Malware Analysis Report

2025-01-03 07:46

Sample ID 230424-jvd9eaae88
Target 35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe
SHA256 35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097

Threat Level: Known bad

The file 35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Blustealer family

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Uses Volume Shadow Copy WMI provider

outlook_win_path

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Checks processor information in registry

Script User-Agent

outlook_office_path

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-24 07:59

Signatures

Blustealer family

blustealer

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-24 07:59

Reported

2023-04-24 08:01

Platform

win7-20230220-en

Max time kernel

97s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b46c72826a969e.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{617F050A-CA51-45C7-A30C-62A35BF1B385}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{617F050A-CA51-45C7-A30C-62A35BF1B385}.crmlog C:\Windows\system32\dllhost.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{EDE37A51-30D5-4E61-A943-82082BA0004A} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{EDE37A51-30D5-4E61-A943-82082BA0004A} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 924 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1412 wrote to memory of 1112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 1112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 1112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 1112 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2212 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2124 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2088 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2088 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2088 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2088 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2064 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2064 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2064 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2064 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1412 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2776 wrote to memory of 2344 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2776 wrote to memory of 2344 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2776 wrote to memory of 2344 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2776 wrote to memory of 2216 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2776 wrote to memory of 2216 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2776 wrote to memory of 2216 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1412 wrote to memory of 1948 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 250 -NGENProcess 24c -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 254 -NGENProcess 258 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 25c -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 23c -NGENProcess 258 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 240 -NGENProcess 264 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1ec -NGENProcess 258 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 26c -NGENProcess 23c -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 25c -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 250 -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 26c -NGENProcess 27c -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 264 -NGENProcess 24c -Pipe 240 -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1283023626-844874658-3193756055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1283023626-844874658-3193756055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 264 -NGENProcess 24c -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 70.32.1.32:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 70.32.1.32:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 70.32.1.32:80 uhxqin.biz tcp
US 70.32.1.32:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 199.115.116.43:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 170.178.168.203:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.115.116.43:80 anpmnmxo.biz tcp
US 170.178.168.203:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 tbjrpv.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
US 8.8.8.8:53 gnqgo.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 199.21.76.77:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 173.231.184.124:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 72.5.161.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
DE 169.50.13.61:80 lejtdj.biz tcp

Files

memory/924-54-0x0000000000230000-0x0000000000296000-memory.dmp

memory/924-59-0x0000000000230000-0x0000000000296000-memory.dmp

\Windows\System32\alg.exe

MD5 e829a798b794fa9d08fa7a4ba2b5ae87
SHA1 1cf5328a7987d46bb6fda9883dcf47dc77130cab
SHA256 cc1feeba17ac47f9abbf9917105fc0f397d82d4f4f4a0406c5b1940169505f52
SHA512 4dd7d397743ed4d79296b23b807395cb6096e5827f7c391cbfc286063c37960396ead477462d8c58cd9d55c7adbab3a3c02f24491615132d01ec1445d214ce2a

C:\Windows\System32\alg.exe

MD5 e829a798b794fa9d08fa7a4ba2b5ae87
SHA1 1cf5328a7987d46bb6fda9883dcf47dc77130cab
SHA256 cc1feeba17ac47f9abbf9917105fc0f397d82d4f4f4a0406c5b1940169505f52
SHA512 4dd7d397743ed4d79296b23b807395cb6096e5827f7c391cbfc286063c37960396ead477462d8c58cd9d55c7adbab3a3c02f24491615132d01ec1445d214ce2a

memory/1488-67-0x00000000008E0000-0x0000000000940000-memory.dmp

memory/1488-73-0x00000000008E0000-0x0000000000940000-memory.dmp

memory/924-76-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/1488-77-0x0000000100000000-0x00000001001FB000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 b954ba29bbaeddcd8d5e3390bafb1178
SHA1 b20850848c86dfcf851e531ea5d045689c8c5ccb
SHA256 41187b4c1f8d0530b9f1bb510c08eaa04eaef0d05d4c38d946a664bff79afb4d
SHA512 9a7b7810a6d1b21d4384817b570b1f8aa5300de302683ee5922318ae207a1612e75d73508fa48e5aacd27f8c8370a85198dd5f7862c219f43f957bc9331da8b5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 b954ba29bbaeddcd8d5e3390bafb1178
SHA1 b20850848c86dfcf851e531ea5d045689c8c5ccb
SHA256 41187b4c1f8d0530b9f1bb510c08eaa04eaef0d05d4c38d946a664bff79afb4d
SHA512 9a7b7810a6d1b21d4384817b570b1f8aa5300de302683ee5922318ae207a1612e75d73508fa48e5aacd27f8c8370a85198dd5f7862c219f43f957bc9331da8b5

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 0dd7fc7d7a4e42a1a3f1379c72dec91b
SHA1 28b634aec8f9df351c41e4c80b135bcde4c3d84c
SHA256 2aa6a0a7c8679174d4aa13efb1a90ec45615314cf1d723a1fb680668d8feaa37
SHA512 73fcc7e6d1a1b292bc3609385281380f599460d8dca8c5642933e981b455d3d1cb66043a979db400a2b5f7813a1b1b7915265dceb32fae590547a8ae0a062927

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 f4b66431758def3f2611da994a36e3af
SHA1 38344f7a596f6ef6da6c401d03273c8dea1296b2
SHA256 d1b5ffc1563b119e22e7152b7745fbdf813ebdb91323e52c612aeefd4b0bec36
SHA512 a25c865059dfb2a511c0ac2f3e7b0021addf55de2ed6d5db3d85a81fd4183bb717202df8f03f997da05891009cbefe49418fdb94e6f53537bb293484951ae798

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 f4b66431758def3f2611da994a36e3af
SHA1 38344f7a596f6ef6da6c401d03273c8dea1296b2
SHA256 d1b5ffc1563b119e22e7152b7745fbdf813ebdb91323e52c612aeefd4b0bec36
SHA512 a25c865059dfb2a511c0ac2f3e7b0021addf55de2ed6d5db3d85a81fd4183bb717202df8f03f997da05891009cbefe49418fdb94e6f53537bb293484951ae798

memory/1528-90-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 f4b66431758def3f2611da994a36e3af
SHA1 38344f7a596f6ef6da6c401d03273c8dea1296b2
SHA256 d1b5ffc1563b119e22e7152b7745fbdf813ebdb91323e52c612aeefd4b0bec36
SHA512 a25c865059dfb2a511c0ac2f3e7b0021addf55de2ed6d5db3d85a81fd4183bb717202df8f03f997da05891009cbefe49418fdb94e6f53537bb293484951ae798

memory/1316-95-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/748-96-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 0dd7fc7d7a4e42a1a3f1379c72dec91b
SHA1 28b634aec8f9df351c41e4c80b135bcde4c3d84c
SHA256 2aa6a0a7c8679174d4aa13efb1a90ec45615314cf1d723a1fb680668d8feaa37
SHA512 73fcc7e6d1a1b292bc3609385281380f599460d8dca8c5642933e981b455d3d1cb66043a979db400a2b5f7813a1b1b7915265dceb32fae590547a8ae0a062927

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 feb3b96d2a33f7644161dbcf8f54603b
SHA1 b6170f0e23f0b0ebcc6bbeeb5d9dabac5a4293ef
SHA256 10e8a5b806dfb59e7627962a17dd5380ed70abcc960b82d803731ca94cb74151
SHA512 fb6ca7d429b5ccfdbde64bb97a160a00c9838eff9f39a3d104bf7ce610cf3690af24b858b9b2dadfb5a8d2c6d973635416bcdd4096b9021701f5a9061a97c400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/948-102-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1412-104-0x00000000006E0000-0x0000000000746000-memory.dmp

memory/948-103-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/948-105-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/948-110-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/948-114-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1412-113-0x00000000006E0000-0x0000000000746000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 7fe4d9d0e7a5e5d8dddf009ee4e5c71d
SHA1 44aa5530830614b6a208baf2eee8f7ad9ca29570
SHA256 f41dbf369940ff747c532b281b89b1b7b84f046d37687a4371bab36507eb476a
SHA512 b1ef05b2e8b791ddb559528fd3dc99e931d48ca23390e89fb56d6e85e689f92ff9b8c56553257221b0dae887a07487c668487b7e59babe78d7deffada303bcd6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 2ea71f471bb91c904f29a6b6e051ec78
SHA1 084bf58d7ea254185a157539f772092e4e9965af
SHA256 52e4c44fdbc1752c73e6e25a2558fc294415f89d52645c1ac3acd2da9bbc6dc9
SHA512 dd371a488f0ed28a5e656fd208e176fd5b764b1271684940d8e82539f81664393d90783c499dc4f6c098b0c808f9e1c7d7f044fad2cd35146412f0502066de02

memory/1624-122-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/1412-128-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 28942fb38b2927bd161933b612fd1472
SHA1 f83003c3d8cb8988068ec03c2227798e6f6532c4
SHA256 95fdbe86be1474006f710b50f4a93c83dcb15f577536deb0d797c287e9affeee
SHA512 72b34a8d1bbce32c9721a6dc12be58d07e7099e6db8e08f5333821a77a38fb256673154bd062be2f6bfd8e0cf304c59b189d23d23a76fa4cb8630a9dc7ee1ddf

\Windows\System32\dllhost.exe

MD5 28942fb38b2927bd161933b612fd1472
SHA1 f83003c3d8cb8988068ec03c2227798e6f6532c4
SHA256 95fdbe86be1474006f710b50f4a93c83dcb15f577536deb0d797c287e9affeee
SHA512 72b34a8d1bbce32c9721a6dc12be58d07e7099e6db8e08f5333821a77a38fb256673154bd062be2f6bfd8e0cf304c59b189d23d23a76fa4cb8630a9dc7ee1ddf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 2ea71f471bb91c904f29a6b6e051ec78
SHA1 084bf58d7ea254185a157539f772092e4e9965af
SHA256 52e4c44fdbc1752c73e6e25a2558fc294415f89d52645c1ac3acd2da9bbc6dc9
SHA512 dd371a488f0ed28a5e656fd208e176fd5b764b1271684940d8e82539f81664393d90783c499dc4f6c098b0c808f9e1c7d7f044fad2cd35146412f0502066de02

\Windows\ehome\ehrecvr.exe

MD5 3aca6b19edf63d09926d7d1fb542acf6
SHA1 5943a895b0021c4dcf34b025426241fe123abde5
SHA256 e6da2b6e6d51a1e5fcba7f9bf9aeaf64df8fa69e549c7e51b0edf0fdaa567c3d
SHA512 6986d3d78ced0020878d15677e2e4fd688b7480a462fe92b67be0162ffc3fda79e76e46f8258763146599ca1451479e4d6194b3c13c617ba2b45466d9f320a87

C:\Windows\ehome\ehrecvr.exe

MD5 3aca6b19edf63d09926d7d1fb542acf6
SHA1 5943a895b0021c4dcf34b025426241fe123abde5
SHA256 e6da2b6e6d51a1e5fcba7f9bf9aeaf64df8fa69e549c7e51b0edf0fdaa567c3d
SHA512 6986d3d78ced0020878d15677e2e4fd688b7480a462fe92b67be0162ffc3fda79e76e46f8258763146599ca1451479e4d6194b3c13c617ba2b45466d9f320a87

memory/1296-135-0x0000000000270000-0x00000000002D0000-memory.dmp

memory/1296-141-0x0000000000270000-0x00000000002D0000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 297fc37dbe2b2963915f1119f3c931db
SHA1 c9cc2a613ba131a2b68387a0f2907f9e66c30fc8
SHA256 333692da46786e66069c6a6112bfc23cb4c0b8b3e4f126b7c2b3daa982820f9c
SHA512 57ed0d7177a02f1c550d649d2bcecdc09f52292335916a0babba316fa46a5ea9b73ea3ebc5b909f999150fd8256c57cd3a0d06ae7a1de43a3d4b439be9e3ce91

C:\Windows\ehome\ehsched.exe

MD5 297fc37dbe2b2963915f1119f3c931db
SHA1 c9cc2a613ba131a2b68387a0f2907f9e66c30fc8
SHA256 333692da46786e66069c6a6112bfc23cb4c0b8b3e4f126b7c2b3daa982820f9c
SHA512 57ed0d7177a02f1c550d649d2bcecdc09f52292335916a0babba316fa46a5ea9b73ea3ebc5b909f999150fd8256c57cd3a0d06ae7a1de43a3d4b439be9e3ce91

memory/1632-146-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/1296-147-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

memory/1732-148-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1296-151-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

memory/1296-150-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1632-154-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1632-157-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 77d0c117e8739d83710dd27f84a4d676
SHA1 c5f3dbf86fae3b6ed674cdb2ed654b12b991531f
SHA256 f9d822e0972a721c3a8ff1ae4f7968906e02733a069197b08f5d02541be6fde2
SHA512 b7ed98f98cb0134ffbd5e31c28dbab5abdb15725984cca88b1875a200131fa1aa86aa2d3da68c4680b1c2c8cc2a0ef8347563aea402bf4e1a5308e7d74caf044

memory/856-162-0x00000000008A0000-0x0000000000900000-memory.dmp

memory/856-168-0x00000000008A0000-0x0000000000900000-memory.dmp

memory/948-170-0x0000000004DC0000-0x0000000004E7C000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 b4ed5235df0c03454c243563fbf0ee4b
SHA1 f03e61e24b24dbefcf5dff482aab81180974192e
SHA256 f1e224f221e8cca4eb4afc948562a87fbed9d3e7f038fbcb1edf6b74fcf77b2d
SHA512 b0dd3752303414c979d75e6744c6726aa02ddaa7362e34f866dcf85449ad6e6282567297d31e01298cd1decdd79c55787e759d01f3e57695ffdef1a661c6307a

C:\Windows\System32\ieetwcollector.exe

MD5 b4ed5235df0c03454c243563fbf0ee4b
SHA1 f03e61e24b24dbefcf5dff482aab81180974192e
SHA256 f1e224f221e8cca4eb4afc948562a87fbed9d3e7f038fbcb1edf6b74fcf77b2d
SHA512 b0dd3752303414c979d75e6744c6726aa02ddaa7362e34f866dcf85449ad6e6282567297d31e01298cd1decdd79c55787e759d01f3e57695ffdef1a661c6307a

memory/1592-174-0x0000000000850000-0x00000000008B0000-memory.dmp

memory/1592-180-0x0000000000850000-0x00000000008B0000-memory.dmp

memory/1296-183-0x0000000001430000-0x0000000001431000-memory.dmp

memory/856-184-0x0000000140000000-0x0000000140237000-memory.dmp

memory/948-185-0x0000000004F10000-0x0000000004F50000-memory.dmp

memory/472-186-0x0000000000B70000-0x0000000000BF0000-memory.dmp

memory/1592-187-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 1ae73a0d3226eb780e7272aa62e74d0b
SHA1 1dd9b7b364a1aeba4f91595560f9d0bc28250b31
SHA256 82a3a569b6b691333b83255049f204af044ca1ce9cebcfed11856f6ee5229649
SHA512 6fe40f2f550119c77a47f1907748c3433215c6dca6d9eba50a64e986ba854d48cfbd858aaa65e83d98649493b3b53f7c90f7b6df2e43a751cd6f2ca27d7aa594

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b6a0ff8e32eb894b35fcbe6443fca89d
SHA1 c0978deea164c80839d97eb4724b00fb88c6f1d8
SHA256 af5f737eeae496dc527b1724536725a9dd00011d72748674716a3f6b06627955
SHA512 140eb158a6e4f0e3b6c5ba89cd9691c645ed14bce2dfb2e49d3d7358e4960fe18dc23861a4e8370ff996cd2118259fb6dfeca6c451d1b164c17f2f139339391a

C:\Windows\System32\msdtc.exe

MD5 44cf5e8177dce2709359ba8b584695dd
SHA1 24323f32f8d0b2296fdeba9204a7d46ad3648ee7
SHA256 81d6995d87e221387aac512d93ddeb0c6510fed16c2590c44fa8ae0293b50785
SHA512 91508c6fb3b140c02a7a609a8a98be5bc32bebb52d4dc9e45ec4442f1b7b57a17ed709d3d7ff4ce228aaf83bc30894e4fbd871161b7f3c198cf6d5eacd9ba033

\Windows\System32\msdtc.exe

MD5 44cf5e8177dce2709359ba8b584695dd
SHA1 24323f32f8d0b2296fdeba9204a7d46ad3648ee7
SHA256 81d6995d87e221387aac512d93ddeb0c6510fed16c2590c44fa8ae0293b50785
SHA512 91508c6fb3b140c02a7a609a8a98be5bc32bebb52d4dc9e45ec4442f1b7b57a17ed709d3d7ff4ce228aaf83bc30894e4fbd871161b7f3c198cf6d5eacd9ba033

memory/1112-221-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1448-226-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/472-227-0x0000000000B70000-0x0000000000BF0000-memory.dmp

memory/332-230-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2132-232-0x0000000140000000-0x000000014020D000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/332-243-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1112-247-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msiexec.exe

MD5 9e9a86f413702de436efe31e39e3aa23
SHA1 f38e7a3e094513187b33c5e49a9e46ebc969d14e
SHA256 4477bda594a11b450073bbdde8920d5d73c0754a1e91cee78fa56466fbaa9c31
SHA512 d6c27e0cb9e834439278778d306235010d12c4185494561846df1ee213cd9db54dc9ba1aac120ce9c3e9d8acfce865efc172998dd7bab6998e62efcfd4d4cfd7

C:\Windows\system32\msiexec.exe

MD5 9e9a86f413702de436efe31e39e3aa23
SHA1 f38e7a3e094513187b33c5e49a9e46ebc969d14e
SHA256 4477bda594a11b450073bbdde8920d5d73c0754a1e91cee78fa56466fbaa9c31
SHA512 d6c27e0cb9e834439278778d306235010d12c4185494561846df1ee213cd9db54dc9ba1aac120ce9c3e9d8acfce865efc172998dd7bab6998e62efcfd4d4cfd7

C:\Windows\System32\msiexec.exe

MD5 9e9a86f413702de436efe31e39e3aa23
SHA1 f38e7a3e094513187b33c5e49a9e46ebc969d14e
SHA256 4477bda594a11b450073bbdde8920d5d73c0754a1e91cee78fa56466fbaa9c31
SHA512 d6c27e0cb9e834439278778d306235010d12c4185494561846df1ee213cd9db54dc9ba1aac120ce9c3e9d8acfce865efc172998dd7bab6998e62efcfd4d4cfd7

memory/2332-252-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2212-253-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/472-256-0x0000000000B70000-0x0000000000BF0000-memory.dmp

\Windows\System32\msiexec.exe

MD5 9e9a86f413702de436efe31e39e3aa23
SHA1 f38e7a3e094513187b33c5e49a9e46ebc969d14e
SHA256 4477bda594a11b450073bbdde8920d5d73c0754a1e91cee78fa56466fbaa9c31
SHA512 d6c27e0cb9e834439278778d306235010d12c4185494561846df1ee213cd9db54dc9ba1aac120ce9c3e9d8acfce865efc172998dd7bab6998e62efcfd4d4cfd7

memory/2332-260-0x0000000000540000-0x0000000000749000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/2212-281-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 8f10b286707a7c03a96ec9a98912a7d2
SHA1 e015cf25b94748b5a0a41d3e8ab1ed264040d48b
SHA256 53a03a3ffd6f7e657894486c301d7322760192b0e68d7fd5303e48114b0d7589
SHA512 0ea1a7f1bdfa183999c834899590f509b52d1694339e03625ae965aca2c94e362c15bd97d28d65d8b013d2c83ef4f8fa42b5f966b4ad5e1420304c8ccec3f905

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 db3cd1c8a67aefdb9f06a52ba7365def
SHA1 574c2c80c4de3fcd84b4667ff817b7523c7b0319
SHA256 3e436e92253c4713d13c1eab83f45548bf2dc812048cf2ce8a313811e9061614
SHA512 629214cae8588659f9a3f678d9a14fdcf241078a24ce44789f6e366db1ee9c9df3eccf634482d853355c826c6a5a7b1643b4ec42042dd34ec18c8c709f22d832

memory/1488-287-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/2608-290-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2536-294-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2684-297-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 48a2f6e4d626ec3c9fe88bb107132d26
SHA1 32f74369ba5979c9df6c6b1e53386eace4a7b306
SHA256 61b8fc6a1851b9da217242417646eba7bfd72162e4978e1d8b39233d994a880a
SHA512 a4cb85f15767f11b5b3db439457801d6bc7572900dcb6a8f626a0d4ac3b50f8b54ac32573d5702d81c64d4fd962069d8e905c57b8b5a6583d91ccf417a01af40

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/2536-302-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\Locator.exe

MD5 7acdaa02b7e343a7365c2aa9b272ffb4
SHA1 6d3176caa4cbf4003acd77a282af49cb161e46ad
SHA256 a822b3b3e9ebd2e69668c1689d2c400dce7def1a01a7dce810f2ffd6d3ce5970
SHA512 901e6dc4fef541b1798eff3c4a2921b26de8b36ed7e35d00c96303fabb64473d2ceeabe125fe708c8a2ec7beffd7b6a3c6706b2754e6c64fdca658faca92578a

C:\Windows\System32\Locator.exe

MD5 7acdaa02b7e343a7365c2aa9b272ffb4
SHA1 6d3176caa4cbf4003acd77a282af49cb161e46ad
SHA256 a822b3b3e9ebd2e69668c1689d2c400dce7def1a01a7dce810f2ffd6d3ce5970
SHA512 901e6dc4fef541b1798eff3c4a2921b26de8b36ed7e35d00c96303fabb64473d2ceeabe125fe708c8a2ec7beffd7b6a3c6706b2754e6c64fdca658faca92578a

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/2884-326-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2804-329-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2980-331-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2784-333-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 53386b5c750ac4d3aa76fb4f8c9ad9ba
SHA1 5ade33477569680f61b807d781e16f9508450988
SHA256 2c3f66a2fc3f90031fd93285b6ae0bad124225e3a39b4e35d6621f995fa9aa83
SHA512 31d36bd547fb783feba3deffc4c0ec7e29fe5779fc7688dc0f53f4ff3baf3e75a9d6dfa11a6955586fff1f50a4c078124cf148fc0cecc38843fb0f1ea69ac018

C:\Windows\System32\snmptrap.exe

MD5 53386b5c750ac4d3aa76fb4f8c9ad9ba
SHA1 5ade33477569680f61b807d781e16f9508450988
SHA256 2c3f66a2fc3f90031fd93285b6ae0bad124225e3a39b4e35d6621f995fa9aa83
SHA512 31d36bd547fb783feba3deffc4c0ec7e29fe5779fc7688dc0f53f4ff3baf3e75a9d6dfa11a6955586fff1f50a4c078124cf148fc0cecc38843fb0f1ea69ac018

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/2980-351-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1632-352-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3044-353-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2156-354-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/1296-366-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2124-367-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/856-368-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2132-369-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2332-370-0x0000000100000000-0x0000000100209000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/2124-385-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2088-387-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/1632-394-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f74dc63f9aee5e3b747e8113326f3714
SHA1 ad3774ff22aff34461a9c8a372a6495deea9842c
SHA256 171367427c02048b692e9dae45c3e3b233a7a8eb29ecb5426d61b8d6ff80cf44
SHA512 62232c00d1185803f18aa6681e3091ba7ff0f0879d7c9692787ca7d29d75c1269ee5145170b129f6ac51f5f7b4a8c8e564c21ab3a95e9e32495c108e1b2ec60e

\Windows\System32\vds.exe

MD5 f74dc63f9aee5e3b747e8113326f3714
SHA1 ad3774ff22aff34461a9c8a372a6495deea9842c
SHA256 171367427c02048b692e9dae45c3e3b233a7a8eb29ecb5426d61b8d6ff80cf44
SHA512 62232c00d1185803f18aa6681e3091ba7ff0f0879d7c9692787ca7d29d75c1269ee5145170b129f6ac51f5f7b4a8c8e564c21ab3a95e9e32495c108e1b2ec60e

memory/2088-412-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2716-414-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2332-415-0x0000000000540000-0x0000000000749000-memory.dmp

memory/2620-416-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 9cf4c6b9fc7df0559e860dd4a8284a21
SHA1 e95f83907742bc85942818bc1096c3326c372213
SHA256 85748995ece414294f00ff66af65b7a96dd52093fbdf746c6d7436684c0da332
SHA512 a7cbce0b92d47800560704a06ca167496b905735ffbfb4843b347f6ce5a6e8637981fb7de114fe4d53e7c28d2630e7846f71527f2f69921438fa18d1dafc5f02

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/2848-437-0x0000000100000000-0x0000000100219000-memory.dmp

memory/3008-438-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2620-439-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\wbengine.exe

MD5 d5e1eed4012312f142c7f6e3eb0710f8
SHA1 d4398183f9adfa5a8ae3f2f7268458d86d9d701c
SHA256 cb53ab3eae78087d168fbbf368cf7884091cb1ca615d77853e821402c1ae5c34
SHA512 767488f9b5bb1b18e1ece343c40dbde8d659af1f47ff15b72a8fecc0142bdebaf72347aecd13f52526f05eb90243e27a972846f0462ff2905ace942288a7ffdc

C:\Windows\System32\wbengine.exe

MD5 d5e1eed4012312f142c7f6e3eb0710f8
SHA1 d4398183f9adfa5a8ae3f2f7268458d86d9d701c
SHA256 cb53ab3eae78087d168fbbf368cf7884091cb1ca615d77853e821402c1ae5c34
SHA512 767488f9b5bb1b18e1ece343c40dbde8d659af1f47ff15b72a8fecc0142bdebaf72347aecd13f52526f05eb90243e27a972846f0462ff2905ace942288a7ffdc

memory/2684-450-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2916-451-0x0000000100000000-0x0000000100202000-memory.dmp

memory/3044-452-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2156-453-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

memory/3008-464-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 507b403a21fe9a2a2dd2297ca965b66b
SHA1 6133fc47af2524053181239e59ec076bbbd084fe
SHA256 70a810d585cbdfaa2930e0161348bbb91a434bac4ebacd71b3a89607fa509520
SHA512 5d51c77a8efea399cc37c3a4ab25be3a5f02ebb5dc5d3a20354a5e8da1172c93bba36e06dd339445f956ba1f88a995d437221e5e098efaa384dcf25a77cc5a78

memory/1592-469-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2308-472-0x0000000100000000-0x000000010021B000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 507b403a21fe9a2a2dd2297ca965b66b
SHA1 6133fc47af2524053181239e59ec076bbbd084fe
SHA256 70a810d585cbdfaa2930e0161348bbb91a434bac4ebacd71b3a89607fa509520
SHA512 5d51c77a8efea399cc37c3a4ab25be3a5f02ebb5dc5d3a20354a5e8da1172c93bba36e06dd339445f956ba1f88a995d437221e5e098efaa384dcf25a77cc5a78

memory/2064-473-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 a1461a497f487223f5f0399c6f66b7f0
SHA1 e7ee5a7d4014623ef9292dd6591b81a5d69e42f3
SHA256 ef2d0b312a6d9d29c50ff5d0f140dd3c2635ea63debc6208501bd619396132ec
SHA512 db6ec53ad69f891c1bf1d4e77b21de309dd3d0e98748d917959a18b4ab7f5625501167c88bd7dad0b60dc323f179c1f56d0433fcf72cacc3b05f66b86eeee7f6

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 a1461a497f487223f5f0399c6f66b7f0
SHA1 e7ee5a7d4014623ef9292dd6591b81a5d69e42f3
SHA256 ef2d0b312a6d9d29c50ff5d0f140dd3c2635ea63debc6208501bd619396132ec
SHA512 db6ec53ad69f891c1bf1d4e77b21de309dd3d0e98748d917959a18b4ab7f5625501167c88bd7dad0b60dc323f179c1f56d0433fcf72cacc3b05f66b86eeee7f6

C:\Windows\System32\SearchIndexer.exe

MD5 cb80a699941fb6c01f0d4de6d22b564f
SHA1 bd79e923d5d8897cb5959f1ab2fccdf60d8ccedb
SHA256 114a0ba87b98e04436d399cbba30d5893a1be55a01b5de6ce05147d37407d872
SHA512 ab32b5194f7b12417f1d6d10d6e50c5bd9815a6094d2a18f71f570d37491acd3f6c97f921fd7c25e82a18e8ee975fb79136e895471008361b4607179d36a8230

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 a1461a497f487223f5f0399c6f66b7f0
SHA1 e7ee5a7d4014623ef9292dd6591b81a5d69e42f3
SHA256 ef2d0b312a6d9d29c50ff5d0f140dd3c2635ea63debc6208501bd619396132ec
SHA512 db6ec53ad69f891c1bf1d4e77b21de309dd3d0e98748d917959a18b4ab7f5625501167c88bd7dad0b60dc323f179c1f56d0433fcf72cacc3b05f66b86eeee7f6

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 799d113a8c86b6cbace6bcf31b44ae92
SHA1 3b65338cc2472593acd647d19a010ce29d08f31d
SHA256 fceef6857cf96621c3bde221105dc8693f33282826248d0af03be72cf4fb7624
SHA512 1aa44b19466184ee8ded91698da2bdf99d9b55b217a7b56f63e48af96e0aa932bdeaf90ec686151b312bc8def771015820d533e2bfd18a9b45d4dea4d8e6e3b9

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1575453f2fa2b326a378540d9c7042fd
SHA1 6d480fe8ba71e2ec0eb8f46a2fbca119f29efbfa
SHA256 d1695f222840e313cca2267b1de58997d47d4ce28cb316c4164d712fab1a88e6
SHA512 34c1e88e623042df27e1814157ae19374472d892d62e916f5052057caa5b77b6891f8e9d4a2f517b52f4b7045338e516bec4476d7d7990b78b1b9f0a60d36557

C:\Windows\system32\fxssvc.exe

MD5 5e3ba1a514e99d98f7e8afa6bf9e1e93
SHA1 23d24952a1eb3595661593fca4fb211660cbe4c2
SHA256 47536cfb675163aa0e03c53e7fc65de81f0b42942e72e552b417c3a99926b025
SHA512 c442adf479036962a4a0755018f9ac1fae5d16dd83026f8ddbe729c6b756d093ccfae0a7288f2a64dc7a7cee5176aaff6a5e9e382414eb5db736bbc9bd9f3700

C:\Windows\ehome\ehsched.exe

MD5 297fc37dbe2b2963915f1119f3c931db
SHA1 c9cc2a613ba131a2b68387a0f2907f9e66c30fc8
SHA256 333692da46786e66069c6a6112bfc23cb4c0b8b3e4f126b7c2b3daa982820f9c
SHA512 57ed0d7177a02f1c550d649d2bcecdc09f52292335916a0babba316fa46a5ea9b73ea3ebc5b909f999150fd8256c57cd3a0d06ae7a1de43a3d4b439be9e3ce91

C:\Windows\ehome\ehRecvr.exe

MD5 3aca6b19edf63d09926d7d1fb542acf6
SHA1 5943a895b0021c4dcf34b025426241fe123abde5
SHA256 e6da2b6e6d51a1e5fcba7f9bf9aeaf64df8fa69e549c7e51b0edf0fdaa567c3d
SHA512 6986d3d78ced0020878d15677e2e4fd688b7480a462fe92b67be0162ffc3fda79e76e46f8258763146599ca1451479e4d6194b3c13c617ba2b45466d9f320a87

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-24 07:59

Reported

2023-04-24 08:01

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\398dfd28c94b1c77.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3760 set thread context of 2536 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082433e799376d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007feb62789376d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b747d7d9376d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022099d779376d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064deb4779376d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3760 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3692 wrote to memory of 2196 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3692 wrote to memory of 2196 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3692 wrote to memory of 4864 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3692 wrote to memory of 4864 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 70.32.1.32:80 uhxqin.biz tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 70.32.1.32:80 uhxqin.biz tcp
US 8.8.8.8:53 32.1.32.70.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 170.178.168.203:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 203.168.178.170.in-addr.arpa udp
US 170.178.168.203:80 anpmnmxo.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 70.32.1.32:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 70.32.1.32:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 170.178.168.203:80 anpmnmxo.biz tcp
US 8.8.8.8:53 api.telegram.org udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 170.178.168.203:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
NL 149.154.167.220:443 api.telegram.org tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
IE 13.69.239.74:443 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
NL 8.238.178.126:80 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 vcddkls.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 myups.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 165.160.15.20:80 myups.biz tcp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 8.8.8.8:53 myups.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 76.74.6.107.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 61.13.50.169.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 199.21.76.77:80 gnqgo.biz tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 173.231.184.124:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 72.5.161.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 199.21.76.77:80 gnqgo.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
DE 169.50.13.61:80 lejtdj.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 173.231.184.124:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 72.5.161.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
DE 169.50.13.61:80 lejtdj.biz tcp
DE 169.50.13.61:80 lejtdj.biz tcp

Files

memory/3760-133-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/3760-134-0x0000000000910000-0x0000000000976000-memory.dmp

memory/3760-139-0x0000000000910000-0x0000000000976000-memory.dmp

C:\Windows\System32\alg.exe

MD5 ee7c940a8bde8bd97e622f37bc051457
SHA1 954d57c288c69a98872c7d9bd1e68ded6b599c85
SHA256 d5da7ed8e61538714be6ef7d0e7c7df0fcada4aa085fdebc7a5631571bc815bf
SHA512 a37580f355efd0cae7d57fedcd1c22605290d9ea59dbacfd72ab82353d5630c49f6224b4449022f0aa4e166d97c8972195980366615c649dba13bc3db1ba4fca

memory/2324-147-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2324-146-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/2324-153-0x0000000000670000-0x00000000006D0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 0cb2b9f6a1e5ea923ff8bbe539f29a7d
SHA1 29580d82bdd7e9366be11e6bf1d28a052b912a8d
SHA256 7a75c8b328f9d33983e1e4b6ef6d4eee52f8f53e11baa48ed2d567f8211b00e8
SHA512 39c93fbbcfa878838d21fd9926998210a562a96595c2e9d5efb50817b0d87cf1a314f35fa8d3c20698e10d2bda78975117a7f9d06ccb491fb365ee77081d958e

memory/4220-159-0x0000000000650000-0x00000000006B0000-memory.dmp

memory/4220-165-0x0000000000650000-0x00000000006B0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 ad76d39dd3213d75bb29ed69a164fe54
SHA1 246d33db448aa229ff5ff86ec85a7fe7bd664c5e
SHA256 cee79a0f015c3d377040a9ed3fd03fdba8c38a470db32814354518b752772d3e
SHA512 a2ad98e96081792cdf28bfc626d1799563f09bd2d288b60ac96c5d2fe82bff373e9f9acdc813e63df6f98f41e7fcad5f7a45f6f5c64d26b8ba1ffd575999b7bb

memory/2300-169-0x00000000009C0000-0x0000000000A20000-memory.dmp

memory/4220-176-0x0000000140000000-0x0000000140200000-memory.dmp

memory/2300-178-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2300-177-0x00000000009C0000-0x0000000000A20000-memory.dmp

memory/2536-175-0x0000000000F00000-0x0000000000F66000-memory.dmp

memory/2300-180-0x00000000009C0000-0x0000000000A20000-memory.dmp

memory/2300-183-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 f9b8783ffa654a1cc5c5c9e2da21dbe4
SHA1 38d890e52f6570dc27b30fb9fbb60a88355d6e0f
SHA256 3fd717373e5591e78fb95e8d7b3ec0688f727a5082556ba44263d7dfd2fb2ee5
SHA512 c56c3df3d6740b7a2552c1275d0a7beafb0c9466c527870e044b6b1fffd5219556d9575a59c906af40955baeb95b841fc4d36459d33241703847dceb94fd520a

memory/4892-185-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/4892-192-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/2536-191-0x0000000005570000-0x000000000560C000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 fe209123402d25868a19e91905e278a0
SHA1 d6f54c81e16921bea9958c07851d3789e2412e08
SHA256 1dabf3a0462e0223000135065c092ecb20c07837f462be1c632f39e1d8f97bb7
SHA512 9ff3747f510d6a40d5236e23c86541fbde94f52994a4908a4241b44630af8504ad0879c69a82763a054d32aa8bc21cdb1f09876e5dc3d397d31cb0e1819b95e5

memory/4552-197-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4892-199-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4552-201-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4552-205-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 33c3aedc38db6778b0a1a0df6ca211d6
SHA1 d319d7d351079e0ee8315256d25d53e0e2b329c8
SHA256 f20884f838b37e714b72c429b3a3d6f2bbf413fbe38f4f02c8261541caac5560
SHA512 c8d4c0a3e4c6e4ee86bdd9a86853d5d0a05084934b8b3aa638efefe7c1e31561dfd5e6b66141745df0592d6038c67c537b54539ecde64a35babf4896889fcb50

memory/4268-209-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4268-215-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4268-218-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4268-221-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 e0250aa03884eee1c83b24d4cc9284c1
SHA1 e72489737cca325b28c78285f67791776d8527fe
SHA256 3cc313bfc9a675a308a8be0620ad38d8bc6092f605a966a1e2ef5ef44b219717
SHA512 230db9bc891fcdfff7400c3e796645dadf777547e6ea87ce83c4746fa634b189c7b991220fe66c0e45eb6efba8e2034fe3658f82d5d7995dc2aea8779debcf5e

memory/2952-223-0x0000000140000000-0x0000000140210000-memory.dmp

memory/2952-224-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 20f5771a7ab4637c29f79c6c3447c3e2
SHA1 6ce79d8f6d30da9187dc7e2899752369dd7266e6
SHA256 5a80943264269c8c6248f1966fc0f07b8dfd129c93baa3e15e718133ed82bee7
SHA512 bee1b7da4deef771a77adabdc3db9c91489ccb2899f1a5b27f44f1448e0f698bfbd65737c7f700565a91c3591a4207811811db906effc86b7ca622d89afc1809

memory/2656-247-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 c41a0f80a93139d4c860fbb756ec8629
SHA1 ef1a065c32329008598a56be029826ec59ec2f10
SHA256 4e889fb252b201ec6ebd0ce9fe94443148d9b167b0abf5c169a07337e241e437
SHA512 5ceb7c36029dedfe9b50d06b1ca876187de4ac327ab0d4dfc2ca86b03e1be09f2985ea25129d8a95ada89a0ade4f06672ebe71f811ac5b4d9808624998fda6c1

C:\Windows\SysWOW64\perfhost.exe

MD5 61f8e263344a1c6f71eaea2f7089b0d7
SHA1 55bdcdc5a4ea3383b094c13c822422744290f97f
SHA256 19d3249d8e47bfdff230b06ba32e52e4e8a2cc6a8afd9113b2a6315b8f8b867e
SHA512 8df3f9c1ccd692f89be9c049bf19397442c9efd1c3c7531a3d11319a5a30610ffc18e47f25f1359b2d13b2c5ffb0a670742475274c761b4f26715e42901041d1

C:\Windows\System32\Locator.exe

MD5 4e95305cc6d1201dbc3649ba8af8fdb0
SHA1 2af357fc276bd4a7af73cf1ff0246caa4ef85be1
SHA256 91e4b186664bc0c80edb91cc5ad53cab8f93b8bdab91c21ced40fb0717e882ad
SHA512 63a217499dc712b9318b55e1fc9fba97a36c13b668055f96a015c12aff9906ad837e73126f143d39f72aeafc34dbb2e4b6fd05cf5b3afa34312bbcaa7f310016

C:\Windows\System32\SensorDataService.exe

MD5 2f68476385d6a7063d7f9165f6b555b1
SHA1 e6a51e968c7825e987cf77ed891950704e593593
SHA256 95377b8ac6e2143b498e9e12c872274360f776a6eb3bfcc8499703f02d4f7b4c
SHA512 1a3bf3e89efdbecb3976e70387a162a22cd084cc675365a5114171673525403d2611bba3bf16f53eeb0eaaec28e6161966dd2efd72c0186af43c591bc2f8c215

memory/3360-280-0x0000000140000000-0x0000000140202000-memory.dmp

memory/1076-283-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/1900-286-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 bc57c23ef597e38e4bbae22ca5f85740
SHA1 4d645ef0ffd31e168903340abad502fa42a3d324
SHA256 6b6a5f0e4a1dcf3b05dd59ce8221a112170f4d62c0552e06c3bdb551c744afc0
SHA512 0f3a6d46a829aecc91df602b84dbcc195f7202f43ed4248d60d71568b440985e0b14d2773758f576c439a2746b9d18626e7cc73e1018eadef32df9724981afab

C:\Windows\System32\Spectrum.exe

MD5 5ca271087404514a7256b51cdf59260d
SHA1 e25cfd93516c36957aeb39fd218414331f362cf2
SHA256 7724ea97d5b9205f3085f595b6c5835f6f18adc2f6b4b1b82910ba926ceaba82
SHA512 70c4f60447c549bd161a7845fc3f9cf5da1ef6f538669a269c57419fc2d9cd8a07b7a2a3b07ef4acd40f1aa0a8f2eb02a256c1eec9b7eef135567d1be6016d6f

memory/1544-310-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5012-311-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1424-313-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 c14f658115f5e6192468e9c796b15522
SHA1 4f8c94c58166d75faf0b152701db5cfcee0cddba
SHA256 60b1602968b2954b4ab7ef8cc0e4ccbada2c2e02823f30d7605873e767bd2536
SHA512 3a55ac4fc931d420cf4c053dc99b70613e51e4e626c35e9423cc0361f72d368966d5204daee457413a294e5de40503624363cbbd80c6c941f87ce8bb620472cd

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 c14f658115f5e6192468e9c796b15522
SHA1 4f8c94c58166d75faf0b152701db5cfcee0cddba
SHA256 60b1602968b2954b4ab7ef8cc0e4ccbada2c2e02823f30d7605873e767bd2536
SHA512 3a55ac4fc931d420cf4c053dc99b70613e51e4e626c35e9423cc0361f72d368966d5204daee457413a294e5de40503624363cbbd80c6c941f87ce8bb620472cd

C:\Windows\System32\TieringEngineService.exe

MD5 bed89c331b9d628201dbab6bdc5b6a46
SHA1 dc8f2767b4bf884ec664ada9348f7d282697dd0b
SHA256 c3a1815f72dbd770afd8e0b63d0ead2bfa0ea41c2d10bba2b2a4e46b302be932
SHA512 1e0dffd72af64b739d6cdeb4803e92f4134aeacecde7c5eeef96b1ad58bbc1b65c710a990f42a8b9cf44365cf99b21df88bae8e14e1d9229fd1a939facb12929

memory/4060-335-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 4f5764f28e54bbc1c4942bbc4bd535d6
SHA1 a623c9e0ff16daff116cc6f2f227745bf67f0086
SHA256 2152fb7d5675f47c71a5951008f7e1441245d51a3f56a4625011b3e9db05a145
SHA512 054bc77b5c301059528a922eb0f23dd655f5e74cd720dd55229130822f6567149d69d5c2d1ad62591f0c3ed56f3c666fabc4fe7bb51591f916ae086d9f830896

memory/3400-337-0x0000000140000000-0x0000000140239000-memory.dmp

memory/3624-349-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 c6b0400316b1daed3dd273beafea9fa1
SHA1 6919f5e6ee69591edb612b34d959b7e544ae1e3d
SHA256 f157e2aa713e33d361125246466e8f7033b66013fb7ab33a6d734d5fa0e488e9
SHA512 be7e7e12018c2e25fc083c5a940344eb9c770205fc4f60e5b064a553de23e7e54372bbe648a8e4532a167b56debf232098e087062ea171479f876c7204e97a99

memory/1028-360-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 c022d282bb542f3d6ccb93b4381c80d1
SHA1 06230b545b4c269d32dc55a9f2b5266457354506
SHA256 077fd97c1bb91dae5795387bc33dd9b8288a3a6c042a03d0b7ae49a8b841b41c
SHA512 800e58ad70ec6cd29198873f02ed575c8464af39c323a08cf59697065edb61cb7f1071a7e28d6b7e25f2bce8eadfca9aff72293dc1beb5257acb12a8cff50b2b

C:\Windows\System32\wbengine.exe

MD5 b842c2250bae5977cf7b2fd8bc949b5b
SHA1 381ed08c79d007b5e2283bbbe1d1cf53ba56ef20
SHA256 c5edac1e6e9aafbded854149927b90561f4883e4f3893160c12bdfe3b3bbea48
SHA512 87a7a625035784412dd7beedf795c44f0ba8e7f3189f824a503a6c0b731444b52b19dd3580676108b56791616dea177fc3cc9287d3e98d09c5958087311bd01d

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 dce056dddb913cd6b704ba61f369ca8e
SHA1 199d35909a175815cbaa25c173b3f0bd703912bf
SHA256 a2c83eea7800ce236e0086ade60b8adfbc3682bd2726bc3227d666e6b340027e
SHA512 3a0d16ae31e064cd9b54be93fcba5891d34ff2d430c21ec1c6ca74d63259a6b44f4c234740d86395bb52bfdabb6f07d63339755d397f77128758326e86119759

memory/2324-383-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2748-384-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3184-386-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4516-388-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 c3444fb2a67ac03f60f9995e923d8343
SHA1 1f356f6769ceff6af29cc851dc9af9d6c5573def
SHA256 9ef1720c0a573c0c9dc801c7f799538b9d01b3f080b2bb3ad07ddd6d23a7b721
SHA512 4a3bd6f3da1912dfbe7596ad1a2a365d80ae858602c9f4b93989a65ab5712016fa821474324dc27a08d3d196439540a8e2df11cc11f9a04177468ddcca98c045

memory/3692-406-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4892-514-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4552-516-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2952-538-0x0000000140000000-0x0000000140210000-memory.dmp

memory/1544-554-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1424-576-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1028-593-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4516-600-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4864-602-0x000001EC0EEA0000-0x000001EC0EEB0000-memory.dmp

memory/3692-657-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4864-658-0x000001EC118B0000-0x000001EC118B1000-memory.dmp

memory/4864-659-0x000001EC118D0000-0x000001EC118EA000-memory.dmp

memory/4864-660-0x000001EC118D0000-0x000001EC118EA000-memory.dmp

memory/4864-661-0x000001EC11A20000-0x000001EC11A30000-memory.dmp

memory/4864-662-0x000001EC11A20000-0x000001EC11A30000-memory.dmp

memory/4864-663-0x000001EC11A20000-0x000001EC11A30000-memory.dmp

memory/4864-664-0x000001EC11A20000-0x000001EC11A30000-memory.dmp

memory/4864-694-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-695-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-712-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-713-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-714-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-717-0x000001EC118B0000-0x000001EC118B1000-memory.dmp

memory/4864-718-0x000001EC118D0000-0x000001EC118EA000-memory.dmp

memory/4864-719-0x000001EC118D0000-0x000001EC118EA000-memory.dmp

memory/4864-720-0x000001EC11A20000-0x000001EC11A30000-memory.dmp

memory/4864-723-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-724-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-725-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-726-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-727-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-728-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/4864-729-0x000001EC136C0000-0x000001EC136D0000-memory.dmp

memory/3760-744-0x0000000000400000-0x00000000005A8000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 8508abe2197d8313277c0af3b0f7c04c
SHA1 3d8c709ea5195456c2709fcc5176bc8593a9b0c0
SHA256 13d3a32bf0a631f62966dba4d7cb1fe15749ecf44354779e4c1deb205a0c4d00
SHA512 3da165fa65ba894c18e6353834b5a90bd91bd0108be77279929438b423e8d5c531c09efba91a50d20dc807e269cbad7e126ce8edd09cc4daaffaf519931b742e

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 33c3aedc38db6778b0a1a0df6ca211d6
SHA1 d319d7d351079e0ee8315256d25d53e0e2b329c8
SHA256 f20884f838b37e714b72c429b3a3d6f2bbf413fbe38f4f02c8261541caac5560
SHA512 c8d4c0a3e4c6e4ee86bdd9a86853d5d0a05084934b8b3aa638efefe7c1e31561dfd5e6b66141745df0592d6038c67c537b54539ecde64a35babf4896889fcb50

C:\Windows\system32\fxssvc.exe

MD5 ad76d39dd3213d75bb29ed69a164fe54
SHA1 246d33db448aa229ff5ff86ec85a7fe7bd664c5e
SHA256 cee79a0f015c3d377040a9ed3fd03fdba8c38a470db32814354518b752772d3e
SHA512 a2ad98e96081792cdf28bfc626d1799563f09bd2d288b60ac96c5d2fe82bff373e9f9acdc813e63df6f98f41e7fcad5f7a45f6f5c64d26b8ba1ffd575999b7bb

C:\Windows\system32\msiexec.exe

MD5 5888be677db456e0bf48c706a46e3d21
SHA1 78d9b2e34b43d37dce361455c79dcbec415d2aa4
SHA256 d6bd2ad49c3c58993b2460922f984f2aa40d22fa7706dc4e2062d3e30bc2986e
SHA512 910bbaa74eda3e2dbd47d9a18a46b3508e96ba678e2c93994432c964b89537e863b4ded1633a2e6c4c03d09e4c6da8cf571b375cf948d191feb1618213453924

C:\Windows\System32\SensorDataService.exe

MD5 2f68476385d6a7063d7f9165f6b555b1
SHA1 e6a51e968c7825e987cf77ed891950704e593593
SHA256 95377b8ac6e2143b498e9e12c872274360f776a6eb3bfcc8499703f02d4f7b4c
SHA512 1a3bf3e89efdbecb3976e70387a162a22cd084cc675365a5114171673525403d2611bba3bf16f53eeb0eaaec28e6161966dd2efd72c0186af43c591bc2f8c215

C:\Windows\system32\AgentService.exe

MD5 4f5764f28e54bbc1c4942bbc4bd535d6
SHA1 a623c9e0ff16daff116cc6f2f227745bf67f0086
SHA256 2152fb7d5675f47c71a5951008f7e1441245d51a3f56a4625011b3e9db05a145
SHA512 054bc77b5c301059528a922eb0f23dd655f5e74cd720dd55229130822f6567149d69d5c2d1ad62591f0c3ed56f3c666fabc4fe7bb51591f916ae086d9f830896

C:\Windows\system32\SgrmBroker.exe

MD5 c8bb7218d92b2c0c1b36b5ad4b04b09f
SHA1 3f53558de5b81e6f1afd2df8807f9ec23521a277
SHA256 6d11f610a54cc0fa7b2b893ca14ef0369d51af2fa4c947c131e90cb452d38775
SHA512 86c31d8c750b5a0c1c0c29d71230164534de5bebaea22c6f2e8877342d2ee0d90fc7477304b585546a0d65a2a94bfa6a44fe25fbdefcc97f8f8bb34d412f9910

C:\Program Files\7-Zip\7zG.exe

MD5 fd4cd18b494da5d2528b694547631c18
SHA1 4ebc53b39e273a5bbec2bc9d38283fdf265be2ef
SHA256 66923872cdb60e59b1db02da4b0a2ecdaad25a2dfa7014d11059b9974b0c6f81
SHA512 9610c4bed16fee8f50c675d661ff287c41f5f23c1ec137dd418e71f2ecea10c261cb280716c3915344b15c463c806a7c3b61393f4082ec441c4953d556a1f74f

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 d53472f9d9b483e83a9bc35fee174fa8
SHA1 fe5cef5fb355cd55a15425b7635297da4e2be3de
SHA256 e332e930bdc2bd330e8d33ac97e836e271bf0bf87ed50542c503acc9c720545c
SHA512 4a50f30cb7fe1685b6b731244623a6db881b286236c54e098a15453f5e21ad3cbb19b9f17143e4e026898c7ae52a6bf8db70c1c0771ec637db7096aca2c33a4b

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 1954a06bc62e1031dc2f51fc516f89aa
SHA1 2ffbe768c6b9654a479e80a1d7100c76f68d2580
SHA256 122ac7d732b2563d6a956a14abd1a481285ad4d7d82aa48ba33f59ddefbf8650
SHA512 48862cae05e3e14a719e247b2b52b469baad03e2bd038813fe29e977d24682aad04c7fea0d0b96f81c69ef4f1bcc7f78b22dbc763fb3bdb3564831ee7b75b64b

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 022da470d3a121271454111a71f3bf5a
SHA1 54aafdfd3012f1465bdb3f5936cad7099c1239fe
SHA256 4c09ad14e2e9faa854e7bf7a35cc0f2b8822a7d70116b83c4077a4e7de41ab99
SHA512 58a45abaef419efc213540e50eaad59f83dc19e53fc103b1caa1e0cca7b7a659523e3a36db10b2fe57b69fef86c4c5b5c1fee337af56a608094995078f85d20d

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 c2477190b8bb13bae68ed639d7f6f191
SHA1 2c4a048837ac21ff4bb751448bd7a29382da5856
SHA256 8be7da5b1b539886c26749eb6f159fdd17014bd5f496be798b721627570261c3
SHA512 ec834e1ac5158f10b1271832b5b773cdc13849bf75c19c33bcf9a21dc4f2346af30462e33b88c1280d2f4a65cd8b8c1e505b7855f5d5159381aada4b558e61cc

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 1159e7a4b78535a3620e27b35dbbbb9c
SHA1 045649db41b1b17ca323355b1a71a20e6e7220f6
SHA256 1cebfaec4b663c472765d0ba7f18939546b97177ebe72ca7520f273de7a676fc
SHA512 542b2a1347624df0069f5c9dbe75fdfa53ac1fab85538adb9169cb7a85132408bc1c261a6aa6823219640af3316e4f646404eefc645f7e07b8ce73f15ae66daa

C:\Program Files\7-Zip\Uninstall.exe

MD5 4fff2cfd9c728ded9fcd0333884df4db
SHA1 6543af80f48ca778c0ec336694b96651fc523b38
SHA256 c6d10f41761b26e31e3737e57598580ae7d1cf1b9dd59fcae5f8936331d5389c
SHA512 cffad8bef08f01746099c95af16b5b30d6f70c72feff09eb9d04e41cc6daa296e58885379b39c45b69751073b4db48f0ad190ae65925658f2acda160e986125c

C:\Program Files\7-Zip\7zFM.exe

MD5 07339451e28f81ebaf3f1ba2f31d1f6f
SHA1 07292bb51298a5e648dc2ad0384505df77a18dfa
SHA256 b89a1d8f311b36746dde87aef3c547d11bd413b6ee880c612c7ba9c789590403
SHA512 368b3241f66cae23c05caf246fa78fbe6eb72e253038653424815d46bd6ce1c5309d87cbeb3ff0e8c612d9bafad390cd6677462430ec51278b2bd2a59a5a69cd

C:\Program Files\7-Zip\7z.exe

MD5 149ebdbba71bc85b8642ba7bae3a56bf
SHA1 e47f0587469aeadf23d127bc75352c8e203507bb
SHA256 354733fd18c97e584be309d92f2ac784b59e4d7d9b20fcdc02e499e11f9b14df
SHA512 2f5fc9462b17378b714f5bd415c365f1a31d1fb8e338fb36e3fb6298b9dbce69c07100b73537fc4638434af9a402ea48c76d92b9b79d2c64e858e814846f595d

C:\odt\office2016setup.exe

MD5 0ba912c7c490e50021190ca744fda6b7
SHA1 ac582c7a106cdd0a902d74d0d9b471fc4fca7268
SHA256 d1fc5639b53b6a735f08e4b178c130db11fcfefa8fcd73e3cf0e53684727dad7
SHA512 bd262f32d19e9990074bf47b344373cd2cbe968e576b36e8ecad3022f8b4c6ea728380b5b1c59f35fb1fdf109f3b2ddedf7597f2bb0ec6b0bb180bf66fe98446

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 2238c217ca6cb4a0964c2420df3aaff6
SHA1 5d45d0976d4bde2d1977fcf0d8976d0970f3d755
SHA256 28579f63668b3a5ed64a5e8c24e0340a7094e0f44d6faf09543d6dee9d5a74d6
SHA512 48f331cb5972e92b72f92a8a9df88a693f44db899d11d8d719c2377ee202f4a9296537e4b06809a38afddf470615a8694bfa015c2660a1748ae1994c32e623a3

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 89309b0a99db5a8babd2b07f9f76c2ab
SHA1 844b0a6c0ea60a0bfd4f88379a1fb5e0de83796d
SHA256 94b5536b6771c6ff91f52e3d1fe98291b70a9d39618328796a2fc44b7a47a099
SHA512 dca8564392dae82f3f50e387a50fca59b0c6bdf0f8c2bc8648bf4d0fc57fffaa79a1786f077337b862346d43318b64e07fc4bbd3d6967823aac787b75879e364

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 d41a5c57192150a7e7d1e4d4dd63afb0
SHA1 19ca76dc911bae638b697d044ff99f7aeb57ea73
SHA256 3741758b8587df3efa3314a174268f08a0325afcb60bd84061be581d7c3dc2f5
SHA512 2b9d85b1dd9ce14636b0334475b3fed3f7fdceb3f5eb455e7b5d67898d5b0015dec2d48a9860262b24e3f0e48c50af17956992ce94ff9367c685681f905ebd35

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 0f775cfa8ead294496fd48813d6ed765
SHA1 ed6283eada0ab9f15c682f6c266cc6132f399239
SHA256 6b81ef678a38b6661869c8ca3a444a0a4441803838cbbd0bbaa1ec6cb7e72ba1
SHA512 de84ae4ad46696d308b1470fe91c183c645bc34fd5410e1d88cbd06915b04ddccf63a357a73fda0f7e039f70fec83927b8223cf705b5eead4e3c17ac38a47818

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 97a88edef8572dd4276686e129dcf200
SHA1 025c3bca857dca3fc4edb913f97e47ede53050b0
SHA256 a2468460dd91151cd13c987b6e4786b8b792e3b2cfeaea74fe888da6176dcffb
SHA512 8d1bc4e30477c5dbdec5f1d8daad74f0aff5efa331b67eddaba3a60c787ab8b9c4c0cb3d42dcca20dd80a256d007a240c589937527939b559023e612b9781e3f

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 1100fb9a31e7513d9afd8eb2c98517d6
SHA1 a59c1a16ed24068dda30ab7ce0a694d9efafcd83
SHA256 4fc806a35ba55dea39dbe063cf3b3fc7a53518392ceea62f32cac919205a3526
SHA512 41906349ed612d8d0a9c99a2035d6cc6d3401cefce3eedf84fdafa4412d57d8c6607168bb44f7688bbff563428f87ac17a2b4fb0daff18b5b071d2607f55b8b4

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 842ec7128a8ffb7cddf13571c10f1e08
SHA1 372c36152e3c7c77df1e0c9515db83ff5bcbd26b
SHA256 953499fc3ef1dd2a6e172d152a36151413e3906a9f8ca292ea484c7093780779
SHA512 d41bac6a1fabf2b629d8638def26c2613a9f70ed538c60d2928e15d9c1b904abffa43aab62a36a659cecce75f974376bb311e6ae8394a3734350b1abfc986625

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 2e293aae3f920a17cf24d545cbe0e550
SHA1 7c349b6d9db3117f6c335d1e7796d2ba17e698b2
SHA256 d7fd6f2ad174649364586ee8e5dce27d8e69bba40ef7d002651f7e40517d37bf
SHA512 8108d40c3442ba1d898303150740845239f1fdcff9148aa9dcb2eb3ac93b5c35c95f041e51a1382d3a4547c9879fb3123e639c0a5a54f09399e6928aa8cc7a58

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 e5365dcb84253b5c2dedac3eb6a5f802
SHA1 18f96480db5cd539ca9a45eb506a111976979d0e
SHA256 1b086c68949a786e2844e36ffa18d60bb75537dcd54392b41e2c1ad1c4fbc936
SHA512 6e36a4e9fb7602ab6d0b93a165d483c4bcc23ae5672a695386586e228406335b84c55cabb4d5e8218748a9548e719458e6737927789abb5237df9ccbca6bb25b

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 5ba216dcd3b6bf384dc6e4111c116395
SHA1 b697efc9a7fa16837a558307815931d72465b883
SHA256 acdbcbd5542fc17d33f753c7fe4b7705d40ee39069860e98855e73683d745960
SHA512 849886fe765f341f425cf348593e48141818ecb63a55842e50ac5685a88bfbcc47c87c8e90940a6432a8e226f66fd72e039852ebb74dce5e4ddb8b2bf4118a5d

C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

MD5 1064d2ecd34b5ddae4a4609b1f1e8eca
SHA1 9d135a83d8a38fc9fa4cc7fb6686e70f44bd8e0c
SHA256 8424270260b8eb75dc2b50a9c3bb95d6c9a997c8659c8df5bba77a50bb7dba90
SHA512 b3bc5482ad9beba611f492c676e055b1b857a62292b73745540563a52718bda0a674b1395b8bad48bc77da9dc1a5d1893cc6db6fed47a64b4623d9e55730503c

C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

MD5 1433020651fdbd71497d33877ffd2c26
SHA1 19811418f12776544943d2f512cdccd39276c72a
SHA256 6b04103334a7438acaf91a7923a4d4355fb0e743c0e07ad09293cf5be1faeb5a
SHA512 10e24241045394542db5a8c6b3a690060e8fcde991d81aec338bf8f63b8a1d6f4487f23e7131bc66e4c7fae78adc678d8642f17482d5c367ff9846ca997683eb

C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

MD5 586615f2b275314c41c4182b9067c4c9
SHA1 f75f4234ce2bd54313b0d356f6ed2fff8a6a2b51
SHA256 cbc5bb4f22dd88e827432dcb4102504cf9525dfcc6b999341aac4f37a6e4ce79
SHA512 35ccb04f1259d3f9a1e263fd63286db4fc4e41089948d4622f8a21b4ea193b20a35005194f23a27e390665f713c593b0121423874819f120c615df1f50417380

C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

MD5 08d6d38d53d8b08ca4902d686d6504d3
SHA1 a187793c7d7e89dda08ccc0c62670fa538696e72
SHA256 9fd7e3f6654422c87bfcd56ba91f26f4b00d87dee37ed03f2df5489baa9dc228
SHA512 3f12411ce070a8de5a72a0e71a8e13649b3f0e7b5914870283dadcd91ffcf514bf2a72d353d30add29b20f567545a95c2ed4814a7eb7bf3a795029273ab97b67

C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

MD5 dfb0bbbcdbf020f44cb5e86dcf32a442
SHA1 fac83668b1cc59ce37bc04f172e8bb319c03c7f8
SHA256 b11ab278cd1230591654b8b0cf1e0493e2c1da32b83c334695b1905e4e053b97
SHA512 38d352bc1e497b6c662c66477cc38ebb444da12ced7bc84f5acff638de5981b7fd4bc1c9c0628a7e38996fd07071afa289c1ac5c1fe3fa52b5ee1ad2c182bf17

C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

MD5 85e5f5450fd4716169faf243199958a9
SHA1 ff650488ed7b5b58816d0c3ab4f0a75618e0e334
SHA256 2f9c0f3088bc786e6a5d7af42838ebc7c896e7b50bac56ffc14d548aec3ae6ea
SHA512 3e1a415580c86151e98f463952b35fe92e6c15420e96598e78746cfa341228616bdeaac4122482a3451fee5b1cef2614e11a3bd019c186d9c88d46500f43c1ac

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 fa47b7b950f802cd961205370fa13fa6
SHA1 1444c71f8ed3a7a168038d78a0f2b7bc2fc751c7
SHA256 2c1c34a371e90bb12f5df8256e52e37491f461ae75aa267ac9bd1c1e2a4c5eb9
SHA512 f43665b792ff412a827fa76cc639348c22bf96b48094cb06c70def6fd5d2af476f6ddb1236d189e0772d309de910683ee3c82a20aa8d6866b1c2643c35a38b02

C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

MD5 46064c269602a64ab1ddff80584d39b9
SHA1 d7635b422810b0c465d535447d0c055a576edb72
SHA256 f323ae6640785abcde3bcc7d276aee9347d90af15a482766ca100da4e42effaa
SHA512 7b735452a06d17f8aed5c49611e24fb5ac5fef16ae4aac49d6fcdbabef22373708843f7ad4b07537fedfc50f27feb455fa6a4347d0a84d68e1fd6dcf77fb0e0e

C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

MD5 511eb024e0bd86003cff1ec7ebe959e5
SHA1 9741b79c4f3f7eee04df26d68bfaa0aa1618a762
SHA256 f5ab0a94aacbe30bd1189fb5f499d16b1a647b3f1612fa3574f5ba5521183bd0
SHA512 50c7b1f103c21b68960e4e4d6602f8328eef7463b7c421b251cf424c06d64479fbef30d360d81338a7918f8baca112f45fc26e4c2ae35df36a578a3c940459a9

C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

MD5 92c83bf44c3789cf8f47e06f1b3e6ede
SHA1 41a3e4a866bfa2b80c0595f0dc0e26122e394e7c
SHA256 ebd7a9d3a2c45ebe7d10a906a1d463ab03e50a21743b4a1a4852e10b50ac8696
SHA512 e2ae6d6a08bc43233f1ca1c72cb9ef14f122a2960c3863914015e0ec1792eb9bfd580e497a937882db2da3cbe99cb1931409e5241ef8260f3e4e09704214fdf4

C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

MD5 bbe8b4820da5ec47b03155ce2edcf544
SHA1 de2af0a6cc78074f65f01a6d9ae9799f2305caae
SHA256 79452d9ec5ede4f4c3534bf9b2902707df435e8be6a565e03aa5f92125a1f32e
SHA512 ed718aa2c44c74ce2d9d1094a02e1ec40f950b2fd1fc0c6287bf1c2764a158a28090b1ae2ff440d75ba5bf8fc6aa81bad1323f6241db4eac5db2fc472c37ab36

C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

MD5 2a07059741b5de999592e8370098e97c
SHA1 f7a69633bf7f3ebcc4df84ec8d5ce9cae630a0a5
SHA256 bedc0a478b9267582dc37eff04983d2d2bb831b3bfc4e8890720f412be375a26
SHA512 efed275905cbe558ee5202ac2265dea1bdd364c6a430a3f145771fe8e13f670fd8f22cb4bd5fc453e84ae1b216de0b8c1d11a0bdf6d5a250bf86d804dd322beb

C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

MD5 ee069300d0c16b23776f2eda2a3b57c4
SHA1 63117e4f37c5b3fe9214bcad1e2f2c17640db641
SHA256 e79c77f0627b242361b3bde2c4deb5b14f9cdd52986be5c399b3306f06affe0e
SHA512 6e5d7781bef2f5744c72832ad3a192b854dccc688b203376d654ee949ba3c16acc1fd994906a940c931811f36647c8e24584b8e0289076e4f1c8a781432a4b3d

C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

MD5 13792a977a6907a94f10ec02e5774dad
SHA1 568b06e733a5c0daa50a5f656dc1d72abc1c3eb7
SHA256 3650695b90de47d7eec8073b0fb78faf4ef7a2d34e202b96fcd207bba1207fe1
SHA512 9db64caa67525b61c272ff79817e22a0c32632e3b2f3285b4b3a2c8d57942ed1026b324fc2f3ffe65f09a9c13903e5689c8e766914527667228ab74e5487ecf6