Malware Analysis Report

2025-01-03 07:46

Sample ID 230426-gzwm5shd5y
Target tmplhf3940d
SHA256 6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
Tags
blustealer collection stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c

Threat Level: Known bad

The file tmplhf3940d was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer spyware

BluStealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Script User-Agent

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy service COM API

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Checks processor information in registry

Uses Volume Shadow Copy WMI provider

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-26 06:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-26 06:15

Reported

2023-04-26 06:17

Platform

win7-20230220-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\707d4bdc826a969e.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1712 set thread context of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 768 set thread context of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{806180DF-8125-4964-A3C9-07267A6CD57F}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{806180DF-8125-4964-A3C9-07267A6CD57F}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{33C02D2B-C7AF-4AC9-BFA7-BDB16C9A4C65} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{33C02D2B-C7AF-4AC9-BFA7-BDB16C9A4C65} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1712 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 768 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 824 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2724 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2924 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2504 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 1668 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 824 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 250 -NGENProcess 24c -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 1dc -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 1ec -Pipe 238 -Comment "NGen Worker Process"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 258 -Pipe 1f4 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 268 -NGENProcess 23c -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 248 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1b0 -NGENProcess 1dc -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 1ec -NGENProcess 248 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 27c -NGENProcess 278 -Pipe 248 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1712-54-0x0000000001210000-0x0000000001398000-memory.dmp

memory/1712-55-0x0000000004E40000-0x0000000004E80000-memory.dmp

memory/1712-56-0x00000000003A0000-0x00000000003B2000-memory.dmp

memory/1712-57-0x0000000004E40000-0x0000000004E80000-memory.dmp

memory/1712-58-0x0000000000580000-0x000000000058C000-memory.dmp

memory/1712-59-0x0000000005B80000-0x0000000005CB8000-memory.dmp

memory/1712-60-0x00000000060D0000-0x0000000006280000-memory.dmp

memory/768-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/768-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/768-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/768-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/768-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/768-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/768-69-0x0000000000280000-0x00000000002E6000-memory.dmp

memory/768-74-0x0000000000280000-0x00000000002E6000-memory.dmp

\Windows\System32\alg.exe

MD5 ad7fdf4d747026db363f51c16c2d4166
SHA1 3044d00834791fe10bbedb7bfc3fb183534dadd4
SHA256 912f59d1d8db07fe585b32d472fa1f17dc1987e631c000de95c08e1b0841d45d
SHA512 52b9dc9878c09bb62b12b543bb97e7ef56c65a31c17c4773a3b2ad9173669cb2b5e495cbe1307c8cbab8515783b95f698bb0437cf3e41439b273ad3f2f2fa586

memory/768-82-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 ad7fdf4d747026db363f51c16c2d4166
SHA1 3044d00834791fe10bbedb7bfc3fb183534dadd4
SHA256 912f59d1d8db07fe585b32d472fa1f17dc1987e631c000de95c08e1b0841d45d
SHA512 52b9dc9878c09bb62b12b543bb97e7ef56c65a31c17c4773a3b2ad9173669cb2b5e495cbe1307c8cbab8515783b95f698bb0437cf3e41439b273ad3f2f2fa586

memory/1304-83-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/1304-89-0x00000000008F0000-0x0000000000950000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 9358f7db48eea4bab14a817d11ad3e3f
SHA1 718090794a1021bfb90c1acafeb7638978ad564c
SHA256 0aa8c969d50f0bece5b2ec6dcd4c5e6aa3aeb19f712a70dc97ecef8b7a809f8c
SHA512 67865196159aee9a7cd42fc0d25c7e47a0cf534d1c5a72316af21eaba6e3faac63f3998212538318694054f6141a1415aa70a883bc03345ccd5b4ba2a9072ccd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 9358f7db48eea4bab14a817d11ad3e3f
SHA1 718090794a1021bfb90c1acafeb7638978ad564c
SHA256 0aa8c969d50f0bece5b2ec6dcd4c5e6aa3aeb19f712a70dc97ecef8b7a809f8c
SHA512 67865196159aee9a7cd42fc0d25c7e47a0cf534d1c5a72316af21eaba6e3faac63f3998212538318694054f6141a1415aa70a883bc03345ccd5b4ba2a9072ccd

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 6a8d8a7a5fea79e2847b25c64a795a3f
SHA1 297145616b348b5027112271c15a88609ed93bac
SHA256 391ac872f84ea1cab70c22e7e9c3426f68f9ee12f2f9ea0c248843923ee410d8
SHA512 de864933c925afa2441f5e98d7af36e03ebcb784311d81ba051af19984549250d3bba5dbdcd4b545fc6f33f501b642cd908b180ef8d5de96a20d93386447bd79

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 6a8d8a7a5fea79e2847b25c64a795a3f
SHA1 297145616b348b5027112271c15a88609ed93bac
SHA256 391ac872f84ea1cab70c22e7e9c3426f68f9ee12f2f9ea0c248843923ee410d8
SHA512 de864933c925afa2441f5e98d7af36e03ebcb784311d81ba051af19984549250d3bba5dbdcd4b545fc6f33f501b642cd908b180ef8d5de96a20d93386447bd79

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 a40bdfc16e5c0421c0cb4cf8df86fa4d
SHA1 1aa25aee70223aab8dcab3a365486b5f3a4cd1a2
SHA256 c54fa76ea3f868596a6decf6e2bd930f0111c7ef3ec332bdaf0b2cac1486323e
SHA512 f63183ad479d7b3c7fad6ff5a36af26a82d81ff501a4718cde0a6f50f743e24cb1f2f53bad30c2959518279aaa60d78db489a82d6f6f409ebed1e821aa8dc375

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7174c88720cbef3aedf295a9867c7229
SHA1 9e83284446d72e1105e95a2b179b565556997290
SHA256 331e6818c72b03b4e333b6dfcf720c4e18755a72a8e071a6f3508442d8c3fed8
SHA512 dc131766492e16bb7a98c42967358420d7333ebb3470ee8c6c71bd7f30ef175646398c4e8760152addeb76d6d71be84eab2bad015cb30b44642361294edd241f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7174c88720cbef3aedf295a9867c7229
SHA1 9e83284446d72e1105e95a2b179b565556997290
SHA256 331e6818c72b03b4e333b6dfcf720c4e18755a72a8e071a6f3508442d8c3fed8
SHA512 dc131766492e16bb7a98c42967358420d7333ebb3470ee8c6c71bd7f30ef175646398c4e8760152addeb76d6d71be84eab2bad015cb30b44642361294edd241f

memory/1580-107-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1304-111-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/896-112-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/2028-113-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

memory/824-115-0x0000000000230000-0x0000000000296000-memory.dmp

memory/824-120-0x0000000000230000-0x0000000000296000-memory.dmp

memory/1044-122-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1044-123-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1044-124-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1044-126-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1044-128-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1044-129-0x00000000024B0000-0x000000000256C000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7174c88720cbef3aedf295a9867c7229
SHA1 9e83284446d72e1105e95a2b179b565556997290
SHA256 331e6818c72b03b4e333b6dfcf720c4e18755a72a8e071a6f3508442d8c3fed8
SHA512 dc131766492e16bb7a98c42967358420d7333ebb3470ee8c6c71bd7f30ef175646398c4e8760152addeb76d6d71be84eab2bad015cb30b44642361294edd241f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 0a382406719356e4e82a61667a643b86
SHA1 e5adbd3c4f69e3bf2eeea5178bfea378a75e196b
SHA256 3c79466b1150269f0c05f4732e2881bb959d18210a16c35b4e78ee64eacdf961
SHA512 dfa406a2e4963d98c04884473a2e0fdc46e4b827fad66d73e488244002887de533a094867728268ef5c6ab2491d0f8d915c09bdd096736d9a84ac012d90426e7

memory/824-138-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 36c28c815119063f1e3d6e64a3091ba2
SHA1 0fd51bf9ed6f6d017fe76f6549cde6171af0dc07
SHA256 a637dc91a6d9976b76e4c20b377f0924f4a3daa9cc323f0765a18c3ac551ce0d
SHA512 f74469dbdff90f6f9f02f2184c2474cbb5914f7cf960d44516473ca10a42a74614dd448f544f3ab53e9d67a42a56cdcfdcdfa627167030a82e80dbe774ccf82d

\Windows\System32\dllhost.exe

MD5 a1b8104ae0b2f91b611df2f83df62955
SHA1 14c946abf287c9b29cf25317f8159aac023480a2
SHA256 1e81902b26acf9c7df814141a8c3e30aba960b67cc1d62bbe0893538c5d35365
SHA512 636b6c90daf43d9913b139a4477d97c6e110c83757b87deecc9f37dd461593b925e83f1dcf3adb56f701eca4dff8a729dbd12a280679b17dd268310b330775c8

C:\Windows\System32\dllhost.exe

MD5 a1b8104ae0b2f91b611df2f83df62955
SHA1 14c946abf287c9b29cf25317f8159aac023480a2
SHA256 1e81902b26acf9c7df814141a8c3e30aba960b67cc1d62bbe0893538c5d35365
SHA512 636b6c90daf43d9913b139a4477d97c6e110c83757b87deecc9f37dd461593b925e83f1dcf3adb56f701eca4dff8a729dbd12a280679b17dd268310b330775c8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 36c28c815119063f1e3d6e64a3091ba2
SHA1 0fd51bf9ed6f6d017fe76f6549cde6171af0dc07
SHA256 a637dc91a6d9976b76e4c20b377f0924f4a3daa9cc323f0765a18c3ac551ce0d
SHA512 f74469dbdff90f6f9f02f2184c2474cbb5914f7cf960d44516473ca10a42a74614dd448f544f3ab53e9d67a42a56cdcfdcdfa627167030a82e80dbe774ccf82d

\Windows\ehome\ehrecvr.exe

MD5 7c4aed8d438065473a70ef9d85594f94
SHA1 3d0f64ebe5655b352260f8b4c42ba69ad6461966
SHA256 80a6cebf30c8c1e5b17e78cc0167384748fa8bc3007df5efba0dc7129f854f5b
SHA512 a9b327e1a5356165a5f14d58c8c85a65bd5978199734aeb67d1cbf2950432a5b947d0a2b92e9faf0a5c02e5f6098325f6a265bb7f2ae71d3a827f146bae79367

C:\Windows\ehome\ehrecvr.exe

MD5 7c4aed8d438065473a70ef9d85594f94
SHA1 3d0f64ebe5655b352260f8b4c42ba69ad6461966
SHA256 80a6cebf30c8c1e5b17e78cc0167384748fa8bc3007df5efba0dc7129f854f5b
SHA512 a9b327e1a5356165a5f14d58c8c85a65bd5978199734aeb67d1cbf2950432a5b947d0a2b92e9faf0a5c02e5f6098325f6a265bb7f2ae71d3a827f146bae79367

memory/1504-150-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1504-156-0x0000000000830000-0x0000000000890000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 d5a685739baa0d1d09f7e485fa6ac354
SHA1 87bc8e0143736b8a4f85ba5645b7dc483f245554
SHA256 5f4fa696c55875447c53bcaf658cafda669265631b17b93f36912f278ea4b059
SHA512 26fa98098241bee11a1828b3a8be48ff88ed06469c42c5f0dfccf564c191bf113efdd980e2dbf1282d4a36289a7492b0b8f7b8958ce0b45f8250c57486da2840

C:\Windows\ehome\ehsched.exe

MD5 d5a685739baa0d1d09f7e485fa6ac354
SHA1 87bc8e0143736b8a4f85ba5645b7dc483f245554
SHA256 5f4fa696c55875447c53bcaf658cafda669265631b17b93f36912f278ea4b059
SHA512 26fa98098241bee11a1828b3a8be48ff88ed06469c42c5f0dfccf564c191bf113efdd980e2dbf1282d4a36289a7492b0b8f7b8958ce0b45f8250c57486da2840

memory/1504-161-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1576-162-0x0000000000180000-0x00000000001E0000-memory.dmp

memory/2024-164-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1504-165-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1000-167-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1504-168-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1576-169-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1576-173-0x0000000000180000-0x00000000001E0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 0f3461f3a7b4bc1f4153b5a0bf578bf0
SHA1 94b0ca4fef429cbe0c30f628a4fc375c99ef2ba3
SHA256 1a1175f16f289980fec780fd7df1a47a32d2aa026c5ff98d6432471333c5f566
SHA512 de78c9f67454791290ced66cde7c7cfbe7c51cadad4fa748ae4aca8eb8e8b16cf5c9d0ec30b003debe12f1f4a29290cea7a9a188ddaaa41f7db9cc1e30882066

memory/900-178-0x0000000000900000-0x0000000000960000-memory.dmp

memory/900-184-0x0000000000900000-0x0000000000960000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 d7e7c09feb21639e0c5f342e4cbc7e65
SHA1 08f8948172b356455fe816286e7410bc10eaef06
SHA256 31a7e3973cadc3c43f8dc880c3d4c0f0c88efb7b690304caef6ced320adfc0cd
SHA512 6ccecf80af3e73a152383a901c75570c0c6db6e5e23a88870c8a4754dc56b6f8b2bd0bd5dcd0a21ee2e1956a8fbb980355fde95695eeb8dc66be0b936f64e0a3

\Windows\System32\ieetwcollector.exe

MD5 d7e7c09feb21639e0c5f342e4cbc7e65
SHA1 08f8948172b356455fe816286e7410bc10eaef06
SHA256 31a7e3973cadc3c43f8dc880c3d4c0f0c88efb7b690304caef6ced320adfc0cd
SHA512 6ccecf80af3e73a152383a901c75570c0c6db6e5e23a88870c8a4754dc56b6f8b2bd0bd5dcd0a21ee2e1956a8fbb980355fde95695eeb8dc66be0b936f64e0a3

memory/2032-189-0x0000000000810000-0x0000000000870000-memory.dmp

memory/1504-197-0x0000000001430000-0x0000000001431000-memory.dmp

memory/900-198-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2032-199-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1712-200-0x0000000000B00000-0x0000000000B80000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 5628db18da98bb737fcce2a9d17925cb
SHA1 01025e8bf587a64ebf520d63443617b881452ae9
SHA256 b2c854902eb7446559774d1440193dcc4c1271905de834645d6cb496ccb764ea
SHA512 8ebb938871c287d53571c56d19bf70286a5ab2fe58f37b5ebe11348b2038db40ae345c78233c43dff95b226d6f3f7d6cbb10fee6d595559dc513ae7b9d00b107

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 9de8c9bb0411c9bc3c2bd92a0a2db83f
SHA1 f10de13df62d7f6c325e63a2143c6b9344e21f76
SHA256 0a24fa09a636953a47a8b493177a78017a8fa5f8b74ef3b64456b6b88a61472d
SHA512 eab7501bde608ab4c3559a448e6e38b74916de8b35d670538308271ce653c3317581ca29e8a15cb50888d6f0bce97bdc5f0aa36f331865ecc2d50dd76ebfd0d1

memory/852-224-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2036-226-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2072-229-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

memory/2036-246-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 6d670969a4d1ff51aeaa00ec172b2b54
SHA1 7ac55c2fa9dd9a795716c9448083ca0eacb8a679
SHA256 ca4755fd89ce679d1cd52238330880e2d2fec907d8c516acc371933e3e1714a0
SHA512 d485a2da2e188c2d5f91e735880ac30ba81ffb3677aa28b1a09bb57eaac2f173dc1374b68b88f654b1b6d4f171fe9482d064afd7db456d75a538a4baa8bb00bd

\Windows\System32\msdtc.exe

MD5 6d670969a4d1ff51aeaa00ec172b2b54
SHA1 7ac55c2fa9dd9a795716c9448083ca0eacb8a679
SHA256 ca4755fd89ce679d1cd52238330880e2d2fec907d8c516acc371933e3e1714a0
SHA512 d485a2da2e188c2d5f91e735880ac30ba81ffb3677aa28b1a09bb57eaac2f173dc1374b68b88f654b1b6d4f171fe9482d064afd7db456d75a538a4baa8bb00bd

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

memory/2276-266-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2152-267-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2292-268-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1712-270-0x0000000000B00000-0x0000000000B80000-memory.dmp

memory/2072-274-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 03dbe4e2d3a56788328bcd269f41a832
SHA1 88af151aa574cf7bb60a944905a8809dbac38122
SHA256 7ee75718dded6f85386cee0324b4fa7b72fdf7936b654154a271c1a893eb3871
SHA512 25af20ba314507c1bbd1bc7a017071f35b43dab068dd9ab2497a79465e82eec7c8ab0d49097c116bceb39829c35c85c0334d99d3c6f025df86ad3d2a876020f8

C:\Windows\System32\msiexec.exe

MD5 03dbe4e2d3a56788328bcd269f41a832
SHA1 88af151aa574cf7bb60a944905a8809dbac38122
SHA256 7ee75718dded6f85386cee0324b4fa7b72fdf7936b654154a271c1a893eb3871
SHA512 25af20ba314507c1bbd1bc7a017071f35b43dab068dd9ab2497a79465e82eec7c8ab0d49097c116bceb39829c35c85c0334d99d3c6f025df86ad3d2a876020f8

C:\Windows\system32\msiexec.exe

MD5 03dbe4e2d3a56788328bcd269f41a832
SHA1 88af151aa574cf7bb60a944905a8809dbac38122
SHA256 7ee75718dded6f85386cee0324b4fa7b72fdf7936b654154a271c1a893eb3871
SHA512 25af20ba314507c1bbd1bc7a017071f35b43dab068dd9ab2497a79465e82eec7c8ab0d49097c116bceb39829c35c85c0334d99d3c6f025df86ad3d2a876020f8

\Windows\System32\msiexec.exe

MD5 03dbe4e2d3a56788328bcd269f41a832
SHA1 88af151aa574cf7bb60a944905a8809dbac38122
SHA256 7ee75718dded6f85386cee0324b4fa7b72fdf7936b654154a271c1a893eb3871
SHA512 25af20ba314507c1bbd1bc7a017071f35b43dab068dd9ab2497a79465e82eec7c8ab0d49097c116bceb39829c35c85c0334d99d3c6f025df86ad3d2a876020f8

memory/2488-282-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2488-284-0x0000000000610000-0x0000000000819000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 c269c9787b8b6f2f1b796a1f47c0bba4
SHA1 c94fe79360360c088f0d71229cee5a2c6aba4bfc
SHA256 9d59f8d35b8a37f8bb0209285ca27ea5caf8bb54e198452681859f057cd6df91
SHA512 794955a35ae6bdacc32d1cb7ea755116ae8e51adaf979d287e37488f118262a39597d92390b12a80dea0b06e406ddcc656039f752c1995d322635e29bd1d8512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 d8cea481e3546234bb64186cde4f546d
SHA1 f1138193cf3a6fdedb78a237664c502997d55a0f
SHA256 5deae1fccf3b72788fb5c591e02b6d9c80c6a5c8939e8c628b93f977196560d0
SHA512 aa47f80e97e0079565c11b378ad28e888009f6e9b7a93715b9ec659cc559fac6b7dfcbd554375f6074d018ded6571c79bb8aa48a313af4c9ff07c92650543a85

memory/768-305-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2684-312-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/1712-315-0x0000000000B00000-0x0000000000B80000-memory.dmp

memory/2724-316-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2736-320-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

C:\Windows\SysWOW64\perfhost.exe

MD5 135995d0b63b04f716f5f69aaa00ef63
SHA1 ff41b39aed16c77d645f0821155c34c5d33e57c7
SHA256 d73299c3ed4b596ca7a08777792df8fba992bfbcc82a790ab1a6b46e2b78d48b
SHA512 029e9f7b705a9fa5d36a03c7da39456259429da40db570c80f8b69a78fc0f15173fc20668165ab9b94becc7ce43a75869f68eb06cb591d5b0502316d2e99596d

\Windows\System32\Locator.exe

MD5 d60a63cbe64bfac05576052d6846bd65
SHA1 c3705952b3c4e25f34f95a035e540f9c1576b640
SHA256 11ecd622dfbbcfaa1f9374ee10dd6c93d3987948928a2d66cfeef5c9d37ae7ca
SHA512 51637871db1f6bb6c37de51241a1f98736ca0dd0e9b7f87d5a7b30446105db1b146dd64d4102a5990a62b34928afd984b603bf91bb46a6349b85aacad676d65f

C:\Windows\System32\Locator.exe

MD5 d60a63cbe64bfac05576052d6846bd65
SHA1 c3705952b3c4e25f34f95a035e540f9c1576b640
SHA256 11ecd622dfbbcfaa1f9374ee10dd6c93d3987948928a2d66cfeef5c9d37ae7ca
SHA512 51637871db1f6bb6c37de51241a1f98736ca0dd0e9b7f87d5a7b30446105db1b146dd64d4102a5990a62b34928afd984b603bf91bb46a6349b85aacad676d65f

memory/2924-343-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2992-346-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/3020-348-0x0000000100000000-0x00000001001EC000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 9027915d681a66b1abc0a961a252fa77
SHA1 debf258002f0299e511fce49daca05e2dc10ab6d
SHA256 ce10f868036db232f9e0de8a16abcdd4b81591ea7c4cb2a462eefa0ea630e459
SHA512 0b95e4a5d19e2c309e775d310e3c878c037d560cb9d0ce06b0a1804c4a89b34e753d70f1d77594a72a4bc5ef701ebe8dcf7154da0771269be90c5bf521395ba3

C:\Windows\System32\snmptrap.exe

MD5 9027915d681a66b1abc0a961a252fa77
SHA1 debf258002f0299e511fce49daca05e2dc10ab6d
SHA256 ce10f868036db232f9e0de8a16abcdd4b81591ea7c4cb2a462eefa0ea630e459
SHA512 0b95e4a5d19e2c309e775d310e3c878c037d560cb9d0ce06b0a1804c4a89b34e753d70f1d77594a72a4bc5ef701ebe8dcf7154da0771269be90c5bf521395ba3

\Windows\System32\vds.exe

MD5 3af4d057c05db071a1b022207d6c45b0
SHA1 1422b0e15fd08a923646e51a63071a8f8ce5ef8a
SHA256 ac9dc3af7e0f3331df7f5b3ed68e0f3005ed2209913b73d20db0080c121bb853
SHA512 2f11a04f4d3783479ab9ec1fb7289063151fd3f4925ef9a53510e86332c7d81e7abf0d25d1bab41e4ecd67006d6b4a9160c1af90d59ee8e15282d2d3ddb0570d

C:\Windows\System32\vds.exe

MD5 3af4d057c05db071a1b022207d6c45b0
SHA1 1422b0e15fd08a923646e51a63071a8f8ce5ef8a
SHA256 ac9dc3af7e0f3331df7f5b3ed68e0f3005ed2209913b73d20db0080c121bb853
SHA512 2f11a04f4d3783479ab9ec1fb7289063151fd3f4925ef9a53510e86332c7d81e7abf0d25d1bab41e4ecd67006d6b4a9160c1af90d59ee8e15282d2d3ddb0570d

memory/1504-370-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1576-372-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2204-375-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2352-376-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 fb3093e4e706beb554460dc8c4e18d2b
SHA1 d8864812b788fabc48a90adb829a5a107eb25a5b
SHA256 56437d4624bfee99d2bc02f41edb5a5328f09181b12a29a08da83605b1a070a5
SHA512 3ece837a18a2417aff0521e71bef0b45ed45ba4fd4abb96ea4f46a1ed4d2bf06cc2ff73ecebb72f894dc7fd271af218b8953826896489d423b6143d2db225a4b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

\Windows\System32\wbengine.exe

MD5 3c07754874ea499f5c912bd98263791c
SHA1 4b9f75c4412224abcf0b5cdc1bf464ba0b3abb9f
SHA256 8008dc9014f8c3ffe00dfe806ee9fa6eae2758502a4a3d8d3599f7504e128495
SHA512 dbf4b6a0ecbcad67be48040d7d0961cada4b90287d2259350b7d3da6043a16acbbdf0884f74a75696258483d126115beeffcd411d5ee9de5914031f6634109db

C:\Windows\System32\wbengine.exe

MD5 3c07754874ea499f5c912bd98263791c
SHA1 4b9f75c4412224abcf0b5cdc1bf464ba0b3abb9f
SHA256 8008dc9014f8c3ffe00dfe806ee9fa6eae2758502a4a3d8d3599f7504e128495
SHA512 dbf4b6a0ecbcad67be48040d7d0961cada4b90287d2259350b7d3da6043a16acbbdf0884f74a75696258483d126115beeffcd411d5ee9de5914031f6634109db

memory/900-404-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1712-406-0x0000000000B00000-0x0000000000B80000-memory.dmp

memory/2420-409-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2504-412-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1300-414-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2924-417-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 a4a0ff0b14a3dd62ce857807b94f00a7
SHA1 440e48c93f15e68df29bbc2258a3b927094922c7
SHA256 8bf6a2fbd1ebc876eb10b30a1393643d450847d6a3105081465fb28e4ea48970
SHA512 19d39475f5e009228f71e8a9099eb0a80af5c39547778540e17a0dcde56829448d1e0df8c5961ba8b16870eb00593d5da6a3a7991e4f668eb333db4df214bc1d

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 a4a0ff0b14a3dd62ce857807b94f00a7
SHA1 440e48c93f15e68df29bbc2258a3b927094922c7
SHA256 8bf6a2fbd1ebc876eb10b30a1393643d450847d6a3105081465fb28e4ea48970
SHA512 19d39475f5e009228f71e8a9099eb0a80af5c39547778540e17a0dcde56829448d1e0df8c5961ba8b16870eb00593d5da6a3a7991e4f668eb333db4df214bc1d

memory/1404-431-0x0000000100000000-0x000000010021B000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 67d8a5275c6602f584eda841bd5e81ff
SHA1 d268177d7e552e388f3a61c41bc2bb69823a5b5b
SHA256 36aade3bc655e766db34717046ec815c8eee304e238b514df43555eb38ad0ee5
SHA512 99343d3392ae64e2570bd4f8a003c8084eb51094d054934bc32ab12e676b69571a9ed755c662f34ea54246b74a664667293b01377b1fd1722fb7ee2a31b8082b

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 67d8a5275c6602f584eda841bd5e81ff
SHA1 d268177d7e552e388f3a61c41bc2bb69823a5b5b
SHA256 36aade3bc655e766db34717046ec815c8eee304e238b514df43555eb38ad0ee5
SHA512 99343d3392ae64e2570bd4f8a003c8084eb51094d054934bc32ab12e676b69571a9ed755c662f34ea54246b74a664667293b01377b1fd1722fb7ee2a31b8082b

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 67d8a5275c6602f584eda841bd5e81ff
SHA1 d268177d7e552e388f3a61c41bc2bb69823a5b5b
SHA256 36aade3bc655e766db34717046ec815c8eee304e238b514df43555eb38ad0ee5
SHA512 99343d3392ae64e2570bd4f8a003c8084eb51094d054934bc32ab12e676b69571a9ed755c662f34ea54246b74a664667293b01377b1fd1722fb7ee2a31b8082b

C:\Windows\System32\SearchIndexer.exe

MD5 5efef59aedc9b01ae20e922570f1470d
SHA1 f25e091162e90145d0118c7151a5a132cc2cc7e3
SHA256 d1396fddea57e6fa6415ad7f5ecfbfe66be7ad115bc7e1229e0383f2190c0d5c
SHA512 255135ae1c4a31347749c2b699ef5789a681f6fe739c82471575c2dae94e7e4b4bdd7303535378d2236340f37b3df67f53e6f43e304d3d25af13ed94484496e5

memory/2276-461-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2292-462-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2964-464-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2104-465-0x0000000100000000-0x0000000100123000-memory.dmp

memory/2488-483-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2488-484-0x0000000000610000-0x0000000000819000-memory.dmp

memory/2724-539-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2736-540-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2032-554-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

memory/3020-568-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2352-574-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2420-575-0x0000000100000000-0x0000000100219000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 1da8117256039d07a064755ded20df6b
SHA1 97894802103740895fb01eea7b608f714decf963
SHA256 10830f32cdc6734bceba18a855360dc65b4854fcf2da4e292f02d2d39f7b38eb
SHA512 ed2090492b99f1f582f3776a99b215cbfb15cded20dcd231867985f9837c2caa0cc8b0043c93b643a46f0cb3366ed089c397aa1a36367ddeff571f85955b744a

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-26 06:15

Reported

2023-04-26 06:17

Platform

win10v2004-20230220-en

Max time kernel

151s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a1db7972c94b1c77.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3780 set thread context of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1832 set thread context of 1552 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048f32a641778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d571f691778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000402e9f621778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f3f88691778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003baf81631778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000627cad621778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045c7bb621778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cb56d641778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d9a30631778d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3780 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 3780 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe
PID 1832 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1832 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1832 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1832 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1832 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1968 wrote to memory of 2096 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1968 wrote to memory of 2096 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1968 wrote to memory of 2792 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1968 wrote to memory of 2792 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe

"C:\Users\Admin\AppData\Local\Temp\tmplhf3940d.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 254.20.238.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
IE 13.69.239.73:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 233.141.123.20.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
NL 8.238.20.126:80 tcp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp
NL 8.238.20.126:80 tcp
NL 8.238.20.126:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp

Files

memory/3780-133-0x0000000000140000-0x00000000002C8000-memory.dmp

memory/3780-134-0x0000000005220000-0x00000000057C4000-memory.dmp

memory/3780-135-0x0000000004D10000-0x0000000004DA2000-memory.dmp

memory/3780-136-0x0000000004E90000-0x0000000004EA0000-memory.dmp

memory/3780-137-0x0000000004C70000-0x0000000004C7A000-memory.dmp

memory/3780-138-0x0000000004E90000-0x0000000004EA0000-memory.dmp

memory/3780-139-0x0000000006C40000-0x0000000006CDC000-memory.dmp

memory/1832-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1832-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1832-144-0x0000000002C30000-0x0000000002C96000-memory.dmp

memory/1832-149-0x0000000002C30000-0x0000000002C96000-memory.dmp

C:\Windows\System32\alg.exe

MD5 11a2001ce6ac2960399098f1384b5c65
SHA1 8fa10bdabadb51016bdfef4bc75b1f0ae7146b99
SHA256 7468e8d53bde7ffd5182a88bf65e8b96af8861e9b90592fb23d1c0bfa53c7ad7
SHA512 a6dcdc61fa619d69a8ea3316f27b1c97545ba1618167168924715fadaa2eb5c39382eec49aab9b250a16345f9fd509d6170da97eb9013b0db8aa36a41eceb048

memory/2812-156-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/1832-160-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2812-163-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2812-164-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 f001246b8ef253c2927349bbfdad0417
SHA1 0835870290a80640a6a594a6107e2fbe3d9d1fa0
SHA256 ec965c54db1b92747aab898ee5a70ab5431c37c1b53dd274b7557a379572de46
SHA512 510b32ec4ae813166953dcd73778640e9771fb8d8ff6347313fc9df03f3e5cffd844f3c896e0870fb0c179fedd826f98cf6f58a9e62d8e757fc1d28e39f43b14

memory/5008-170-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/5008-176-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/5008-178-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 d61110019597a954198b91959d73d7d8
SHA1 4cdfee3d185bd189cb374c634346989ab26082fa
SHA256 a2a53b902f6e59da464791f77302bdcd5c5bc837ed445ef390c53897da1c1b30
SHA512 be90b716a78c6c00d60efc2bd010b6b0ce7868666674d36619e862c234388b1ec886ccc6a0fc11ac3b21aa49a144f13a5414f740615366c2af26740a03953b2f

memory/4200-181-0x0000000000420000-0x0000000000480000-memory.dmp

memory/4200-187-0x0000000000420000-0x0000000000480000-memory.dmp

memory/4200-190-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 bc32d3ee6703c43ed1cab3f6c7caad25
SHA1 387a129f6223d1fca4fb4fb652350458aeb6ec59
SHA256 203e50063313751e2ac0a5a4000ec9dc3b0ffcd1d65d9817f8b13fec1b0dd781
SHA512 605050c8a88de2ef0ae924d9016c32f4cd8d58b3925ad4c17469f2bf55faa0be4fa2b2fb9ca59134533ab081b9c657316d2e0b4df5af8057d80127ada3d765ca

memory/2948-192-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/2948-198-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/4200-200-0x0000000000420000-0x0000000000480000-memory.dmp

memory/4200-203-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 36a2100da641d66e34ecde95d85f4022
SHA1 4d4f5bb04f2fd379d36a7826314ce47810d7a05b
SHA256 c3ef724fb217f94b55e54b9034f483f445585818aefb053ee0bd258a0ac139d9
SHA512 029cd8eebc361785e5041ccde47abee78db025ffa02f01da1bcfe43c81f9bd7fbe6edc9549765ed6704b0abcccbbdfbd1aee59dd5aa1201ace8932973d2f0e06

memory/4528-205-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4528-209-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2948-211-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4528-213-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 e05cd50deda2aaa705ce212e96505343
SHA1 7a4b69de1648125ac99fabb1c8fc2448bd3ebf96
SHA256 06037db60520a605e250392af313cd096ea9d3344856a2869522802c268ba175
SHA512 7f4d6a2bf8bdbf9a41ff72ec795320c0a8d8c3ffeaabb290fddaaaea484b5a532253b0ee589bcfdb798f0813314ca1d734b5f338ca987551b131187eedfd8e3b

memory/4232-217-0x00000000014D0000-0x0000000001530000-memory.dmp

memory/4232-223-0x00000000014D0000-0x0000000001530000-memory.dmp

memory/4232-229-0x0000000140000000-0x0000000140221000-memory.dmp

memory/4232-227-0x00000000014D0000-0x0000000001530000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 c0822fda503e09211dcfd4ce858a58d7
SHA1 43cbc073b913463ba3305ed30d2cccb2500b8c4f
SHA256 6a511cad9438cc1eb5864768eff5a539c8026b206cd8f25d7b58aa11c19de906
SHA512 83ac126b29c2094f6d226d41323867cf5ceedf2ecca327dc6606a370b9532d5f891a5733e211cf99889b472614dee3ff36a6a849733b11fa7b755933a7e272a2

memory/3548-231-0x0000000000650000-0x00000000006B0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 5f4f136b8749033a46cc7a3c4a61e90d
SHA1 7ce77501ad98167d45a2e747430a7ba673a3a269
SHA256 059a5020e99a47327730389c178158ad71e2e9b1938cee9eb4e0c29ec6909cbd
SHA512 ac01735ff08ce80b75e7fdc57e12fe2d9a9090e5bdf76184709d58096337f5083a668481aee1f14ab958087b2902e6ee037813e6b0f85ecaaa06d6328577e6f3

memory/3548-249-0x0000000140000000-0x0000000140210000-memory.dmp

memory/1780-251-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 27468780c635e7bf2416b63f89769645
SHA1 d99c27d2b2ad64b5244b759464d964ba349b6254
SHA256 9e34741ac23ed15c83494a0f747b319a0a9c2ad08b425acb5857522d29177c73
SHA512 a4ac812e219a5c41b326c3b93f30769973ffea6df65048659f856f0f76180800ba3cc369afa2a53507d88b82cbc16616e31039973feb8240c707ea1e4f953754

C:\Windows\SysWOW64\perfhost.exe

MD5 adf4999d1db391375adfbff831c8a03f
SHA1 d080caf5bda76c3e046d12e84578eb11bc9f4b0b
SHA256 d3f0d49fe48130e8a0843bce30239d9ea436a8d67064eb9df22264f1464a9c68
SHA512 e5d2118aa5c359680da6848c775518b5212864b042545a7e5bff5b5205e7a4845f2d8ddbaa04728cc5847c951e64c8f7931a8de4bcecb6b019fb4a761041ca8f

memory/3204-269-0x0000000140000000-0x0000000140202000-memory.dmp

memory/3508-271-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 2194b239c3d270bf35cd724592f7f0fc
SHA1 c49becd51c17e06bae3b76a4c0786cadf1b1629a
SHA256 8c3911149ac9d1d46d98b62854e259a25e14880963aa86934833e96ac8094ca7
SHA512 ec2dd0f7c7f7b599a996529f26597a32cd936ee5bb8db0b88f7ec00972fb3bffda560cc380df1fcd62f1ce1acd104b31648f40d6c1768c434d485c55501c2a09

C:\Windows\System32\SensorDataService.exe

MD5 05bb3a74934ec436c38aa1893d819d98
SHA1 176f5eb796384a578505ea25427021deafef4c01
SHA256 a188334819bef5795a0b7ec22d169f5727bcd59a50e955129c4896242b7ff011
SHA512 b1e3c7b0ca8c7866d0c5a44692a411a30fc727da75a40415fab683e5d9d6d6862a5bc562b524b819d816c5b34bd282880bf474b05d64f349256e80401aaa5faa

memory/1664-290-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/720-292-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 4dcb9d4145fc5173b27555a7ccbb43f1
SHA1 8bf83ec6ce1a029de18219e7393561f3827c7f2e
SHA256 7268e242a3b0239f0f78e4debbeb0da4ab98452dc953548cb5b8440527f548be
SHA512 c6fe6808b7de8ced1fb1819908a0cea3a9c61d1b722a292ac065cd45175d0229cbf690d9aa7ce43b0f3dbd98afb8eb4fbdfd6f5bb338fb78850da32f3ca43e9c

memory/1348-309-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 51de03a78b47f950268040526ed3f6a0
SHA1 961c24e7531f5cbd7ff12e149facf5e24959ec44
SHA256 8c58f9092f811046a101a34634ff06c411c51bb47e3ad1f1b54e27ca076ba171
SHA512 fd8ea25a334ebdcd2c7dd1485a006ac0b568c191cf3986cc29e817d8d2b7d8f50eace25c1cc0a31f4dc4f72d2e28a31996c62ace86bcd4e34afd479e55d190a7

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 423e6505c158c6c319ded77e1a472c8f
SHA1 ea1d688656cf798475b3b3cc5901a9bfe13dc522
SHA256 7deb54d2262d1c05f46f3693653f0de2f3eb648020652e9195a22007d3267c7d
SHA512 4c0b83882b5cd9670ddd0ec9a0fe272b00a0add099d6319300b0ba945d98756f8927eb14334e41a8b8661cdc109f16a1db2656a91688ffaf34091b12e4ee6454

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 423e6505c158c6c319ded77e1a472c8f
SHA1 ea1d688656cf798475b3b3cc5901a9bfe13dc522
SHA256 7deb54d2262d1c05f46f3693653f0de2f3eb648020652e9195a22007d3267c7d
SHA512 4c0b83882b5cd9670ddd0ec9a0fe272b00a0add099d6319300b0ba945d98756f8927eb14334e41a8b8661cdc109f16a1db2656a91688ffaf34091b12e4ee6454

memory/3376-329-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3780-331-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 1835197c98786e38d798c1d27036e602
SHA1 fed8be37a2a292dd62af27bb5de1247114b51201
SHA256 1ae077a25d232481dcc59b9a8c0a8addf60be65ecdae754bdccbaeb86328b91a
SHA512 f1fc22b6314c23511422015e30b20fd1e6f0412e0a7429a05f54f3252106e1fa973b4bb6bf4a8da08de428ef1b645cb581cd3f6955f9ce13fe1566102f1a9338

C:\Windows\System32\AgentService.exe

MD5 51740392a0a13bcfa0d76414a3caa5b3
SHA1 11d9124832e18cf082038930986cedc11ec31df1
SHA256 0991c70d68759952453c50e912de6339fb4edc55c40cc7de5349e0732a8162ae
SHA512 9eaff0afa4a8b02c79d1175b2048ddf609581f5d54c6cc2d1ca24fd8231ca9f906cc08307e80a4be2ff39131e99e04f01fa041ea3635103d63dac3dd8331b889

memory/2812-344-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4168-347-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4176-358-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f42f5fb13d10c79f8b649a3fa8b1eec2
SHA1 c1440bd5a8d69e2b582763e41c54c68df19cb6c1
SHA256 edfcbf9e620512082abb6c14fa7223c443bb9e5a1b11d3e66defd39d53119054
SHA512 200ef400e324ce1fdaf93887b1b91401453db4eb76150589f87fd2eb93cccf9b32489e368bba71cafe785bd46714bb0a39aba0b599d7ee078e00d75f4d14a983

memory/1240-369-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 cf08340b47821f84a2c04015c37d2566
SHA1 5103a3b590d9c37d8c1bdf30fa6c11c49d19faf2
SHA256 7362bbc3d65786b6e390c58e45aac87a6ed3892924903a4b2a41a2b703a7da2a
SHA512 d3b60e7fb8b7212627338fe7b32d5542537da9e3b1e3ebebe51f4b7ec1b6957919153d318b5ff222efd635d98a99a74ea63edf61c0f9191d19d9a188e5a2e527

C:\Windows\System32\wbengine.exe

MD5 b70040e57951e8283120a47044743982
SHA1 5ba298807b215cabd1bc8838ada8ba0b607d04d5
SHA256 2c90c26b24bdbfd86e759e028d608a716878928996272b6d128653d3ed8ea7e0
SHA512 91ba21980ab8f72b933a591bbd01aa4294c44e0fc88195559a51f5c7cd96b30d1e6d8c4d646f75a2bd1040f777373e291057d9a37d1c302554d56e830821299a

memory/5084-389-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4012-390-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 06c99ce795aa76b65c18ad0bdfae41aa
SHA1 cf388c66bc9c0dfcbdc08ae05a1977087a403d6c
SHA256 b36f8ce19cf6ccc38ddc1cb139d0a253b1086792e93c306dc3d2c6c65cb44282
SHA512 1875339091d100bea36800f0a73ebd45388ed9c002019ccff7701f5584a9f800001cd6d3e011e4ace041265264f6964dae2bac56dded4ed2f1cd15a2c766a755

memory/1552-394-0x0000000000620000-0x0000000000686000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 d38a076356d0c63fac5eb03f8e390537
SHA1 4191daeb040ad40360fecf7402273c085a131163
SHA256 9d1969abd48fe2c059f425e34235e0d30ead80644feef1a8077cffab8375489b
SHA512 0fca3176ce7e7eb3dce8cc2b7ee17d9e8a84094d0aefb6149771a8088a18a0749fa6a56cd6547c3fbd70d21b976263d0bc7fd5d810d8858c2a319d06260e9541

memory/4528-415-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2948-416-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1064-418-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1968-420-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1780-499-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3508-531-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/720-539-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1348-574-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3376-582-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3780-583-0x0000000140000000-0x0000000140259000-memory.dmp

memory/1240-598-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5084-613-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4012-615-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1064-623-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1968-624-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2792-653-0x000002022DB70000-0x000002022DB80000-memory.dmp

memory/2792-654-0x000002022DB90000-0x000002022DBA0000-memory.dmp

memory/2792-655-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-656-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-691-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-692-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-693-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-694-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-695-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-696-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-713-0x000002022DBF0000-0x000002022DC00000-memory.dmp

memory/2792-714-0x000002022DBF0000-0x000002022DC00000-memory.dmp

memory/2792-715-0x000002022DBF0000-0x000002022DC00000-memory.dmp

memory/2792-716-0x000002022DBF0000-0x000002022DC00000-memory.dmp

memory/2792-721-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-722-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-723-0x000002022DBA0000-0x000002022DBB0000-memory.dmp

memory/2792-724-0x000002022DBA0000-0x000002022DBB0000-memory.dmp