d3c9b29844dfc
SHA256 1231d7c64a28a2015139586615966a160cc0e9216ed12c23a7324e0b5d44bf78
SHA512 74a53b4bff7910108bf9f428f580e04a362b3e6542aa2f52bcfca9e3500d674bfde0be8b3ac659c8c25e9ece67cd9e502b19a20b292e417bc47c9d7b2757c833

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-02 05:21

Reported

2022-10-02 06:28

Platform

win10v2004-20220812-en

Max time kernel

178s

Max time network

181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe"

Signatures

BazarBackdoor

backdoor bazarbackdoor

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables taskbar notifications via registry modification

evasion

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2629973501-4017243118-3254762364-1000 C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2629973501-4017243118-3254762364-1000\EnableNotifications = "0" C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\G: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\P: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\Y: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\U: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\Z: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\I: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\O: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\R: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\M: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\S: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\W: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\N: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\X: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\H: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\L: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\T: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\E: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\Q: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\V: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened (read-only) \??\F: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\J: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened (read-only) \??\K: C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system32\vds.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\searchindexer.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msiexec.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\vds.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\SysWOW64\lsass.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\WindowsPowerShell\v1.0\glidemac.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\qgpkckle.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\alg.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created \??\c:\windows\system32\openssh\oggfejop.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\wbengine.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\Appvclient.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\sgrmbroker.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msdtc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\aiqcljlp.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\tieringengineservice.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created \??\c:\windows\system32\olemmfce.tmp C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created \??\c:\windows\system32\okdpjkfb.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\ekahockl.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\syswow64\perfhost.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\searchindexer.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\vssvc.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pibbaghj.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\svchost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\Agentservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\SysWOW64\hkgajbjn.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\sgrmbroker.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\sensordataservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\SysWOW64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\system32\snmptrap.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\windows\system32\lanmlgeh.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created \??\c:\program files\windows media player\gocckohp.tmp C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\jmmpndhg.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\opdlodcd.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File created C:\Program Files\Internet Explorer\akgcadpd.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created C:\Program Files\7-Zip\mnclgkoo.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created \??\c:\program files (x86)\mozilla maintenance service\fgcdobib.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\program files\common files\microsoft shared\source engine\dfdgciqm.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created C:\Program Files\7-Zip\bglnccaf.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created \??\c:\program files\google\chrome\Application\89.0.4389.114\lllgakkl.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File created C:\Program Files\7-Zip\ckjgpiji.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File created C:\Program Files\7-Zip\fijffced.tmp C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
File opened for modification \??\c:\windows\servicing\trustedinstaller.exe C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe

"C:\Users\Admin\AppData\Local\Temp\e38af0d79c15c641f3856bca0471b6e7205acac3d152816dc6ee8335e2a946f6.exe"

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

Network

Country Destination Domain Proto
IE 13.69.239.72:443 tcp

Files

memory/1844-132-0x0000000001000000-0x0000000001280000-memory.dmp

memory/1844-133-0x0000000001000000-0x0000000001280000-memory.dmp

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

MD5 351de0b2b3c28b71fde928332fc4eb34
SHA1 41bba31016e7eb7a28f298d1ddbd3e7f0bf143ea
SHA256 611351037b32ea672ffc5805827bef65c8c8ada137b766afb8f949ee1b51d8c3
SHA512 1e3a77a2749648338db3711383bd52bf1b2b5d2d25776651838862a7308d72e76f0187b3eed8a6b3ab0082bb625b54eefe128c91d47aa57673cb710d666e7da8

memory/1752-135-0x0000000140000000-0x0000000140369000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 b28a38c4701489a6013bfb34282f3f70
SHA1 ee8960071e9d4d11ae310ce62114d9aebce9711c
SHA256 a03dddb0444d28be913f33743cc4deff96d68a01b8688fbe6ca3aecb7a77a029
SHA512 c13225e1d48ff655eb0c787175abd1e2fe8318a925e1a3df1b1626416f13ab2596d09d22ffef9329a33e8a2e27f98d44ecfe2b6e49c869170c97a977297665db

memory/2864-137-0x0000000140000000-0x0000000140387000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 bf1798e4b4d62f9c9ee3b2a13c6639ac
SHA1 164b72a907835638e8c8bc41199ed21e0a67d4e5
SHA256 04b0883f53698dbb2db1a0861b6d91cb9b88bebb7164e9f30ecbe822821d0f7a
SHA512 9ad0b26f387a8d652e222082f977b19db7880089c5b43b5fdbfd371a56f6350e74a14888dc9712ba1359e09486d59590f467acdc9e091efbe6b60e9b2cfd4173

memory/1720-139-0x0000000140000000-0x000000014022A000-memory.dmp

memory/1720-140-0x0000000140000000-0x000000014022A000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 1505f9da84f04972a2d82c1dfe1b5805
SHA1 75e0944f3ac0af0464066326402070fecb81b943
SHA256 017fa4a696f6ebddb517b09933e4ef07e9a1e46e4ceab9271866c7aa1eb9633e
SHA512 bc6bfeb2ae2063f99ffbf6bbb67d1cffd6b18dff58db035a566927fe4c40040550493cd5fef3490e39c0809aeaa74463781697b90a41cee1d9765cb8adf5994f

memory/3832-142-0x0000000140000000-0x000000014022A000-memory.dmp

\??\c:\windows\system32\Appvclient.exe

MD5 3358872f42a7df5c5fffb639fd100a69
SHA1 32251163391300683d955a37991d481bc0f18daf
SHA256 dbbf7cc5b5b8a3da44135aba26b3c370e8ba0b4ab2ed07ffc0d059f49dccbe33
SHA512 9e8b816422c44d19badb2c2b283af1db23073e18d992f8760d943b520c506450f51ddcbd66d201eeff4222af85a742d33c4b105754407e82f53a973795f5e961

memory/1752-144-0x0000000140000000-0x0000000140369000-memory.dmp

\??\c:\windows\system32\fxssvc.exe

MD5 cd30eaa8665356407ae9d0c3bec628bb
SHA1 f629db2cb5fc0aebb81735f375de961263990f6c
SHA256 41146210e7a5c4a98f1e654f158f1c4b159c81ed7821d7c1697764dab7910c8c
SHA512 dd9a6e6c9364a3fc2195bd1b38d65d838414b489535e53c214bc1c4df52a1ce4b9adbb8299a8f84c1fd5a910c741971c1a76d75c69fe1ae47de50c5499cd08ba

\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

MD5 bf1798e4b4d62f9c9ee3b2a13c6639ac
SHA1 164b72a907835638e8c8bc41199ed21e0a67d4e5
SHA256 04b0883f53698dbb2db1a0861b6d91cb9b88bebb7164e9f30ecbe822821d0f7a
SHA512 9ad0b26f387a8d652e222082f977b19db7880089c5b43b5fdbfd371a56f6350e74a14888dc9712ba1359e09486d59590f467acdc9e091efbe6b60e9b2cfd4173

memory/2864-147-0x0000000140000000-0x0000000140387000-memory.dmp

\??\c:\windows\system32\msdtc.exe

MD5 30249840167336f9582a43e654ceebf8
SHA1 c3589864ffea8622e34cd51f6bc23ea9da66e9bd
SHA256 2d093ffc158c502dac83f312b98ab9ec81913922b8b4f94def1bf9aed19daccc
SHA512 876cabf806ef3e4fa4ef0c0056da32f85f04424867f3f774b580ddbc4b318198ea53dc3dc87096719bb4fa490ec452c7f3e6af32151f74456ead2759dd87963a

\??\c:\windows\system32\msiexec.exe

MD5 36488c1b55264867f6f83196c2ec956a
SHA1 c9de081c1c75c0e9ec61ebf13cd6a6f64c1b4ae7
SHA256 8379eb97fabeb760d7101fa41b80625960627b73c606dd3ee851568e479895df
SHA512 65194a11dc6d6e1f2609b5c0b0021f02167cc1465bbda0d21cef73987ac28f9d2a56cd7ffc759d9c6e2d7a4f9c7707e7cbb6b09114756cc0055a0db500ae6b7b

\??\c:\windows\system32\snmptrap.exe

MD5 fc72e4137590f9bd533bc2a6766ff8b7
SHA1 2fe3c00019e78dc0a9abb6e6b014972c9a15186e
SHA256 e02be5f67efde38b0f7c2fa0ada90ab9376fb0881c670bad1069a1075a3e7788
SHA512 7e5db6d6e46cecd7497bf9e0a29069b03f18b8ccb3b19ef31ce60eb7d69b259b450c5eed695dd369f104a9fa7b0417cc1d703914938d1fdb407528c8158bd32a

memory/3832-151-0x0000000140000000-0x000000014022A000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 1c2b64b4fde132b000c5c3b5899e8568
SHA1 2860a5a2ec4512afbc32e5e14d104f8ae3daa5ce
SHA256 31b6b97ac71502d7abfff6ff20780008643ce3786274d1e99817c78e1651bc74
SHA512 1d6a0bd5f1daaa732b3ec50fc807d73207a357fb5e1274fe1bbf2b7c83c306bfbd10ad4ad99c0ee855777127da9520d4f2d6dde117881bca8c9e5ff3b9469eca

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 1c2b64b4fde132b000c5c3b5899e8568
SHA1 2860a5a2ec4512afbc32e5e14d104f8ae3daa5ce
SHA256 31b6b97ac71502d7abfff6ff20780008643ce3786274d1e99817c78e1651bc74
SHA512 1d6a0bd5f1daaa732b3ec50fc807d73207a357fb5e1274fe1bbf2b7c83c306bfbd10ad4ad99c0ee855777127da9520d4f2d6dde117881bca8c9e5ff3b9469eca

memory/3732-154-0x0000000140000000-0x000000014025D000-memory.dmp

memory/3732-155-0x0000000140000000-0x000000014025D000-memory.dmp

C:\odt\office2016setup.exe

MD5 dfccb2a46f546e7d1f310a7f296f5e41
SHA1 b8b8ae95b187efc09dbccb3d51a379004a1e9eac
SHA256 fc6ac343ab1a62a5518e7ce154c8172fab2a02a7e8a8a3a30378423327a10399
SHA512 1cf3a90ae0a7a452a7dd06313fa587299a159fc0d5c9b21971c350dc86ecccae8f32b55912dafb601545d70c8b7ada1cd128842be6878275d099d37976a4f7b5

C:\Program Files\7-Zip\7z.exe

MD5 42466a0e78355f80892e3c265a28fc6a
SHA1 8b8e16f3624597414ca7c0b7cf0ec41e904582d1
SHA256 01318727d5a8dbb9e7676e010a6d4782c61c093afe9a336e385b9b8aa2dfad6e
SHA512 c1c8c8a159972961affae3989f88ebe736bde586c670d403577a6059a365a14eea5ea5112790b39ac137071e9ff875b28b5ad696bd1745a505d0ff69f1aec5b0

C:\Program Files\7-Zip\7zFM.exe

MD5 62c455924f6ba101211bd539ef86bd03
SHA1 bb1fa34c553d34595faa9d768026e8f03064002f
SHA256 4a08e4185fc9a073ad311189136f58c790b5f4067cb0145fa6c377653a087d09
SHA512 b8c2d0e3d20cdfe1ea7c31cf4e9e2a5464e85a66c2bc380ddb642f8d54d986b57947498a821ef300bf5cd2143b3c6dc8c25a743e4c07a957ad93d50465338306

C:\Program Files\7-Zip\Uninstall.exe

MD5 498848cfd0409f145adc20653b31b4bf
SHA1 40d199cb96aa8fb506ce87fa4ab1c4bc714faa0f
SHA256 ebc76dd2f62b9ce26c7126aef9d0b9496c944147eec7cf65424dfc0cb7093432
SHA512 dc77e0c2240e9cdf8673bf7c1d208a2c53c43c948e738fcd0db4c6431d5cffccb7ddff1470d8b0e12ad088475019ddcec5df0ac37b7c4573101cccc1d6f75529