Malware Analysis Report

2025-01-03 07:45

Sample ID 230426-l17t1sgf25
Target RFQ 21032023.exe
SHA256 295ebe6ba820bb813c6e9dd5526bf194a8da0268085ba0fc805f19c1ae3c6186
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

295ebe6ba820bb813c6e9dd5526bf194a8da0268085ba0fc805f19c1ae3c6186

Threat Level: Known bad

The file RFQ 21032023.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Script User-Agent

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Uses Volume Shadow Copy WMI provider

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-26 10:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-26 10:01

Reported

2023-04-26 10:03

Platform

win10v2004-20230220-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\1e31b96050d0d086.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce14b2f13678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bc5b4f63678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb16ceef3678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000838216ef3678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a3570f03678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d9af9f13678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2b714f13678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 704 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 736 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 704 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 8 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 8 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 8 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 8 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 8 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4680 wrote to memory of 3424 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4680 wrote to memory of 3424 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4680 wrote to memory of 1880 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4680 wrote to memory of 1880 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 126.128.241.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 52.168.117.169:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 24.249.124.192.in-addr.arpa udp
US 8.247.210.254:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.247.210.254:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 fwiwk.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp

Files

memory/704-133-0x0000000000860000-0x00000000009DA000-memory.dmp

memory/704-134-0x0000000005990000-0x0000000005F34000-memory.dmp

memory/704-135-0x00000000053E0000-0x0000000005472000-memory.dmp

memory/704-136-0x00000000055A0000-0x00000000055AA000-memory.dmp

memory/704-137-0x0000000005340000-0x0000000005350000-memory.dmp

memory/704-138-0x0000000005340000-0x0000000005350000-memory.dmp

memory/704-139-0x0000000006410000-0x00000000064AC000-memory.dmp

memory/8-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/8-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/8-144-0x0000000001510000-0x0000000001576000-memory.dmp

memory/8-149-0x0000000001510000-0x0000000001576000-memory.dmp

C:\Windows\System32\alg.exe

MD5 8a8c14a338f4fa68ea9cca2b5205c6b8
SHA1 6600dbbf926e675b51f5704fba33b1ac552082da
SHA256 9d84d915940ea944d3379081754e25f28c4d9589433e3f9fa90f951a4a50a1cf
SHA512 d989eb17d18d6e8e93514f17bd9bc7169514f6ea794e65e8a9dd3fee648082bc921bc4199dad869cb0a609571bc0b84571ad15764bc66c953eb7fd5c9990e4d0

memory/820-156-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/8-158-0x0000000000400000-0x0000000000654000-memory.dmp

memory/820-160-0x0000000140000000-0x0000000140201000-memory.dmp

memory/820-164-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 3b0b498e2c2296783906b56a059929c3
SHA1 b02a0037bbc39eec791123e2a65910ba1adf3366
SHA256 55a760dccf6df0defc022d4b5a5bddc35fdedf7c200b4e11bc71d7838fd495e4
SHA512 fd452defc189f392bbac007c9a3a6ca41577f0abd7f8d0a053c484601e529b6298e1b60734bc7a0125e36bbd8ee79d3381d7e70aaff082399c8a7883878d4902

memory/4120-170-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/4120-176-0x0000000000670000-0x00000000006D0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 fe0bb82ef23ba91b88c48596532f3910
SHA1 593924c4ec7027d7a17613673048c592d1cd5f70
SHA256 d3c2013cc3e7456d580bae32eecfc8a182091ea8ab5096a1b137468ed26c981f
SHA512 ebf8a58e78d35dbd38c093bc7942630f56075c108aeb97371d17f80325f835a5a91fff84bc07ad1752be988c6f088fc5690bcdf6f09431e7c8a50cd0e19c6ff3

memory/548-180-0x00000000009F0000-0x0000000000A50000-memory.dmp

memory/4120-184-0x0000000140000000-0x0000000140200000-memory.dmp

memory/548-185-0x0000000140000000-0x0000000140135000-memory.dmp

memory/548-188-0x00000000009F0000-0x0000000000A50000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 fd854af45b1769ac5cd3e703da6c1865
SHA1 723cdece2a85fbeb2dc42bb69666f3558350a562
SHA256 dbd68691b369b6c339ef8040ea42c086bf991d5e35321d88b944504da0425afc
SHA512 0f096884cdad8d456d73d126eb38806d7f4b9ced8a0a272fba65c263f01cd1f3a62beb8d4a5acc7dc888bf1a686b92348099758135fffd052be944cc1e5a9481

memory/4204-192-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/4204-198-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/4212-200-0x0000000000780000-0x00000000007E6000-memory.dmp

memory/548-201-0x00000000009F0000-0x0000000000A50000-memory.dmp

memory/548-204-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 4049647d33ffc529778a1d3f1da3f89b
SHA1 63f8f12e1b12f8f860aaa75713a758e9bb03ac79
SHA256 9bf402622eba3cb68680f7651ca66fa496ece6b4c148b6238d52d76e58497abc
SHA512 89a37f8b73b6110d9a40f5ee8662250f1846708275ccc0f3660a1e4ab7d2378af9b127c5eff9adc9719d849d8772be7534d07c1c734a44553e98b88c69f96bc8

memory/3692-206-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4212-211-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/4204-213-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3692-215-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3692-216-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b94c5aa3c529469560a93d0f9d2571f6
SHA1 c236f99866cb0e8aec7e6ebc4b7c4484aeec875f
SHA256 5d48e31f321345ce4c3637db8a91b26b495d724d5db2db589df49b3b5c43d7e8
SHA512 810eb1069ca989b46a24748212bb90cb99693e5ba2bd644b498abd80d1de175f18e9090b817d9a80d82683dd17741f6dcc816515793ea25d6c49b14c29e59ddf

memory/4276-220-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4276-226-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4276-229-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4276-232-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 231eeb588069cee32b37c967104edc10
SHA1 623681161f00baf9a4932f03d2b0f085c5e771b5
SHA256 a98a94b83cca64cd6b68017d5c307175528bdeee9ccaf0236c022357815f0ff0
SHA512 163f3ce50f40f6a38e75144fadf256776ea691ef35304155819ffcf1ff686f7cccda3b1870eca57fee6d3ec6c96fa52dbc061a8d96012b3d6bf9e77030ac9d26

memory/940-234-0x0000000000650000-0x00000000006B0000-memory.dmp

memory/940-238-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 df37cf20050acfc0de26caf83c2f5179
SHA1 ffffac855da28fa125521aa7f7907153f2cea1c1
SHA256 987bb9368e6a64fd49b5958dfd11572ebfd8cbbb8203c03c790742af8f36f488
SHA512 4f9d84afb4a97f0483202a3391d526653957d1f95306ebd7d1e5ac99835e903068187a5dda3c3889c771c59c7054865c715ab8a016cc7e7060c01d60559e3b18

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 bea55ba48713459a8223f4ee93852f0f
SHA1 63119f8ea93601ca6cf4722cdcb2901ab5e9bd98
SHA256 c20a0357791b7cc7cedb1d0585ccaa01f21bec559742d59b8ad059e70ccb7763
SHA512 16ade282cd88aa0599eb59ea7d99ef75b2fa6caaa2dab10ccc3a0cf1ca2c335c2aa958306cc558757358e65aeb9d3eb7d71372e5df3928c21c9a78b02535d539

C:\Windows\SysWOW64\perfhost.exe

MD5 0f4bc4b00b721da848709c5092eb8c36
SHA1 0788b9ab44b6dad742680d3fd6a9f483f4907b46
SHA256 ec892297bb091c572877aba9118b06e325dbd78320dfe6aa6e27034ef29ec688
SHA512 a08fbb703fa54ed08797653f5de9744159228936b98bc8b5968598cb40a560ff35f27cee2eb1cdde5d5298287324cecd5e573f5bc178f7ba56084029dd8886d6

memory/4264-271-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3900-274-0x0000000140000000-0x0000000140202000-memory.dmp

memory/3056-277-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 d573abed9c7dad7008b2f12ea8a4957a
SHA1 67917f351e7cd0e7d4ad1e4770a80ac1bab89b0b
SHA256 5fc460bef8866bde5717e5e79f783a06c3199098414b157528fb46c40cfaab06
SHA512 fae4568d747b952dd542c77fdcf8258170bb4ecf86b5620ab098dd649e98240fbb0a3ed5979ea960d01ea392277ca9ad577d2eaf68d45809d9ded8dc3b246654

C:\Windows\System32\SensorDataService.exe

MD5 59b1ee8e4edd38e244b2758909451345
SHA1 4be12a6340bbd2d3c7a11a6b7f045af1ab8e84ef
SHA256 6febcc8296dc38e006d5179e006fe4f25284f1e468a64cd283d9fd28d6147791
SHA512 50ee43a15d3124d5609fdbb961b6a45ad1e33ea16db7bfdd92e526cdb3051bd971cbad518cbf27a70c632452ff96d7da381263da0539ee0875feae145f7ae631

memory/4748-298-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4700-299-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 be9c394431596099c78e0a521c9eee8d
SHA1 7915720990a4e79f13f475e7b526d57ab32fb0a0
SHA256 c9d6b20d8dd14f2774729b8ab162e6aea728e39712f8a7b72623e38a706409ce
SHA512 be9f4bc7f546c4e95b58da0106097398f05d462dc8d03a23a74ec964324f1ef186a881477c9bc8dfc7a8c4307321cb96c36e63f2f47cf6d15207d63b170023c3

C:\Windows\System32\Spectrum.exe

MD5 4bc2b06c04c20252aa1f2c03b1b62b20
SHA1 fca4b2e84dc09c19e4d9ed6e0945d3f140a879b4
SHA256 36b039e2821569dfdb0eed2e9dda26a847901238b610a6f1da6a9c02400325ac
SHA512 40e68d6d9f6169693c8abc5a45f9aadd3ac2e45dc9b37b249ee30d410f055dfa754b345d188c8c305fa13f981fe8876faa3697c80f476ac16942203bcdb55899

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 dd0d448e5a08e03a6678af5284aba8bc
SHA1 a8ce695a6805970ac8c1c1781e18009e87493976
SHA256 9d04bf4c5bd67465db4eafb8b4da5cb06bd5871087c058e20eb8f13537f38c84
SHA512 dd58f8f64a6cd2bf8b0ee7a9fb44c77ef5e9e32c77f394e977e39c8475f93c0d5b9fc5190958972a85145eb8497b203b960b1ed08f17acb206cfa45b2c7cb17f

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 dd0d448e5a08e03a6678af5284aba8bc
SHA1 a8ce695a6805970ac8c1c1781e18009e87493976
SHA256 9d04bf4c5bd67465db4eafb8b4da5cb06bd5871087c058e20eb8f13537f38c84
SHA512 dd58f8f64a6cd2bf8b0ee7a9fb44c77ef5e9e32c77f394e977e39c8475f93c0d5b9fc5190958972a85145eb8497b203b960b1ed08f17acb206cfa45b2c7cb17f

memory/4008-326-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3764-328-0x0000000140000000-0x0000000140169000-memory.dmp

memory/880-330-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 fd2f455f51393f3566c1535840e718ec
SHA1 433432aec02073782ed65f131c9eb719acf76e6f
SHA256 e42f5d7280710eb60ca3b782f6f59fcc040a6698c28160a637f1e3b8fb030d03
SHA512 ac5bc17d19356abd993f12f612fdd93bc7674d7ad5af0fb0ad92850a4ea255426ab1eea4ad0d779feb29344af7b9bb59a61532f26f76b0eb2c6e634713c39cbc

C:\Windows\System32\AgentService.exe

MD5 0dcf47d6ecad1c1d47c88ac44d48cead
SHA1 4a6d35e582bc7b1e25d4e499ec06c17de0e6fa82
SHA256 f5855e29a75b863ff382557164d99e2c53ed117029ff341db838a34c253ed5ea
SHA512 cb23d0f039c77886edfb70341912948feea8ed4477f3912cd954883e714b4c3e0b3a7e61e78666bac52e465c05159c5ee8d347189ddda8e96d7481b896e87391

memory/3036-351-0x0000000140000000-0x0000000140239000-memory.dmp

memory/5100-353-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/5100-361-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 6da88d6fe184f4d00b5197818707bf69
SHA1 872bdd356e6a68bc286662cc8e5386430ed9b7e5
SHA256 3514207c5be65592466ece93a5a67143d321bf2133ea384103f08ebd952a583a
SHA512 e4cb9d883e13882d7d0f77d29ee511a7b36753b9226a625171fa9fcd94bb369f6b188e24ed6315780da462db439bead94d59961c47a3515ad6ced49557d883a2

C:\Windows\System32\VSSVC.exe

MD5 9fd597d6d54c15ee5a02d163d03e06bc
SHA1 30c33f2895de49f4c864000a7f1b31b2a712ae02
SHA256 dbf4aec8a3bd88d234dbd2f7dd8a1c3954c1deba5b4b29dfca92fe9555959a7b
SHA512 9371462c34bd2bee00f4ae2ed73e9878ae405f13e1f2168804a13ea28fc83882062bdaebfef895a050f00ada8ec4ed7e1890ad5b351c68e1e1ac0b3cc51c5cb3

C:\Windows\System32\wbengine.exe

MD5 fe9e9beadc628c17004cc1590b895657
SHA1 12acbc3650f4a27044940e5f5f311e03b590b0ad
SHA256 187f3fc1d4ca746a6be368873a6eb6dc73a57feb3df679d8320512233d21e573
SHA512 56d17bc1efb602a2099077f9456857392b24357acf185798d1556089bd894f6901da38909bb7f9e96f61c9d89e3ad96ba15c21ba4c4e8c0bbcebe376461c9ae7

memory/5096-383-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2508-386-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5088-388-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7df657898330e6fe1e254c091680739b
SHA1 0d62aafef4c0a966b1d92de59dd9a0f3dc49d990
SHA256 cf9d32b05175332cc051c1fdee2d00c3b3e54ff9e261a13626b867c12d6ac10e
SHA512 c4a7083cea8098a4f33ed7a1295fe6800c1525a5191f333d8634cc97cc538ab28a30334dc212a1dadc4b1c0a92593c2a2343b7d6b69173cd3bace619f3008eb9

C:\Windows\System32\SearchIndexer.exe

MD5 c4e143dd9f82f49ed4eba535be551168
SHA1 e5a4e21ac7bfbd150428245158017434cd382e2f
SHA256 be10bf0a3053b817ec179c4ef2f58aaffa924c29909394846fe5cf140916afb2
SHA512 42142b54847b46a570a1f0bc5762e92a1fcbb6ae5a08297b19b808c1a2ba5b2f1197d746ed4963597461e28b062e916ea84e96cd4f17fda10f883130dd58c5fd

memory/3856-416-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4680-417-0x0000000140000000-0x0000000140179000-memory.dmp

memory/8-472-0x0000000000400000-0x0000000000654000-memory.dmp

memory/820-474-0x0000000140000000-0x0000000140201000-memory.dmp

memory/3692-550-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4204-552-0x0000000140000000-0x0000000140237000-memory.dmp

memory/940-561-0x0000000140000000-0x0000000140210000-memory.dmp

memory/3056-585-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/4700-589-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3764-600-0x0000000140000000-0x0000000140169000-memory.dmp

memory/880-603-0x0000000140000000-0x0000000140259000-memory.dmp

memory/1880-624-0x00000258CEB20000-0x00000258CEB30000-memory.dmp

memory/1880-625-0x00000258CEB30000-0x00000258CEB31000-memory.dmp

memory/1880-626-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

memory/1880-627-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

memory/2508-647-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5088-648-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1880-649-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

memory/1880-650-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

memory/3856-693-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4680-694-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1880-695-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

memory/1880-724-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-723-0x00000258CEB30000-0x00000258CEB31000-memory.dmp

memory/1880-725-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-764-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-765-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-766-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-767-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-768-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-769-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-770-0x00000258CF110000-0x00000258CF120000-memory.dmp

memory/1880-784-0x00000258CF110000-0x00000258CF12A000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 70d5c2ff34c8c6bee81367f51186cffd
SHA1 df48b124b4f10e074e5b4ed9ef5e7b1dd7ea5a6e
SHA256 2701ad5dc3fde6ff9d4b1c8841596fd326e398b3d5883f6f8fc544829c9352fe
SHA512 e5ee74b40af5acf73bd04c3726e863201b1afb1c6af72f3eb2e6cb0a634470bfb772e8642f99448b906e82c0c984622e9092aae137c73c5db1ecffd4f40b2b55

C:\Windows\system32\fxssvc.exe

MD5 fe0bb82ef23ba91b88c48596532f3910
SHA1 593924c4ec7027d7a17613673048c592d1cd5f70
SHA256 d3c2013cc3e7456d580bae32eecfc8a182091ea8ab5096a1b137468ed26c981f
SHA512 ebf8a58e78d35dbd38c093bc7942630f56075c108aeb97371d17f80325f835a5a91fff84bc07ad1752be988c6f088fc5690bcdf6f09431e7c8a50cd0e19c6ff3

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b94c5aa3c529469560a93d0f9d2571f6
SHA1 c236f99866cb0e8aec7e6ebc4b7c4484aeec875f
SHA256 5d48e31f321345ce4c3637db8a91b26b495d724d5db2db589df49b3b5c43d7e8
SHA512 810eb1069ca989b46a24748212bb90cb99693e5ba2bd644b498abd80d1de175f18e9090b817d9a80d82683dd17741f6dcc816515793ea25d6c49b14c29e59ddf

C:\Windows\system32\SgrmBroker.exe

MD5 3496aab31300584a1a3e4151a4143ae0
SHA1 9afd50ab08dd6ec6bf02abc3237a2f5d1ed6d397
SHA256 cb9f7898371179086dcc0e408a56d9eecc70aa7d616e08dce626160f6fe99539
SHA512 9656a8846b96b7b914c6cd5b48383c9ccdf211cfa8a2fc6ff437a8c3c54e4c7102843a7d131638f6363752b8e9fca19b99db54bfdffe57240d37a73a02973b1b

C:\Windows\System32\SensorDataService.exe

MD5 59b1ee8e4edd38e244b2758909451345
SHA1 4be12a6340bbd2d3c7a11a6b7f045af1ab8e84ef
SHA256 6febcc8296dc38e006d5179e006fe4f25284f1e468a64cd283d9fd28d6147791
SHA512 50ee43a15d3124d5609fdbb961b6a45ad1e33ea16db7bfdd92e526cdb3051bd971cbad518cbf27a70c632452ff96d7da381263da0539ee0875feae145f7ae631

C:\Windows\system32\AgentService.exe

MD5 0dcf47d6ecad1c1d47c88ac44d48cead
SHA1 4a6d35e582bc7b1e25d4e499ec06c17de0e6fa82
SHA256 f5855e29a75b863ff382557164d99e2c53ed117029ff341db838a34c253ed5ea
SHA512 cb23d0f039c77886edfb70341912948feea8ed4477f3912cd954883e714b4c3e0b3a7e61e78666bac52e465c05159c5ee8d347189ddda8e96d7481b896e87391

C:\Windows\system32\msiexec.exe

MD5 8344dd6b74f7fedea218e06d0f4ce975
SHA1 cda992fbd6f65c18949252401ea97fea728c873c
SHA256 6bebf9d68752ae58a481e58727188d02fd7703c009df386689ab42d9614be9a2
SHA512 642d3efb9cacf36039063b57cd643172c547de4094c8d45c50751d912f8fe076773ee956025aa1fe181c6783136cfdc34eb1bbcd26b63fb352bc82a14d4bbe16

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 0eec2a955c8914f0dff5e66a26b3506a
SHA1 5375c3acd66433b009605fd2fc593140ddcf65cb
SHA256 329382b2496cc79b16d82d2913e7e2a4b8d2c7722c3bcf95f0485cab7521a07c
SHA512 5c27760736a08fe4a75076376a70e2fffb6f386cd326823c91e928f9743501ab9ff631cc6e623697fc599aabc3248b387b8d82540ab2d7928f78267f4cd5de1d

C:\odt\office2016setup.exe

MD5 91d6e82700172c9204960f6333a1d76d
SHA1 1201b9b5f5363f25041bffa9bfcdf32fd2b74c79
SHA256 033dda7bc5daed5fd1f2d53dce8a4a9b0c716a9ec1cceba577f2ba91cfe6f094
SHA512 ad0515ca7438ebb4e406d48ea40f3fbb68445597b69f69119854ee56d2eb48c0f838ae01935d0fe2ad56c08a485908f0cf1587681a63a230abca751a4d14d7a0

C:\Program Files\7-Zip\7zG.exe

MD5 ff6ecb4b6b08da8b2d50929e322e581c
SHA1 094cc99fa304267a260207e45b19561d83e07cf8
SHA256 589c2eaaf69dea6adeeb2dfb4dc7ee73a35bc67f9e61f1d2bc6a4809aada5b5a
SHA512 c714c754ee43cd5c8bb517343723e250a8c4308056943a2e4833165a567b67e45410c34cd152eb04912956dec96ec81ae7fe44804d313d2100c68b7c5ccd64c1

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 8887ca3bbc1e90c2b596b343ca1365db
SHA1 2c3c45159630914ed58bdd5d4e44c826f5798601
SHA256 c67ca75726ac3e3dca8499d18c6346790a4fd8ce67a686be1259760e79660290
SHA512 b3dd81a5139b42fee5b9be5d4f10b3219bca6466d636821a88ddb9a12262a8cf21102c20cf5b87dd66fb0c9654b6451dcdf44460ef015f83d5b5a6d6128dc495

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 95f037720c7fb5bb25349a0f8291ba7a
SHA1 4e84d18af1d01491052911953cefb4725bfca272
SHA256 2ed80f6cf7d5ea82825d7d0b8a831b9d63525b970b6fa3f2236261c7b062f3ff
SHA512 70364df78c75460b4f91b0fc4cd0154f963c43cdc8ba38631b6af5aa0191df189db2afa000c3820b924a2f8633ef0aab00ceee73f5821338cd640e8699fe0a72

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 777cfbe8fae917dd0ef5cbe0df3d677c
SHA1 491502b079f6140bcbee36af116042dd6ae10c4f
SHA256 2c2191856260dfea87d18cff83174dbb70f0d374a3bdf9c93e08d84ed9ac1810
SHA512 cef4ff2b0856e8f14fd74220c757bf1ff8dbc7bfd103a23d52267a02bbae6faa01a63f06c31eadbcdeab01a594b0428a6a269da75761f6eec0909a45b9d9c2e8

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 eda27d31bae54897b57f0f5106dd7c09
SHA1 7dac90a397dcb2ead92fd21d0bc2338c836b74b7
SHA256 44aee06ee8660f6e9dc9046e3d2835f45253459edecb6e59072267370faf59f6
SHA512 17b3b760d5308f2993e2fbed620d62b4f71ab620c4ed68d42dc196d7e03f3a625a39eb96d12c4b398cf8aea04a35da8c7165d2fd3da34ddf60a24230c95f75f6

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 567e3ee2c329a3a1a4576b03c09626c6
SHA1 1fbca243368f6b95ff61d3beddfcdd8a9a127376
SHA256 173d221cb60082b9faf16007e8f7189f747d468e5ebd8ccd1bf07fb8a5a25cf9
SHA512 9b932d3096cebe16807deb3629e4d5414ba578dab05753476e5c3e4d93301914ed25932fdaa4f1011758411acdf5ae97bcc696984c1668c7f0447c6c5510a3ea

C:\Program Files\7-Zip\Uninstall.exe

MD5 94db990619fb7326f77cfe8bfb1e8552
SHA1 85e06095d15926fcdd9020850a74196a1f12e095
SHA256 d99d5300d27d8f766ff5a23a38d1ba2688c075c6ff7bb814f1a355b6c430d83b
SHA512 fef9b2b139f66136e5cc60a531dda4039074b584bea36ae7ed6ba8c752e7831a4ba089c25ad72a5e65e6ec197fcf55e1319ac097eedb3a9dedfeafb7abf24f83

C:\Program Files\7-Zip\7zFM.exe

MD5 e5b30b6322e5c75ed16629b52e3ef0df
SHA1 1b42266cf3c576c396b4707ab327576cfb181871
SHA256 2d0ce75d309379d7b1661b84f7566a64f2f0e62dded2e7abfd24ce4da0089281
SHA512 83e3446d993b81cb355f479f6b67f28be9feba18a63cae6df7f2fe75f5df81a34acf635de0487c13df9c456ae726f91c9711e210842d3d2709fe6a3557f91b14

C:\Program Files\7-Zip\7z.exe

MD5 5e7376fd134581feed0a63832ec6e4d1
SHA1 c02bc913b6cff4d402e49ea5c48af650e7f372d8
SHA256 72e249ef45444b1632550e662e8d77e15dfdcc4e77ad7aad8d9e3030711e747e
SHA512 f41b8ccc9563605f70c725cb3024e589e96060c26ca423fb5b8f72f1c65535eab6d1fabd606ec4f0fe37d75a129eaebd80cc873e8e240b2bdc15284ad4bc688c

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 20e8e26338e86f9040203a2d238c1345
SHA1 028447b25cbfcd813e5c8cd2d6f5b8b9f32e36c4
SHA256 9c70623b7591222446556d4ec106fd7fb3b02d72caa914697c03934549641c2a
SHA512 0034619c7eab655c85aa6c833d77b52fd94226615e654261bc4ec973e1dde6ad3da49d9d4f5cd202d375b6557fc7ce87b1fd43b3feacff090c91b3d3ea8ba7d5

C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

MD5 11c40a5c8e2bb68b185460c7f72afba1
SHA1 32531ed86317fcdd6a4027fd1ad118b3d720b063
SHA256 89ef8072d810210dd4f7ad9a33b73ea59fec5fd6cd0d5ec907ec7b8cae747fa8
SHA512 fbe9fc67b2975a2b83873109e60f0624312a691da695f7528b7aaf5504dd8e0da675544dab9380864cdf97dc14a9014a4a391fb84ec869bc90f4c37f212478ca

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 2d443c6d4992228d88a98f5c7bf0d0c4
SHA1 a168a0e6a18abec7ebd7964b6538dd99d69878c8
SHA256 e0ec5797eb90c56cca7f77475ddeb9155b99260c6d2927709dd0e27323c35cad
SHA512 57c532d7e0dbef56fddfe18ff752f5d5e938cd2b1bf793ab085a573a023d81ea6b8d6acea71112503e14c0609fbb296520d0411bcfff82dbdc00790c1f907479

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 b2852c59dc2b1566d010d75491b8c1cf
SHA1 6acbdf9f73362d9bc3905b66c9210a0b9c1a0aca
SHA256 67680e74684d98a9d364f83f1fddd62c8f8a731e94e7bf878c93ddb5a8bd294b
SHA512 fb73ef88a8c11d2f17d20ad8f9fc7798a198a32d38aa7d78a6fa56103bfeb017cbb302f20f49111ef23ce7145e1c195bc751f7dbf0d2b44b59cf6993012242cf

C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

MD5 7ef1800cc450b1cfa811c80b99a8050e
SHA1 7eebf7486407292b33bf14cf71b4753675be2a26
SHA256 9deecc40901b5604f3f63555351e1058f83ddf0f77e76d017a0dd126af0eca60
SHA512 82c9e0322523e42d44c51eab1eef10abfc775e981d9fe9879c6bcd1e776608517a63db636385c0109cfe4316961bd438937d91a36ce6cd41b8fd6eadb5350ec7

C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

MD5 816ce586f0b6ecf6bd65312b39f40210
SHA1 97765e19d61ab0e27faab47637778b5d7e8b52d2
SHA256 5683535dfab20f36f8a59de995595e05f29fd042cdf6b4303207d805145460b4
SHA512 c2551a1c696b9d5ac295a3942c389cb899f4a3caf6b73ee232bc49a508d6c1def3d63fbade3fb2628fe4ff2672030c1cea627682847a2ebd822d035898b30dcf

C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

MD5 29a2afdb608a7590b1693444f3cb6d42
SHA1 49ce62766e4c1dc03c1d6d955dfaa53b10bf41a6
SHA256 de790ba0527a0a87267078be88cdf18f8062a288841322a678b0690aef740543
SHA512 2912ee7b3b46e7b084cd76edfe5733667eb446fbe86627fda66827f447ccb9789876bd16b6b1ea5315e39c28774091b5e0ed991903789e243c747473650032cd

C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

MD5 94da9a766ab83d9cdec468e7b84359fb
SHA1 7c5d82e72a82c570d24134af73ae3f8ce360a50b
SHA256 f49ac651894e4aac69f54c95641b5058b583de4b4804b4466ed2f8a56b836151
SHA512 19850d9cbb9aa78cdf38ae19429410a1080d018d41c2623f3780e68124587f19c11b55a97f92f5830676408a9def9323d3bd6490b50feb4c3a55814a066014ea

C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

MD5 597f3c6f75645cb7bac8adc2369bed8d
SHA1 06a1f79f6fd8f38c09d49f72194bcdda4d4ccb4d
SHA256 9be714cced807d50d857c354002b4add71e5513a18048dc52a80808354fb9878
SHA512 edff62df39c674cb0b80a7113a031b8da0190efa6d7e49fde6b1bca647ee8ea46b82eca09dc9435e5a51ac090f3eddb247aebf9933dfccdad92cdcd162962fbd

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 cd5a48aff9b8454cdecc506b09776c6c
SHA1 999ed3796d7b8f2c394c2fa421fa6c3d1cb4fbc9
SHA256 b6c8c518c05cb864e94ca3f9a3e135388479af5415cc61f18f548c4cd4a6a190
SHA512 bb1f62abfe321830051512ef0a8e2a5d8c23109c4f73bacd1ac85da4734320492c1145a7742bc02e37543369a8a342d31eeb1f78e17d59ad25b1c7b1236d4b38

C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

MD5 392827f520bd2034cb6f278c028a12d6
SHA1 6ed31cee67ce53390590d2092e098001f4996b99
SHA256 c1f61d06282570a44a02fa69ac39981859273817860e141600d4ba7598987504
SHA512 54dc3e7cf331aa548bc0599c0344ef79090fdc62befafd72d4ad4e98ab58a9d437828e4147ec39c2993c21fe0c2b480aa44725405ad571f8c12243cd7c203429

C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

MD5 711b3e744241c45e8d176ce18cfea3cd
SHA1 c764838484526d082a14a9779adb5c7804ba6cdb
SHA256 33ae22b3194ce46b49fab753377af1e203562d12b25cd0b07a927489b5ead9d6
SHA512 380ec4424dc4a92133da39dcc4e6fdefe95b47434b85aa0016aca1d5eeec9bc4c8697960d0ee7128f867886f9084818458aa94aa19947c5dfa86cc355d7fe55c

C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

MD5 ae942686c44c5c33ba718e3437cd1451
SHA1 0a2edc947f3e4df02d88b0243d536fd889206897
SHA256 e9a4b08ad554125fbd1d5f23e781749af88a392f28e9cc95c490da5cc83e1359
SHA512 e25c153ef6167ce7f41a67a7586529ec9fdd9b33ae7a3b9c786f1cd354dbb149306bd5375c0c4e0a06f46e7c0e8bb20764a8f6f526bcda54bb683d5a0516dd05

C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

MD5 7039172175b7335c591aff1d8a0226f2
SHA1 6f5dada2446cc92deb53e5a41148b09c01dd9a4a
SHA256 c1ada1c97056e8c70466bb464f20e4fa8721ba80f2636f2689b9c676fb042b67
SHA512 5a8a363264d740acc6b049e3e6f1b9d1d5e1cd9ccbc7c231fb3780b9150a0db96935e5e4915b34ef7204834a35f87c160711c191423a5f4fcc1fefd8c3fec252

C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

MD5 967e254f99a53826def96194895037e0
SHA1 0afeeb11b6209eb4c8c1f48f105cd55806f1f14e
SHA256 0e768bd1e944b925ad20af1224354d21e2509c69ccd81ad79e0f2bc6311ceb6b
SHA512 f6e06b20f6147d56120a47bbdf9ec834dfaac844ad9e027c00114a0cc2470abf908662486b218908dbc06779f2b7258df9814942ff2f35a93e0d17c456acf032

C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

MD5 e19280bf226bbe9024b677278fcfb0d8
SHA1 acaeadf29b002bf80eea8c722b15ceddee7a5841
SHA256 10d6f621948853475d2708701db1e3b32b9d9e037f6d6d5ebbe2213bd165e46b
SHA512 07413ccc7bbd6a07c9a0dcfa23a255999d236894fb9da0aa29e1a15d9aa1f1e50cc19b98087f6fb2b951209995d22cb7b5064f0e796faaeed9f4decfe196561a

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 168aab51c11c2f7976ebf6af42c304b7
SHA1 32b9d257b94b1d73f051082686d83bda7af3d573
SHA256 33235e1370bac56355e6f55f8b45d524c225bc46e9367055938e5926914bc3f4
SHA512 11caa650e7988249b19c00395c40664116d395c3ad9c12204709a750a808832e2e000b2dceb2fd1548e3c373169cbc002f6310ecddd1968f2e0bbf6ef1abffb9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 b2f0171bf399a6e76409425cda7fabac
SHA1 278096f7f56f0efb19b700d9a3a4c86dbc01d5f1
SHA256 052d9e1726c589462c6c3c76fc18ba35f1159f7ef431fc9441f639cb320b4919
SHA512 f171bab52eafb200c82d0ee6ebef253358d6aad65bf6ea7c81d7c6f9ed8f038671ddf6ff35a8ee2c2880676c49ba106b9be6d4a2bbf6f4eea55c886246549c5a

C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

MD5 89385c32bbd3ce2c7a392cd15874665f
SHA1 855b4027c3e9d63519343b79a9bf50616ae4fd4e
SHA256 4b6e434f90338b52221c404a9424c48417be2c0e00308427775a1beb994375be
SHA512 e5460f165891e9ebe8adf647e203e2cbae28f7409f1985b786c63c1650fb8ce2a76f89badb34bab11168264e8efb3f39d549c58883cc5e7868b54e8d68da7cc5

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 1c1c2116684e5aa0229a77e8e972a207
SHA1 eeeb1b93455a7c6b79de65754ae2778565465ab5
SHA256 3d1a36c02f58436cf4db7823cd10af8f18146621d4e1f3e419b5282e45247780
SHA512 34642291e602ffefefa9fe054d677e6f36c5ffec74e83fdbff7495f0331820321d34e0301d6a81251e57087cc12efdf8a43ca6f8f10725a0e4073f439506abac

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-26 10:01

Reported

2023-04-26 10:03

Platform

win7-20230220-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fb292096decfa14c.bin C:\Windows\System32\alg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1932 set thread context of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 584 set thread context of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A9E39C3A-7444-443C-87DB-BA699A7FD93E}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A9E39C3A-7444-443C-87DB-BA699A7FD93E}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{49DAE755-12CA-4DA9-BA07-C1818B7F3D3F} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{49DAE755-12CA-4DA9-BA07-C1818B7F3D3F} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 1932 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 584 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 944 wrote to memory of 2192 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2192 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2192 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2192 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2488 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2488 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2488 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2488 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2664 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 3008 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2224 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2676 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 944 wrote to memory of 2236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe

"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 254 -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 260 -NGENProcess 248 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 240 -NGENProcess 264 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 23c -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 26c -NGENProcess 264 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 260 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 24c -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 250 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 23c -NGENProcess 274 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 23c -NGENProcess 274 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 240 -NGENProcess 24c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 258 -NGENProcess 284 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 24c -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 268 -NGENProcess 250 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 28c -NGENProcess 284 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 25c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 240 -NGENProcess 284 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 238 -NGENProcess 180 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 238 -NGENProcess 240 -Pipe 1a8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 29c -NGENProcess 180 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a4 -NGENProcess 268 -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 158 -NGENProcess 160 -Pipe 16c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 158 -NGENProcess 1e0 -Pipe 1e4 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 udp
US 173.231.189.15:80 tcp

Files

memory/1932-54-0x0000000000C70000-0x0000000000DEA000-memory.dmp

memory/1932-55-0x00000000002B0000-0x00000000002C4000-memory.dmp

memory/1932-56-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

memory/1932-57-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

memory/1932-58-0x0000000000410000-0x000000000041C000-memory.dmp

memory/1932-59-0x0000000005860000-0x0000000005998000-memory.dmp

memory/1932-60-0x0000000007D80000-0x0000000007F30000-memory.dmp

memory/584-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/584-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/584-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/584-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/584-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/584-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/584-69-0x0000000000390000-0x00000000003F6000-memory.dmp

memory/584-74-0x0000000000390000-0x00000000003F6000-memory.dmp

\Windows\System32\alg.exe

MD5 3c7e030f6ccd32167f8287e71d186db3
SHA1 8a0418319af476904ff71d9e7017acad12a8305b
SHA256 45779d4b782f1d056068f447b71db4a55a8c7c5fcfa7687e0d99979d44f2b988
SHA512 6e7c9da5dddb1c167d2f23721509f9ed6c1a8a18095d856d2a48ef7b0b8d27584e4c480fb36a32a529a3db69ec3c7619a86320fc643c75b2dcbbd83f8c69c424

C:\Windows\System32\alg.exe

MD5 3c7e030f6ccd32167f8287e71d186db3
SHA1 8a0418319af476904ff71d9e7017acad12a8305b
SHA256 45779d4b782f1d056068f447b71db4a55a8c7c5fcfa7687e0d99979d44f2b988
SHA512 6e7c9da5dddb1c167d2f23721509f9ed6c1a8a18095d856d2a48ef7b0b8d27584e4c480fb36a32a529a3db69ec3c7619a86320fc643c75b2dcbbd83f8c69c424

memory/688-82-0x0000000000290000-0x00000000002F0000-memory.dmp

memory/688-88-0x0000000000290000-0x00000000002F0000-memory.dmp

memory/584-91-0x0000000000400000-0x0000000000654000-memory.dmp

memory/688-92-0x0000000100000000-0x00000001001FB000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 ea58bf7eeb393ffd38e034ef98783f02
SHA1 d8eb5efd0c9179740318204045edaf48e6b6033e
SHA256 3e90d65b75678d3e9a4c5641351dd44c9672a648acd7ec094948c5944b4aa0d6
SHA512 417866e6ecf1b79e0ace98a1a218ce9d9fcfd94460a3e000d96430f58380e0b5169de04f3acedceea5052f3dbcb85b95bf87ce11b43d938cc9dc6a3dc3bf3a2e

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 ea58bf7eeb393ffd38e034ef98783f02
SHA1 d8eb5efd0c9179740318204045edaf48e6b6033e
SHA256 3e90d65b75678d3e9a4c5641351dd44c9672a648acd7ec094948c5944b4aa0d6
SHA512 417866e6ecf1b79e0ace98a1a218ce9d9fcfd94460a3e000d96430f58380e0b5169de04f3acedceea5052f3dbcb85b95bf87ce11b43d938cc9dc6a3dc3bf3a2e

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 52ec3a435d7d46646c3f028c7b21a4c2
SHA1 7a96f78593e2915b4e544f05b04488eb4d64fca7
SHA256 87d3c1a5062758793ac6233b4d79f825fc82de202ce1b58d7839e25515fd469c
SHA512 b12be859ab4a2f6465560adffe6ae6869a43f7d3713d8fce6313bd510e813e0263d6280edc73cbc432a00293234aec0e6bc2d08e2237d65b5a7ab0fd3697710a

memory/1196-100-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1196-103-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1196-104-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1196-106-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1196-108-0x0000000000090000-0x00000000000F6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8cba969299f7d9744f38f0969ddf607a
SHA1 427ff4433415f4953209910dfe5a66a7b4057096
SHA256 6e47fedf1d2bc39c845185df1611145f7fb14b944a29f7d4fcb461ee74d6ddc0
SHA512 202b5b716b84da466b85953aef693305dfcbf3f7726ea9d730fbf913a1c625f6eafd25a307d7599679c98027388b2c4f1a9029be7565f98f7785be528981facf

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8cba969299f7d9744f38f0969ddf607a
SHA1 427ff4433415f4953209910dfe5a66a7b4057096
SHA256 6e47fedf1d2bc39c845185df1611145f7fb14b944a29f7d4fcb461ee74d6ddc0
SHA512 202b5b716b84da466b85953aef693305dfcbf3f7726ea9d730fbf913a1c625f6eafd25a307d7599679c98027388b2c4f1a9029be7565f98f7785be528981facf

memory/1196-111-0x0000000004C50000-0x0000000004D0C000-memory.dmp

memory/552-112-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1960-113-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1296-114-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1196-115-0x0000000004D50000-0x0000000004D90000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 52ec3a435d7d46646c3f028c7b21a4c2
SHA1 7a96f78593e2915b4e544f05b04488eb4d64fca7
SHA256 87d3c1a5062758793ac6233b4d79f825fc82de202ce1b58d7839e25515fd469c
SHA512 b12be859ab4a2f6465560adffe6ae6869a43f7d3713d8fce6313bd510e813e0263d6280edc73cbc432a00293234aec0e6bc2d08e2237d65b5a7ab0fd3697710a

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 7acc9b4a4114341a958b6e9ef03516e4
SHA1 45ff5f6504626dde6b8cd442a9c55d3d1ebf5d95
SHA256 ddd4dc8b2361b4a42153b7c6e455739fb7be33f71ac91110473eb21cb1b60d0c
SHA512 fedc076ff066da70891101ea4dbf50cdd6cedfff5cf4b7fcf4d0031459359d823597a99987325be8f516196d74f16052ce8fa246d9b2358db595362f97c0b392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/944-124-0x0000000000B30000-0x0000000000B96000-memory.dmp

memory/944-129-0x0000000000B30000-0x0000000000B96000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8cba969299f7d9744f38f0969ddf607a
SHA1 427ff4433415f4953209910dfe5a66a7b4057096
SHA256 6e47fedf1d2bc39c845185df1611145f7fb14b944a29f7d4fcb461ee74d6ddc0
SHA512 202b5b716b84da466b85953aef693305dfcbf3f7726ea9d730fbf913a1c625f6eafd25a307d7599679c98027388b2c4f1a9029be7565f98f7785be528981facf

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 ba765aa215532b33ca22acd20827ae8d
SHA1 283b7746102b2a82eeaf7172cf789c88ba8cc4ee
SHA256 9056509a6a3d47584c3af8606b465fb2930eb40a624b0b0ec81f0caf03fd14a0
SHA512 ee6128f663deafdfee948779c13238896297d7503aff079f1228fa50a1a24d94035ace920b7d7c54c8f8bd067afdc4b37f93216f195c00bdf49dc5ba8490de7c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 ffd2da7d6175a96858fa1772754dcd9a
SHA1 c1123736fad264f2c556d19847ef31ee4839b3f6
SHA256 2a9165d9e272da5595780dfbdfb990c702c62e624798e569d5031df68deaea46
SHA512 662afd1b39cc4611c712c5d8a8df812747dd6c50add4aec9a5cfbd1f07dd44832f2f89440461d057244fcf6e95dd0016c23d800f8f1de969d1a7a88bbb5bb608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/1204-144-0x0000000140000000-0x0000000140205000-memory.dmp

memory/944-145-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 ffd2da7d6175a96858fa1772754dcd9a
SHA1 c1123736fad264f2c556d19847ef31ee4839b3f6
SHA256 2a9165d9e272da5595780dfbdfb990c702c62e624798e569d5031df68deaea46
SHA512 662afd1b39cc4611c712c5d8a8df812747dd6c50add4aec9a5cfbd1f07dd44832f2f89440461d057244fcf6e95dd0016c23d800f8f1de969d1a7a88bbb5bb608

\Windows\System32\dllhost.exe

MD5 aa19b2c4254cf28413843674829c424e
SHA1 a5e5c89a4bc3c68f2baa6c090a06c122bc61dbae
SHA256 c6f5ea6e76f4736a72294506de5e6f86f4d29da3070625f8fdbcdf2939e0fb1a
SHA512 0d6c3042a2b8b4dab543a8a8440d1d988702131cb4e96337758bc3c738fb2ed20a1abbd67d52c6bbcc580461f9e99c6d5d28be14816ecb4650d72c996b49f977

C:\Windows\System32\dllhost.exe

MD5 aa19b2c4254cf28413843674829c424e
SHA1 a5e5c89a4bc3c68f2baa6c090a06c122bc61dbae
SHA256 c6f5ea6e76f4736a72294506de5e6f86f4d29da3070625f8fdbcdf2939e0fb1a
SHA512 0d6c3042a2b8b4dab543a8a8440d1d988702131cb4e96337758bc3c738fb2ed20a1abbd67d52c6bbcc580461f9e99c6d5d28be14816ecb4650d72c996b49f977

\Windows\ehome\ehrecvr.exe

MD5 4bdad37bc1d65dc8fa36358489e442c9
SHA1 c9ec24aacef15aca03eeda8eddd0e1fdb75c8715
SHA256 89d2e36e0ad0b5cd0f050e4ac5ae57b5b82ee258192c507d26bf5b938346a15e
SHA512 40d78972fbab0ec3c3c099ad69dfb2971a6847b9bf3ebc794e3b466b322b20a61e0007dd7a37cffebe96b99814013c69283e94e3d0775ca426e7e1a9b218f1e5

C:\Windows\ehome\ehrecvr.exe

MD5 4bdad37bc1d65dc8fa36358489e442c9
SHA1 c9ec24aacef15aca03eeda8eddd0e1fdb75c8715
SHA256 89d2e36e0ad0b5cd0f050e4ac5ae57b5b82ee258192c507d26bf5b938346a15e
SHA512 40d78972fbab0ec3c3c099ad69dfb2971a6847b9bf3ebc794e3b466b322b20a61e0007dd7a37cffebe96b99814013c69283e94e3d0775ca426e7e1a9b218f1e5

memory/700-152-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/700-158-0x0000000000170000-0x00000000001D0000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 76febeba47c027ace54d1bd13f415b4e
SHA1 bbf79fe42eb662769db596c7af951d656c8535e8
SHA256 24200cb43fe988df6c8f8a860656141eeae2c3337c917ed2d9df90c79d69b4a4
SHA512 3a3ee3b345a903ecd0af708d0752d7f60e04ea1589663eb9d277726cc0fe71697db83458fde7aebfda44a2cdec3a866d23f84fa11a69ef21b07760b36b80290c

C:\Windows\ehome\ehsched.exe

MD5 76febeba47c027ace54d1bd13f415b4e
SHA1 bbf79fe42eb662769db596c7af951d656c8535e8
SHA256 24200cb43fe988df6c8f8a860656141eeae2c3337c917ed2d9df90c79d69b4a4
SHA512 3a3ee3b345a903ecd0af708d0752d7f60e04ea1589663eb9d277726cc0fe71697db83458fde7aebfda44a2cdec3a866d23f84fa11a69ef21b07760b36b80290c

memory/1872-164-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1748-163-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/700-167-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1748-170-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1748-172-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/700-175-0x0000000001380000-0x0000000001390000-memory.dmp

memory/700-177-0x0000000001390000-0x00000000013A0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 aa013ec815b08b272de6c7c646a6f3f6
SHA1 03b413b2fac24bcc6733a24dc52140752629df87
SHA256 d03b18d06aa340d17fbb1d56385da566aa3f573f2197e7f5eaf222712a076e2a
SHA512 d4895aaec9fe50c7d210328e56d53f8b674973a3305427bc4e0b985866ccd706936f2adc00476af0fd8b96658d1fc9ef363524a2a342672e4434aa11fd022ce7

memory/576-179-0x0000000000400000-0x0000000000460000-memory.dmp

memory/576-185-0x0000000000400000-0x0000000000460000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 222242eb7214c329db778b058fc260bd
SHA1 72857f84dfd143f634eda0da8eecde65a174015b
SHA256 a1f6be00b4872e95b2322068469464407faa407315160873e205ade782d8c572
SHA512 4b2b052953d9b8d8744f79b4d1ff6bac9038e5044225cb4d49f9555dbd7c99c0ba26c2e6339d1f297fef702732e414a834a9bdefb691574557cb9d1698726282

C:\Windows\System32\ieetwcollector.exe

MD5 222242eb7214c329db778b058fc260bd
SHA1 72857f84dfd143f634eda0da8eecde65a174015b
SHA256 a1f6be00b4872e95b2322068469464407faa407315160873e205ade782d8c572
SHA512 4b2b052953d9b8d8744f79b4d1ff6bac9038e5044225cb4d49f9555dbd7c99c0ba26c2e6339d1f297fef702732e414a834a9bdefb691574557cb9d1698726282

memory/1724-190-0x0000000000160000-0x00000000001C0000-memory.dmp

memory/700-193-0x0000000001430000-0x0000000001431000-memory.dmp

memory/576-195-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1108-197-0x0000000000BB0000-0x0000000000C30000-memory.dmp

memory/1724-200-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 06e6f8de1f8d20c94c7a6786d073628f
SHA1 046c9b1b4c712c1bfb2a5a769bd0e7332f4dfa84
SHA256 39cebc8707794d9b71023be66eb5451c9a56c8fad37a16ea95be4d9dfdd6ec44
SHA512 ccc7e4ed5b8925937d8bdcf25e7e8a0cc39a2aa303463d9d4bfaa7ab1d14e5176834fc95a58f0833a6c7fe0f55a7748b00a92b7f6902636c3384ae65524d2d68

memory/1108-212-0x0000000000BB0000-0x0000000000C30000-memory.dmp

memory/1612-214-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 389a8b29ca013cc1dc1d12870922586c
SHA1 5121cc3ce2c8a86acaeb5d683cc620bcc3ae1e3e
SHA256 a0d1ac222ded9f2eaa5f0cd6c76e80c42e0c9ef9dd19470413b5123c437e6e60
SHA512 6d6a27bad57aed3193f74d4f6ccc0b9ab2279ca72e17752f15f7cb920bc2530f34ae255ba7b380a69b545029d83c8f429f56cb307b8a99d2a0fb3299c4c0c1c3

memory/2092-223-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

\Windows\System32\msdtc.exe

MD5 d25b773eded8f2d7a411c018936b2bd4
SHA1 fb32d71a8609603dfd979de9cd55c0cd298b6b78
SHA256 6e757238f564fb1f7cdea00321b7674713c935786d9be0a0cd3d6ae76e6aee48
SHA512 5d13bb275a991efb9ca919e4fc2f1efb5d3320eea7dcf81a2868cd9ff1770d0d5e566ea3b277a78e4269186a223f7d1dda532626b8b475e914def0e7ce077835

C:\Windows\System32\msdtc.exe

MD5 d25b773eded8f2d7a411c018936b2bd4
SHA1 fb32d71a8609603dfd979de9cd55c0cd298b6b78
SHA256 6e757238f564fb1f7cdea00321b7674713c935786d9be0a0cd3d6ae76e6aee48
SHA512 5d13bb275a991efb9ca919e4fc2f1efb5d3320eea7dcf81a2868cd9ff1770d0d5e566ea3b277a78e4269186a223f7d1dda532626b8b475e914def0e7ce077835

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/2092-260-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2192-261-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 c7c76ac715849d0e42d0514789af9df3
SHA1 1debac10863469a6ea6ee959aaa33bcd26ea1e30
SHA256 9fabfe6aeb80e030169264ef64db1447cb9b30be8b9595b08c227e3081507472
SHA512 f5d53391c5c4f567a2531cd4349d86c9c9978fd4447a86df29c32c491a04e9fb404897c5fe6a4dbb9e456710be9e0352efb25067d6225432362ffb8bad5dc541

C:\Windows\system32\msiexec.exe

MD5 c7c76ac715849d0e42d0514789af9df3
SHA1 1debac10863469a6ea6ee959aaa33bcd26ea1e30
SHA256 9fabfe6aeb80e030169264ef64db1447cb9b30be8b9595b08c227e3081507472
SHA512 f5d53391c5c4f567a2531cd4349d86c9c9978fd4447a86df29c32c491a04e9fb404897c5fe6a4dbb9e456710be9e0352efb25067d6225432362ffb8bad5dc541

\Windows\System32\msiexec.exe

MD5 c7c76ac715849d0e42d0514789af9df3
SHA1 1debac10863469a6ea6ee959aaa33bcd26ea1e30
SHA256 9fabfe6aeb80e030169264ef64db1447cb9b30be8b9595b08c227e3081507472
SHA512 f5d53391c5c4f567a2531cd4349d86c9c9978fd4447a86df29c32c491a04e9fb404897c5fe6a4dbb9e456710be9e0352efb25067d6225432362ffb8bad5dc541

\Windows\System32\msiexec.exe

MD5 c7c76ac715849d0e42d0514789af9df3
SHA1 1debac10863469a6ea6ee959aaa33bcd26ea1e30
SHA256 9fabfe6aeb80e030169264ef64db1447cb9b30be8b9595b08c227e3081507472
SHA512 f5d53391c5c4f567a2531cd4349d86c9c9978fd4447a86df29c32c491a04e9fb404897c5fe6a4dbb9e456710be9e0352efb25067d6225432362ffb8bad5dc541

memory/2244-266-0x0000000140000000-0x000000014020D000-memory.dmp

memory/1108-269-0x0000000000BB0000-0x0000000000C30000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 0a8d9251f9273cace3bbaea300d0fe1a
SHA1 e43d3119db970f41102157bb7fc67aaeb2c40179
SHA256 82b58746ea5e8e036422819cedbf0939734fd02b4271f7c81d4cd587ae33aece
SHA512 621da37e405a95eabbfc03a4ef7d4df30ce678fa90153e75fb39f335a0b08edd20383c5a47a07a190e072e6a79fde4817a7f74e74edfb10e65ca532c62d34c15

memory/2192-287-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 ce9c9557cab74040d2739e40baed6564
SHA1 176901f7b4429c7be75062c382f8dca7e4625dc8
SHA256 5b0b64a8a4861eecf58718b86619ab01dd53ef61f908426aa34e747544e90d2f
SHA512 a34f77be23ea5a56a0bc50e0c5f8fa774ce3dc363713f01ec8ec0bb72c1352b3d363785cd90348074bb9a83829a06d4b492d06e517ec8ae470e242c3dd39a06f

memory/2488-297-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2596-312-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2412-313-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2412-315-0x0000000000580000-0x0000000000789000-memory.dmp

memory/2700-317-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2664-316-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 512afc353e46c5a07ede60838d70ba59
SHA1 85b9a4225ba9658eba77cede5013e1bf7f82e5e8
SHA256 74e971b8c12b3d20c6dea6546cd6d33b7682b6af706ba6d218817cb088edd3ad
SHA512 6d4c99d03ebc15642ee15408cc9970749ef24fd7964fed9f736cf1710c8bc7fc18738d14b899cdd6577811fc8129fce2d2064ead0352bb1c54cd14bbce108412

memory/2664-323-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2884-332-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2908-331-0x0000000001000000-0x00000000011ED000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2884-344-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\Locator.exe

MD5 9605c18ae064b269f3f5ad120a8921ca
SHA1 aff599e047c69a021b849aa1e9d27111ecb3a646
SHA256 c076ce6593ad9a1c87a81c5722df8a92b92b2b4344649e5ee45fce335c815437
SHA512 2e80bf0c53d85f9d3d1165355ab74b16920633e913cb8d134a2fc33ceb9ee16a19d9c7689f8928ad27543a6bbb4a8e7494414b2c7827b526be3091f3796a3184

C:\Windows\System32\Locator.exe

MD5 9605c18ae064b269f3f5ad120a8921ca
SHA1 aff599e047c69a021b849aa1e9d27111ecb3a646
SHA256 c076ce6593ad9a1c87a81c5722df8a92b92b2b4344649e5ee45fce335c815437
SHA512 2e80bf0c53d85f9d3d1165355ab74b16920633e913cb8d134a2fc33ceb9ee16a19d9c7689f8928ad27543a6bbb4a8e7494414b2c7827b526be3091f3796a3184

\Windows\System32\snmptrap.exe

MD5 fc8dd93ab4d72f29ef5415caa44b3964
SHA1 b0607afefcc99077007a6b4e4c4f4f7d583c0a25
SHA256 c9e66661cdcbf4654a6b6a801a26a7d79f5a681d86652f5156144404b0ce9888
SHA512 70048510589bbe3692ec3ce9caada95151523459e807be0207713af059e0745b7edfa38a93fd33af71c7284b14233c67f3041cedf4cff86babcdcb61a391e80d

C:\Windows\System32\snmptrap.exe

MD5 fc8dd93ab4d72f29ef5415caa44b3964
SHA1 b0607afefcc99077007a6b4e4c4f4f7d583c0a25
SHA256 c9e66661cdcbf4654a6b6a801a26a7d79f5a681d86652f5156144404b0ce9888
SHA512 70048510589bbe3692ec3ce9caada95151523459e807be0207713af059e0745b7edfa38a93fd33af71c7284b14233c67f3041cedf4cff86babcdcb61a391e80d

memory/584-361-0x0000000000400000-0x0000000000654000-memory.dmp

memory/688-363-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/2128-366-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/3008-368-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2240-371-0x0000000100000000-0x00000001001ED000-memory.dmp

\Windows\System32\vds.exe

MD5 c7ac4ca35e534bed4e0335c0a852b403
SHA1 c2552b6d6affc6ce85ef8e17a81e6221c685d394
SHA256 4ea9a91823593874e62aae70285c2b1013f854207057335dc4ab246b502956b4
SHA512 c187b5ae0229bd3b7384d1061ea54bb8ed511e89edf5fd331b6d4ecbe28616d918a8908289dc1137a6141b6130181c72df1ab356d656b05ede0c828ba0c6a93d

C:\Windows\System32\vds.exe

MD5 c7ac4ca35e534bed4e0335c0a852b403
SHA1 c2552b6d6affc6ce85ef8e17a81e6221c685d394
SHA256 4ea9a91823593874e62aae70285c2b1013f854207057335dc4ab246b502956b4
SHA512 c187b5ae0229bd3b7384d1061ea54bb8ed511e89edf5fd331b6d4ecbe28616d918a8908289dc1137a6141b6130181c72df1ab356d656b05ede0c828ba0c6a93d

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/3008-393-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2096-394-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2224-395-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2224-407-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 38502a57db377b1d9f70918668216ad7
SHA1 951a0579a2615d0c373429964ce7e7c90a8016ec
SHA256 664c4aae18eb2ef250917fee60fdb894637895bf097002a856e6d74795739808
SHA512 612eec40526b54b51c8d916d86940a8616ae56c422e6cd3202b14ed8003a202f7e7851c6597e7da2d1e745be51eef8f966e2b8bd394ab46a94c46582983858d4

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2604-427-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 026b9b26f800a58eca49058a172b73ce
SHA1 9eb4d5cee12c62397ac30215976fd5cafde893f2
SHA256 fd688d36fea04884ce7fd57b31ac45caddfda2c3387bbf2462cdcbabbb55abfd
SHA512 c9c5137592d33c77d6136a7411c3b301330fd5a8654ff642da4fbca0c0494cf31483ab31816327fbd70ad7800f883e3c12c82e0c51fb7a528b178f723d60094b

\Windows\System32\wbengine.exe

MD5 026b9b26f800a58eca49058a172b73ce
SHA1 9eb4d5cee12c62397ac30215976fd5cafde893f2
SHA256 fd688d36fea04884ce7fd57b31ac45caddfda2c3387bbf2462cdcbabbb55abfd
SHA512 c9c5137592d33c77d6136a7411c3b301330fd5a8654ff642da4fbca0c0494cf31483ab31816327fbd70ad7800f883e3c12c82e0c51fb7a528b178f723d60094b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2756-439-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2648-445-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2960-442-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/3016-450-0x0000000100000000-0x0000000100202000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 a82b466cb53f45f3a96715ceefb31ffe
SHA1 c2bb317e9816d5481f18a7c5af83ecc7661f63ba
SHA256 48ad052a83ab80f5760932abad506a0c2f260e2437a8c8e01f2faba5cee47989
SHA512 e4f2322cb408bb70dec99a4477099db780d8d32d996cb31255f2a3d15d2fe8d9c5ef09a64550a0341f352213af81f56e1607b3442c150e608343253fafc60456

\Windows\System32\wbem\WmiApSrv.exe

MD5 a82b466cb53f45f3a96715ceefb31ffe
SHA1 c2bb317e9816d5481f18a7c5af83ecc7661f63ba
SHA256 48ad052a83ab80f5760932abad506a0c2f260e2437a8c8e01f2faba5cee47989
SHA512 e4f2322cb408bb70dec99a4477099db780d8d32d996cb31255f2a3d15d2fe8d9c5ef09a64550a0341f352213af81f56e1607b3442c150e608343253fafc60456

memory/2960-466-0x0000000000400000-0x00000000005FF000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 666d4e3432865d307b411fd09e1ca365
SHA1 5c79fa40a5b92bc27345c999623bdf82d65d0075
SHA256 0d8c6c11320df419b96dc24c1d7f178899b59c01f910b74c4872a58a499472b6
SHA512 0886e2f4552ffc0bb12e900faf7a4720b026aa10e0adabec4a693e34d699e64637a1ab2e89c578318c2f7e7c91716cdfb0fa9b2802ffc8867e5b2815790524ff

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 666d4e3432865d307b411fd09e1ca365
SHA1 5c79fa40a5b92bc27345c999623bdf82d65d0075
SHA256 0d8c6c11320df419b96dc24c1d7f178899b59c01f910b74c4872a58a499472b6
SHA512 0886e2f4552ffc0bb12e900faf7a4720b026aa10e0adabec4a693e34d699e64637a1ab2e89c578318c2f7e7c91716cdfb0fa9b2802ffc8867e5b2815790524ff

memory/700-478-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1748-480-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2424-483-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2168-484-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/844-487-0x0000000100000000-0x000000010021B000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 666d4e3432865d307b411fd09e1ca365
SHA1 5c79fa40a5b92bc27345c999623bdf82d65d0075
SHA256 0d8c6c11320df419b96dc24c1d7f178899b59c01f910b74c4872a58a499472b6
SHA512 0886e2f4552ffc0bb12e900faf7a4720b026aa10e0adabec4a693e34d699e64637a1ab2e89c578318c2f7e7c91716cdfb0fa9b2802ffc8867e5b2815790524ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2168-501-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 e147e36c4500e75cd3c1804d0aefdc31
SHA1 3cafcb566a5bd3bd837b21bb75dad1a33ec6fc4d
SHA256 252807117260ef5cbc85836b729d149b805e8e5be51886c9a4e6cf0c20d24077
SHA512 b77d165491337c8ba3672be77399e8c780f74f7bd24da3dd368f04cb17a10af97b0dd1780338467a25a3e18e70bdac96ecb8f8925610f9fc6cc237dfa743c198

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

memory/2676-516-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/576-521-0x0000000140000000-0x0000000140237000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 c194b25c6f7750aefec4cafb5bd17959
SHA1 b10f795fd39e871a7bdf2234c8906a7143483cb9
SHA256 8849e045cc953e359023f082406b1eb5e840111cd067910387e8d33fabecd723
SHA512 42c90c533641c6df67d7a8dbe60bd0612463f583708fdd0bed10fd482f5f91ee2b1417bd1f11d96f88128b547cd47c1ef3042ca957f36342c0662d7b427d8d0b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b491ee9a510550ca1b483dc0dca0b40b
SHA1 6e974d88343f157b5c77f65fdf75ff4bdc5b6d0e
SHA256 55da52bf6eee715d5e9d1bf10a71cf354f640f4e9837b92ae7bf125806d85cd5
SHA512 fce27bb9311d60506ada4fc4804224044802cdbdba43c0d8b8f99f1d23cf5e372cbedb695fbd4cbb0fe76e722f0cec79fecf71b84edad86e1bc96dd24b1731ac