Malware Analysis Report

2025-01-03 07:46

Sample ID 230426-scwv6sbh7w
Target TT_copy.exe
SHA256 f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2
Tags
blustealer collection stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2

Threat Level: Known bad

The file TT_copy.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer spyware

BluStealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Script User-Agent

Checks SCSI registry key(s)

outlook_office_path

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-26 14:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-26 14:59

Reported

2023-04-26 15:04

Platform

win7-20230220-en

Max time kernel

137s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b70d9943328eb3a2.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1444 set thread context of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 set thread context of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{13149C68-7482-42F9-A857-7204BA6A730A}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{13149C68-7482-42F9-A857-7204BA6A730A}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{CB684265-ABE3-48E4-98A7-DEC0BF0D098A} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1444 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 984 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1540 wrote to memory of 1020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1560 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1560 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1560 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1560 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 872 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 1524 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 2292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1540 wrote to memory of 2292 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f8 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 260 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 24c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1f0 -NGENProcess 248 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 264 -NGENProcess 26c -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1f8 -NGENProcess 248 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1f8 -NGENProcess 264 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1f8 -NGENProcess 270 -Pipe 248 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 274 -NGENProcess 27c -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 280 -NGENProcess 270 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 274 -NGENProcess 284 -Pipe 270 -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 1b4 -NGENProcess 264 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 240 -NGENProcess 27c -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3948302646-268491222-1934009652-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3948302646-268491222-1934009652-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1444-54-0x0000000000880000-0x0000000000A2C000-memory.dmp

memory/1444-55-0x0000000004D10000-0x0000000004D50000-memory.dmp

memory/1444-56-0x00000000004C0000-0x00000000004D2000-memory.dmp

memory/1444-57-0x0000000004D10000-0x0000000004D50000-memory.dmp

memory/1444-58-0x0000000002090000-0x000000000209C000-memory.dmp

memory/1444-59-0x0000000005D00000-0x0000000005E38000-memory.dmp

memory/1444-60-0x0000000006150000-0x0000000006300000-memory.dmp

memory/984-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/984-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/984-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/984-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/984-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/984-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/984-69-0x0000000000280000-0x00000000002E6000-memory.dmp

memory/984-74-0x0000000000280000-0x00000000002E6000-memory.dmp

\Windows\System32\alg.exe

MD5 b47d2801de11575c338fbbf8b21205b2
SHA1 3db72ad4c2769c443ccfeaeda429a05e5121217d
SHA256 319e2cbaa3cd5367aae1f9d22fce77cca165b26b520dd490a2d0ca08bf2cdffc
SHA512 1045fa23cbd19c136652034f95259a9c43fe51eaf338d50e7de5850e9e07d3286eee3faae3016dcc7a04af010de9cd7562bce9d50d504a9db5949be40a0f8d11

C:\Windows\System32\alg.exe

MD5 b47d2801de11575c338fbbf8b21205b2
SHA1 3db72ad4c2769c443ccfeaeda429a05e5121217d
SHA256 319e2cbaa3cd5367aae1f9d22fce77cca165b26b520dd490a2d0ca08bf2cdffc
SHA512 1045fa23cbd19c136652034f95259a9c43fe51eaf338d50e7de5850e9e07d3286eee3faae3016dcc7a04af010de9cd7562bce9d50d504a9db5949be40a0f8d11

memory/2020-82-0x00000000008D0000-0x0000000000930000-memory.dmp

memory/2020-88-0x00000000008D0000-0x0000000000930000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 82a75ea45239d5f67cc2e00c9c090ac1
SHA1 989d72c6b99721c8ca86fd337bc01e7f53d56631
SHA256 b764b934752cb39edcc134d3ee4c01b9074e8980fa421b9f190d883159cc5f0d
SHA512 82865e551c4efa522733917def65fd1374fe789ff32acffc453006412091ce41543a2e32ebe8441bb0af70dc311d048bb17f14cd0023aa2a4e99d7cedf851054

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 82a75ea45239d5f67cc2e00c9c090ac1
SHA1 989d72c6b99721c8ca86fd337bc01e7f53d56631
SHA256 b764b934752cb39edcc134d3ee4c01b9074e8980fa421b9f190d883159cc5f0d
SHA512 82865e551c4efa522733917def65fd1374fe789ff32acffc453006412091ce41543a2e32ebe8441bb0af70dc311d048bb17f14cd0023aa2a4e99d7cedf851054

memory/2020-94-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/984-96-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1272-97-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 db2c651a47dfa99d39e40bea94b9bbb5
SHA1 9b06091f77e48236b4b339fa2fa28e435dcfd831
SHA256 378ef5803c99b278708ea5042b1b78a03841394a689b66bdcfd922d78e2ff74a
SHA512 d919dcdc48ee9dd260531508046d9a68f9eb5d71c3d8d54bac36493c8eec1e250809bff1f33b3d133611145ab35027366d2e9ca4da93aff2f392dc783d3cfc71

memory/1580-99-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1580-100-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1580-101-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1580-105-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1580-107-0x0000000000090000-0x00000000000F6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 cbdd45c1d4a74cb3533ada76c36441c4
SHA1 31cd103fddb9a800a3443a4773c522d40a362124
SHA256 34f206f4e9f2abee768f64bc9110f552db595a57326ba89e6f48b9b9ad80af21
SHA512 17f39be793693a79817d24ccc164a4422c69ff81a682c1f0308d9a03fb938cdf6b5d8b7073041239f23937d5fb3c006fa9d12658b3fcea67cf3aa6a894842f49

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 cbdd45c1d4a74cb3533ada76c36441c4
SHA1 31cd103fddb9a800a3443a4773c522d40a362124
SHA256 34f206f4e9f2abee768f64bc9110f552db595a57326ba89e6f48b9b9ad80af21
SHA512 17f39be793693a79817d24ccc164a4422c69ff81a682c1f0308d9a03fb938cdf6b5d8b7073041239f23937d5fb3c006fa9d12658b3fcea67cf3aa6a894842f49

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 db2c651a47dfa99d39e40bea94b9bbb5
SHA1 9b06091f77e48236b4b339fa2fa28e435dcfd831
SHA256 378ef5803c99b278708ea5042b1b78a03841394a689b66bdcfd922d78e2ff74a
SHA512 d919dcdc48ee9dd260531508046d9a68f9eb5d71c3d8d54bac36493c8eec1e250809bff1f33b3d133611145ab35027366d2e9ca4da93aff2f392dc783d3cfc71

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 cbdd45c1d4a74cb3533ada76c36441c4
SHA1 31cd103fddb9a800a3443a4773c522d40a362124
SHA256 34f206f4e9f2abee768f64bc9110f552db595a57326ba89e6f48b9b9ad80af21
SHA512 17f39be793693a79817d24ccc164a4422c69ff81a682c1f0308d9a03fb938cdf6b5d8b7073041239f23937d5fb3c006fa9d12658b3fcea67cf3aa6a894842f49

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 d6a51258483c6d1f620e459a77431124
SHA1 b6e78f112367d05c9930489915695a7e21106d09
SHA256 a5058cee0637d5ffb01bb1b1ffaf3c838ed35ab664e3320a168c504cbc6d09a6
SHA512 3f038a85af667bbecf13070179c258d84500ba465ccbb5905c8db2e05fd7091d6423e744def772c50dcebe3eced7fcfdf598459976a53f870fa7ed19df86b52e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 877dc8ffe77db59a4198d5a462eb44b0
SHA1 28f0b058e721aa51cd4afe2164800ff170f18c7c
SHA256 7b5a3fe3e2f47bbb6c9344c20c7adb1ed3da603247fcd0a32cd56f7c6649fa31
SHA512 268c75e399f7482a4e8774e2580ae19140d101695003d7328675b747fa68a2edde4ea53f490c3ddf6cf2aea515f23de76247205fdd0d04e241afdca6e41b2066

memory/1580-122-0x00000000048C0000-0x000000000497C000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1540-124-0x00000000002F0000-0x0000000000356000-memory.dmp

memory/1216-128-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/548-126-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1580-130-0x0000000004F80000-0x0000000004FC0000-memory.dmp

memory/1540-132-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1540-133-0x00000000002F0000-0x0000000000356000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 6501eb7392a9c157893c2a5d6fd5493c
SHA1 aa2873202b92bd67dd289ab46f2324548ab4ebf8
SHA256 28e533268012d7900dd1dd2e42dec92c1bdfb7b0785df6485c6c4fe5d6b13688
SHA512 f663512efce3acb699255a6172c83881a2a4979f94731f25211efb6820ce996ed950dd0f7fcfbcb41d355728385455aad109e2cd9930054f9f8608d721822060

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 6501eb7392a9c157893c2a5d6fd5493c
SHA1 aa2873202b92bd67dd289ab46f2324548ab4ebf8
SHA256 28e533268012d7900dd1dd2e42dec92c1bdfb7b0785df6485c6c4fe5d6b13688
SHA512 f663512efce3acb699255a6172c83881a2a4979f94731f25211efb6820ce996ed950dd0f7fcfbcb41d355728385455aad109e2cd9930054f9f8608d721822060

\Windows\System32\dllhost.exe

MD5 805d469b79d9ffa88816580379c19f92
SHA1 d33895dc17d062e32c4f45a27219e36ddfadc6d1
SHA256 dd2033bf86b76febc14cd0ef3bc49ac02cf773c92cbe2d7fd8a4a75043c62ca6
SHA512 ac8de2b401a7fe364922996f0e6d93f66e29aca851fd1e058f809fadc88c0c0dd0a49caf21807e017d88ffe462075fef48e248506b79fcc20bc7fc249cd1f382

C:\Windows\System32\dllhost.exe

MD5 805d469b79d9ffa88816580379c19f92
SHA1 d33895dc17d062e32c4f45a27219e36ddfadc6d1
SHA256 dd2033bf86b76febc14cd0ef3bc49ac02cf773c92cbe2d7fd8a4a75043c62ca6
SHA512 ac8de2b401a7fe364922996f0e6d93f66e29aca851fd1e058f809fadc88c0c0dd0a49caf21807e017d88ffe462075fef48e248506b79fcc20bc7fc249cd1f382

memory/1036-148-0x0000000140000000-0x0000000140205000-memory.dmp

memory/320-150-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\ehome\ehrecvr.exe

MD5 eb7e03e9688e5a7e4450a036ff868d5c
SHA1 e775e2c0ad304c3e1f6a07f7ae4da43bd72be07a
SHA256 2c17c683409ec3882a063ea868cdbd2144f331d2642383905c83d224f7a7c191
SHA512 4d0d798d3be673255aaaee1b799d673b52990658d618380750311e02369c90e99e77e9cfbe9851c5bdbb42a53df28ec32a219ae7ba35c3df402994f32d1f9720

\Windows\ehome\ehrecvr.exe

MD5 eb7e03e9688e5a7e4450a036ff868d5c
SHA1 e775e2c0ad304c3e1f6a07f7ae4da43bd72be07a
SHA256 2c17c683409ec3882a063ea868cdbd2144f331d2642383905c83d224f7a7c191
SHA512 4d0d798d3be673255aaaee1b799d673b52990658d618380750311e02369c90e99e77e9cfbe9851c5bdbb42a53df28ec32a219ae7ba35c3df402994f32d1f9720

memory/1504-153-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/1504-159-0x0000000000870000-0x00000000008D0000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 d7ed29541b38f06b0790fdd3b91e0e2a
SHA1 502c0800a002281b87d6607c0be66eb556fac2b2
SHA256 0bf35dac6d0e14f31d7ed0ba3093a9bbfcbdecc08ba3cd3b964feaa76f0ae43c
SHA512 14f278421b4f953cc701486af1a2615886c1bd4667bfdbb79e445c2297399f89ebcaf10e8464d5401c75e5dfc6e89f317993358f2ab9de3650683d93d4485dbe

C:\Windows\ehome\ehsched.exe

MD5 d7ed29541b38f06b0790fdd3b91e0e2a
SHA1 502c0800a002281b87d6607c0be66eb556fac2b2
SHA256 0bf35dac6d0e14f31d7ed0ba3093a9bbfcbdecc08ba3cd3b964feaa76f0ae43c
SHA512 14f278421b4f953cc701486af1a2615886c1bd4667bfdbb79e445c2297399f89ebcaf10e8464d5401c75e5dfc6e89f317993358f2ab9de3650683d93d4485dbe

memory/1504-164-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1504-166-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1504-168-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1224-170-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1224-174-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1020-179-0x0000000000870000-0x00000000008D6000-memory.dmp

memory/1020-184-0x0000000000870000-0x00000000008D6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1504-190-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1020-192-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/620-208-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1560-211-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/872-230-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1188-231-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1188-241-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/472-253-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1840-254-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1840-264-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1236-275-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1228-277-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

memory/1236-290-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 2e057f82bae752727a7bdca76261fa54
SHA1 7042c5d5f146e5050003762700d40f343913c959
SHA256 4ca762e92342a65f39031180438cb451ec331641d2da79b67fcda2356c170d52
SHA512 7becd41870c6ad9ffdd9a33dba94da7ab5cee82e6f969ad2e8c049e4adb28fabea9aad40b9f8933b2fefe4952bb3312c22e83a6c928a3e223c1533b74682bf41

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

\Windows\System32\ieetwcollector.exe

MD5 55d02250c04b879d69684fae45426ee4
SHA1 7da9618b2c4de4ca4c5642183e4d06a46081b07e
SHA256 787a89d8177f945b999228f12b2b9de7ea1b7330d96a48efba048d954592ff1c
SHA512 d550ab0335c4c7cd4199117b955f5e417c17cad934e86716aa7083fddf4250b6cc69fb790f6385724ad460dfe631739ea4a39920f188db5a34b33056270db707

C:\Windows\System32\ieetwcollector.exe

MD5 55d02250c04b879d69684fae45426ee4
SHA1 7da9618b2c4de4ca4c5642183e4d06a46081b07e
SHA256 787a89d8177f945b999228f12b2b9de7ea1b7330d96a48efba048d954592ff1c
SHA512 d550ab0335c4c7cd4199117b955f5e417c17cad934e86716aa7083fddf4250b6cc69fb790f6385724ad460dfe631739ea4a39920f188db5a34b33056270db707

memory/1728-306-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1916-311-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/984-324-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1272-325-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1596-326-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 311c8d958aca0762e0471d75c05284b9
SHA1 b1c58916189b6dddde7f22e2f2fdd385469b5b26
SHA256 5b5f9476e0a40ef8346d675680c7eac7ef64dad38e13078b2a4492feba4e2a77
SHA512 431acb3cc37bd54ca39b8f53b409d2155a798b7f1af500ff25c16787ef151fac9db869cde6f6a8dd423faee9358b43b817e3bab152fb06725e151e0985a466c6

memory/1540-336-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 54b0a61485eb297e5dc93fae7a004d55
SHA1 f779eec102df64b6729a27b1e5c6c9f5890a2752
SHA256 5b9db95ea3376610ae51a2cc0c2b0a75451bae39ad5a8ecfa99e8e9f6ce563fd
SHA512 9b6fa04894c143588de5e2095bfa8f96b9fc1aabdb7133ea9429551358790ebf5e89c7b2686ecc0de9c68e856d3f7fc78ab1879f42a66e8d4c22ce787942ef02

memory/1236-339-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1176-344-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 2f6e9b520627623079218aaed9526ba6
SHA1 cddc6e3b3aa5dd015a21daeae352ef6fd5cd3259
SHA256 00b624714e8d6516e137f5a283c1387cd30692f5cac84078696a6aa2b1520912
SHA512 5040d2f8bd69e80c6f747d0d8d6b41bbd93dbd2cf26333ebfb2fb157ec5a457796dec0fd595573dc815bce90f7603d550561ecea10328cf784232a953638e1aa

\Windows\System32\msdtc.exe

MD5 2f6e9b520627623079218aaed9526ba6
SHA1 cddc6e3b3aa5dd015a21daeae352ef6fd5cd3259
SHA256 00b624714e8d6516e137f5a283c1387cd30692f5cac84078696a6aa2b1520912
SHA512 5040d2f8bd69e80c6f747d0d8d6b41bbd93dbd2cf26333ebfb2fb157ec5a457796dec0fd595573dc815bce90f7603d550561ecea10328cf784232a953638e1aa

\Windows\System32\msiexec.exe

MD5 6bf929c8a07d0f4dcfe4cc72cef78b58
SHA1 0d781816fda7315d20bd8c95096c4a89a5f2781e
SHA256 93250ac1226718f8ecc26d3d22c4d073eb62bf00b0020c47b2ec3a4218c0b884
SHA512 d8cfce7480f85edb5b2456409a390aa73dd30ea94d345fa4bf5642686ccccc4f10a008a095d7177dad588c8f1aadb769083fb9eb5666efa869e5a43973768a36

C:\Windows\System32\msiexec.exe

MD5 6bf929c8a07d0f4dcfe4cc72cef78b58
SHA1 0d781816fda7315d20bd8c95096c4a89a5f2781e
SHA256 93250ac1226718f8ecc26d3d22c4d073eb62bf00b0020c47b2ec3a4218c0b884
SHA512 d8cfce7480f85edb5b2456409a390aa73dd30ea94d345fa4bf5642686ccccc4f10a008a095d7177dad588c8f1aadb769083fb9eb5666efa869e5a43973768a36

C:\Windows\system32\msiexec.exe

MD5 6bf929c8a07d0f4dcfe4cc72cef78b58
SHA1 0d781816fda7315d20bd8c95096c4a89a5f2781e
SHA256 93250ac1226718f8ecc26d3d22c4d073eb62bf00b0020c47b2ec3a4218c0b884
SHA512 d8cfce7480f85edb5b2456409a390aa73dd30ea94d345fa4bf5642686ccccc4f10a008a095d7177dad588c8f1aadb769083fb9eb5666efa869e5a43973768a36

\Windows\System32\msiexec.exe

MD5 6bf929c8a07d0f4dcfe4cc72cef78b58
SHA1 0d781816fda7315d20bd8c95096c4a89a5f2781e
SHA256 93250ac1226718f8ecc26d3d22c4d073eb62bf00b0020c47b2ec3a4218c0b884
SHA512 d8cfce7480f85edb5b2456409a390aa73dd30ea94d345fa4bf5642686ccccc4f10a008a095d7177dad588c8f1aadb769083fb9eb5666efa869e5a43973768a36

memory/1176-368-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1504-369-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1224-371-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1076-373-0x0000000140000000-0x000000014020D000-memory.dmp

memory/1020-375-0x0000000100000000-0x0000000100209000-memory.dmp

memory/1020-377-0x0000000000650000-0x0000000000859000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 fe79c36c6295e41bdcc8c4c12f32606a
SHA1 f8f3d9816da5714f2c4234919d625b2832135bd0
SHA256 48ad4f4f0777c4a5cbf353a7b9e2421e550257c6df82d18da0a8cb53f03e2930
SHA512 60cfbfa43ed690ceba7b9b5efcffc890dfddb5ba60611e1c14db2d6ad0e6148d63e3296cd8610703089905250bb243744266e6fc12d26d9e91464856608d51c7

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 e5c9d07427739c008812b4e40d6b87ab
SHA1 398799a354a70a7cf7fca6209e7e76d31c8cfeb6
SHA256 9378beb4eeb3ab56fcf889e51b59faededb231214240f126be1999577d59686e
SHA512 50fd32d5aa49393476af834e8b06624a81d170fcead7519c25e5ab5370923ec3b75c48298ba7aaa9091bca261058e26470777488bbf9aab7d0faa1b5dcbfdf2a

memory/2212-389-0x000000002E000000-0x000000002E20C000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

C:\Windows\System32\Locator.exe

MD5 f6f6752450ea872709fc60394bfb60d3
SHA1 c436f7a58bf68c7b298db1cdd03d376f769c3e08
SHA256 f222c4c6c1813a03f390db7fb5a358b6e64f114aa1fd2aad3598ed8ba5734485
SHA512 41ccbe857b57e542b065b77a6242dd2058c9ab9475d3670c44e838cddc66e8dcd94c86bdb6657c30c45a5edc1e795a99b3647711f4ab7b5081f43bf6b5c7b280

\Windows\System32\Locator.exe

MD5 f6f6752450ea872709fc60394bfb60d3
SHA1 c436f7a58bf68c7b298db1cdd03d376f769c3e08
SHA256 f222c4c6c1813a03f390db7fb5a358b6e64f114aa1fd2aad3598ed8ba5734485
SHA512 41ccbe857b57e542b065b77a6242dd2058c9ab9475d3670c44e838cddc66e8dcd94c86bdb6657c30c45a5edc1e795a99b3647711f4ab7b5081f43bf6b5c7b280

C:\Windows\SysWOW64\perfhost.exe

MD5 f0cc989e68af46a92ba531f03beba710
SHA1 5cc6e27a791c45c7dc7121793d172cdccfff1575
SHA256 4064797f1fb4559f1aa4ddceccd7e9e050e559200984f96cff4b025caf088241
SHA512 3b07d75a6ae346959092cd69c022a4361453c05cf99fcc8fd94c8de7a724f76505bddc72cb63d4197e50b0cfc99aee9f8b03d6715b596c35156037c582304253

memory/2248-416-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2292-419-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2416-421-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2448-422-0x0000000100000000-0x00000001001EC000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 2368414d8c4791c9767e83eb07dcd9b9
SHA1 8bcfbca1b25a4c8a7e9a4fa2ed23cbd03c1ebbfe
SHA256 5a0313a2107c3de3b9c15943f7685e914c5c71a944df9c601411e93b13bfcd19
SHA512 08cb61a2a4bdb789beb72e76debb97fa985300758f5a0e320f72b26709cc80dcb393ab9a6f7c60fd3b0611e6191ce05621925e1ee7898eb778d3a82d1a3ea294

C:\Windows\System32\snmptrap.exe

MD5 2368414d8c4791c9767e83eb07dcd9b9
SHA1 8bcfbca1b25a4c8a7e9a4fa2ed23cbd03c1ebbfe
SHA256 5a0313a2107c3de3b9c15943f7685e914c5c71a944df9c601411e93b13bfcd19
SHA512 08cb61a2a4bdb789beb72e76debb97fa985300758f5a0e320f72b26709cc80dcb393ab9a6f7c60fd3b0611e6191ce05621925e1ee7898eb778d3a82d1a3ea294

memory/2540-433-0x0000000100000000-0x00000001001ED000-memory.dmp

\Windows\System32\vds.exe

MD5 6ee740d80c64080b74fba4844f760086
SHA1 9df9bd3d15243921aece6382dcd308ddd44e6919
SHA256 b2eec8b74ce324ad4e372c4e14e9ebb86ef7e99e7577a6f95cd84e443f6dcdd2
SHA512 e6264dc2529df920248b7a14911470bbe038904534cf8e22edacd6c50424d8bd21c096d8bee4d6af2047f502372884c45fff2a10c186096196b7772dbb41381c

C:\Windows\System32\vds.exe

MD5 6ee740d80c64080b74fba4844f760086
SHA1 9df9bd3d15243921aece6382dcd308ddd44e6919
SHA256 b2eec8b74ce324ad4e372c4e14e9ebb86ef7e99e7577a6f95cd84e443f6dcdd2
SHA512 e6264dc2529df920248b7a14911470bbe038904534cf8e22edacd6c50424d8bd21c096d8bee4d6af2047f502372884c45fff2a10c186096196b7772dbb41381c

C:\Windows\System32\VSSVC.exe

MD5 469f34e397a5db32c56167b20ab484ef
SHA1 9fa34967d96c696bdb8331db6f4265a0f8cba6a6
SHA256 788f425554b0799aa3507f3b7fe29d5f2efe06bb182ebedf094754fa2d693e8c
SHA512 e5733b74a5a058f260a1d60d96e6937027ab65c5bb83e989d8f704e9c5b9cd33dea8a45dbf7a4736ad0c1830217ad6d12be8e311ed14d5353d5c825c5809ea36

memory/2632-451-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2704-453-0x0000000100000000-0x0000000100219000-memory.dmp

\Windows\System32\wbengine.exe

MD5 1a1d5629f11295b3e6e438b1a445cca0
SHA1 78a09b7a770b78f0e872bfa2fdf7b26e448c3b50
SHA256 f9d6b50d1e736401a69ed3a2f95fa76784c0a43cd12ab260befd8547562cc7ea
SHA512 5cee33b3283eee76f10baabbab411487cd52ee4712240fb8243e11737cc257fe8bc36972306ff00b82da3955efb19ee5d2492d892cceb064e60bae3ac34fa28e

C:\Windows\System32\wbengine.exe

MD5 1a1d5629f11295b3e6e438b1a445cca0
SHA1 78a09b7a770b78f0e872bfa2fdf7b26e448c3b50
SHA256 f9d6b50d1e736401a69ed3a2f95fa76784c0a43cd12ab260befd8547562cc7ea
SHA512 5cee33b3283eee76f10baabbab411487cd52ee4712240fb8243e11737cc257fe8bc36972306ff00b82da3955efb19ee5d2492d892cceb064e60bae3ac34fa28e

memory/1728-471-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2784-473-0x0000000100000000-0x0000000100202000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 9e6d2ae9a19b94916cf0d9e7c6385644
SHA1 1d703c0440e1d44999b48d307edfee10c615e634
SHA256 98d37907bf24d3d9bc8df5c888dee19c9e3767d6fd69a249cbbd78a8af2d4718
SHA512 64404a85afca06ddcf9555b49cbb3f8ce13eb6cfde59d4f17ef1c1a76a4aa9bc97d2034673f9bee2161225319e70d83c66d3830ac83f74e98ca39013468be181

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

\Windows\System32\wbem\WmiApSrv.exe

MD5 9e6d2ae9a19b94916cf0d9e7c6385644
SHA1 1d703c0440e1d44999b48d307edfee10c615e634
SHA256 98d37907bf24d3d9bc8df5c888dee19c9e3767d6fd69a249cbbd78a8af2d4718
SHA512 64404a85afca06ddcf9555b49cbb3f8ce13eb6cfde59d4f17ef1c1a76a4aa9bc97d2034673f9bee2161225319e70d83c66d3830ac83f74e98ca39013468be181

memory/2292-494-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1524-496-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2892-497-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2880-498-0x0000000100000000-0x000000010021B000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 030fc074b03428b26e9d43d11b99de93
SHA1 a29460df8298af2422f7b4b8cc78a0fc941d64c8
SHA256 ff3695faaa984077c2cdb0c7e623ff3ab1626504d2c546dcd34e5293897bdf53
SHA512 8d1fcfdaf824438ebb087884c7c907b4a2d90d8e694277c8b943952bf5e4de8bc9d713a624339da676d74c877796da45e834b001d2a2c672a42890df3b757506

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 030fc074b03428b26e9d43d11b99de93
SHA1 a29460df8298af2422f7b4b8cc78a0fc941d64c8
SHA256 ff3695faaa984077c2cdb0c7e623ff3ab1626504d2c546dcd34e5293897bdf53
SHA512 8d1fcfdaf824438ebb087884c7c907b4a2d90d8e694277c8b943952bf5e4de8bc9d713a624339da676d74c877796da45e834b001d2a2c672a42890df3b757506

memory/1236-510-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1836-511-0x0000000100000000-0x000000010020A000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 7f54110646371f6e6d156eadd45d3259
SHA1 e64153e16daa2472c16d4c921d6de1463766d79c
SHA256 6d6324e1c8d4d5e10b4267e0ccea2fa6c0ca603cdf76e658fc2991448dd56c03
SHA512 17467a3c61a6d640c2a78b9a9f1d9f73d7c07b3b846da7b22fe44281631c4a6125bf48c89dc79a995fbb0cea137856788c4985188b40c438ce5264a71de369f7

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 030fc074b03428b26e9d43d11b99de93
SHA1 a29460df8298af2422f7b4b8cc78a0fc941d64c8
SHA256 ff3695faaa984077c2cdb0c7e623ff3ab1626504d2c546dcd34e5293897bdf53
SHA512 8d1fcfdaf824438ebb087884c7c907b4a2d90d8e694277c8b943952bf5e4de8bc9d713a624339da676d74c877796da45e834b001d2a2c672a42890df3b757506

memory/2092-529-0x0000000100000000-0x0000000100123000-memory.dmp

memory/1020-558-0x0000000100000000-0x0000000100209000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 603b03cd3fb07d905d5bd2baf23e77c6
SHA1 1dfd2c27609d2a35612a38632b2cdb8d9659d40a
SHA256 8b6f97b1a606204d4b4ed9f377d34afbfd67c6fdf2fa09bdf806668c763b8782
SHA512 4e70e5bf808bb642b039711cf31c8843e481cb861fd27872ac489a1fe8b49d991cd2b101052225c168359a631934338d6e1fb579b560e1f3313129fcd070d19d

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 fddf127fa06b50282f3717c2e5a1dfc8
SHA1 4ada33967ed8db92f9d75226196ee966c72a69f2
SHA256 941bc07933ffff1ea3677e241a9b263b66d98eb3c7c442a7bfe3fb45f747af60
SHA512 6f89fe5ab3aff787a23322d4ebcd2c8add56dea7bee60d2b516f1dc1f0fb6f4709d47e8ce662a3c7940a9ee8861081df222285d2a678fa8558033fef3de76405

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-26 14:59

Reported

2023-04-26 15:04

Platform

win10v2004-20230220-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\96878860ea807a0f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4344 set thread context of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 2376 set thread context of 4092 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{A100221D-7AEF-402B-B05F-21D404F0BFBF}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7d80afa6078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3c66df66078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000541f68f76078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003df344f96078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000649412f46078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000769080f96078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d03dfcf46078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000528929f56078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb9f66f66078d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 4344 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 2376 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2376 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2376 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2376 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2376 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4040 wrote to memory of 5108 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4040 wrote to memory of 5108 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4040 wrote to memory of 2172 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4040 wrote to memory of 2172 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 40.77.2.164:443 tcp
US 20.42.73.25:443 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 73.254.224.20.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 24.249.124.192.in-addr.arpa udp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp

Files

memory/4344-133-0x0000000000C10000-0x0000000000DBC000-memory.dmp

memory/4344-134-0x0000000005D80000-0x0000000006324000-memory.dmp

memory/4344-135-0x00000000057D0000-0x0000000005862000-memory.dmp

memory/4344-136-0x0000000005910000-0x000000000591A000-memory.dmp

memory/4344-137-0x0000000005940000-0x0000000005950000-memory.dmp

memory/4344-138-0x0000000005940000-0x0000000005950000-memory.dmp

memory/4344-139-0x0000000007970000-0x0000000007A0C000-memory.dmp

memory/2376-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2376-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2376-144-0x0000000003330000-0x0000000003396000-memory.dmp

memory/2376-149-0x0000000003330000-0x0000000003396000-memory.dmp

memory/3476-156-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2debe22845e64c06749c80a8d00f77c9
SHA1 4e3627ab807cb803cfb6c422212f162f6fe89f9f
SHA256 766fd0aa41fc33abd158b0e748778780765cdfeb43bdc51c28e8d500e1af86f9
SHA512 d365a358e1abf1dfff2f98462bbcf6accd171111cc1d68ac6189db91afb75336cafb6e149d3f40b06c725d640052c21e2fc21903ec8ab0219cfa8aae4bfbc637

memory/3476-160-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2376-158-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3476-164-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 c1644354a6784db61c917b2ecb1c8d96
SHA1 9ebdf12822cac02dfe617a82883452d49d4fff2d
SHA256 f2d916e8a9f171c1337575a751fe448e1c2652239ff531061b2e858a3b3b14cb
SHA512 c3f8f48b12c76f1fede9764409ca178462a017d510c4eaa83c7cde6ea55e0f509f9287f06075730e5b6c69916c6008ee903fe398345e071ca20ac9b24101c563

memory/3932-170-0x0000000000490000-0x00000000004F0000-memory.dmp

memory/3932-176-0x0000000000490000-0x00000000004F0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 4f4358a0d053aac8287395c8ecf795e8
SHA1 5d965b2b7e286336ccf16cfeee2132848b5267b0
SHA256 eff2d868edf93f157d70cec2d65f93e92b3795b841ba8395782e2018b5e33e8e
SHA512 2b34dc272f728f60100ef0ac91cf4e42ef2b813bfc73e1a392bba12fc1a8dcd3836ac36cdd11e8b6d68673a3f3207d1b7bc0ed26f8a5de3e891e13c74accbe1d

memory/3424-181-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/3424-182-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3932-180-0x0000000140000000-0x0000000140200000-memory.dmp

memory/3424-188-0x0000000000E20000-0x0000000000E80000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 8b59a5895bd612b958f784a4fe4561db
SHA1 e3fdb6a936eedea0ca16829379a2524156c6f373
SHA256 65c80de1ff0bff4bd158a4350450f51242ed364a8d34235210d592cf08f6cbd4
SHA512 6a85159ff93ddde5ca5bb3d21f1b2d5f4e88d3c2ac235b8086570410c1b3b74e82f07b67c5d61e365f7d1b28f84b17dc6f98418debca1abcb8523dd3476fda9d

memory/2484-192-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/2484-198-0x0000000000CA0000-0x0000000000D00000-memory.dmp

memory/4092-202-0x0000000000FC0000-0x0000000001026000-memory.dmp

memory/3424-204-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3424-200-0x0000000000E20000-0x0000000000E80000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 4b2e24b74e505d2d8e35a1295f7c1e69
SHA1 e05b9bbad2f4f34fea66de000afb05d378e68244
SHA256 2f1284ef069299121c3ec299c7b24dfe1a5bef67d1e2a6487c5444b8b0abd042
SHA512 42f1c9ad1487a2dcaf1ae04675cf434c6bda043403f20126d69741bdedcb708a59a455300b188ab3e62a429a0fdeddb4dd10ef9f41d9c2380188594df7434bab

memory/3776-207-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3776-206-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/2484-210-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4092-211-0x0000000002F10000-0x0000000002F20000-memory.dmp

memory/3776-216-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c3227bc486eb250b86db0e477322a2c8
SHA1 1c1946f144a49e2011c7e5065ce9ffffb119a889
SHA256 fb472bebd4aae4c9bec299a1b5fcddda8b1261e35af9518475587e5f42fa816d
SHA512 e9556956473435bd0b9049e1675ac4b1ee3a6e327485d6a581685f8340d63ea7c63047692580b5c4965f825e7c8e5561394d7cda85e64dd0abc08a2286de0a13

memory/4224-220-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4224-226-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4224-229-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4224-232-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 1837643f01c30beb840feedb003d0f19
SHA1 698a6a44ab265eff32f400f5255371c71ede7ff4
SHA256 563d17ba6f52e2fdd303aed60f3ecae06aff3aebb910be67b14d373fb0518332
SHA512 5e2d80178696871ac21ffa54f0c77356cf4df26233e1cd2c3b736b5828588698102cc57abdc88273cc953a7f4fbc210d41c2706d956edb930bc341f5d23e3789

memory/5068-234-0x0000000140000000-0x0000000140210000-memory.dmp

memory/5068-235-0x00000000007A0000-0x0000000000800000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 a7b916bf71882986eec962e0ce9bb3fc
SHA1 864bd530ce636dc0fc1e9a95516cec718bb33988
SHA256 5cd89bc59431bb1896f611335793fff8903d59951902cd24d9dc4690561492a0
SHA512 97dd2c20955d81ece499ce2941a0b306d80ab8ebb69df15ac29aa6b272eeab8cccb259aac0d4450cf7a1de859161da26bfbc98f933b3f06040b54a9d8612c779

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 60632e4b073fa308703c27cd62bffdd9
SHA1 d5f5ded28685a7adf7f376c65cd8940953d61418
SHA256 464693bf6fc7be61d1e4c3678e480ba212ccf9fd32aa19484c0be20ca48c15a9
SHA512 a3cf89d4e64c03ecb58736deeb1439b9f5a16b31d299b7391355f11d9ea3cbbb3f13ddbfc8c750e5f37f58cefeff45ddf2d11bf32c9c55405adc36349188577a

memory/4180-259-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1548-261-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 0f2f5d2cc17de22356e4f50f3625feae
SHA1 31e26ad90b04e1f74bb7deb10d3679aee0309192
SHA256 8d13f781fe31da38dcb0c75ce4dbcb22515babd9029aa3349f9fe1bef86fe468
SHA512 66f45b4c423f87e8219f3ddf552d2a0706d3d1ad870c2f86a07d336f1141f32bb034693ccca11180ee72946121673581e7c6e9ac074202fc0c32313b2d01f7fb

C:\Windows\System32\Locator.exe

MD5 8436057dc69d0b799d9bc36e371b5ec5
SHA1 6a316b398adbe938870107cdf35aaff240e339b8
SHA256 220ad70a1afb4e93f84ddeeaf1ec70323713ee210a618ca2bfc135404555df21
SHA512 49e41c648da343fe60aa5c3c6cd7775ae27e306d68c4dd43a8228a0e743ae4f5f4e30dec4c0cb01eeb41f151c62167614fe11ba3c9456b10cdb3cac678a6d453

C:\Windows\System32\SensorDataService.exe

MD5 f279364869e93b04f31e878cc34d018b
SHA1 2642aa80d7d2d93d0b3a4524a232ec12f1006fc6
SHA256 72886bdd4050f4f728204e89638ad0cfc66b0f5cae27b7c2607d2ce70c1d6328
SHA512 cc90f59b1b4daa9a1bfe7e243e201c51f16442b06f2a27ffcf301c79edd5d2da69d52fa751ec70f11a0c78d26e556f7e205d070af5fd6dfffc424899078356b3

memory/2120-290-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/2264-293-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/2304-295-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 1aaca7a2fc16ce754cc1a1fe62ad03ac
SHA1 e0859fd5d38bee7a31676354e4732fad202a06f8
SHA256 527a4c4578042d41368d9160b785f80524eec154e3ab52044b1260d3f28ff6c3
SHA512 cd968a7240faeadbb03a9e1c117753987976a5db644460fefe7547eef95ddb21732c996806b7753ef643fea9852694748f3709825d7b3208e065e171bbbedd1a

C:\Windows\System32\Spectrum.exe

MD5 31e79db836f269934aae7b9e98f1e0e0
SHA1 d3a3616e8562e7040b13f324d5655595d13fb310
SHA256 fdbaafe71833a5083017023831e947a8e024a5626488eacbcb3f3c677936c7ef
SHA512 619c52aacb4cc89cd1cca23c573c5c5f7d5f70ff1c6ffae6407dea98e07ff5d31beb3064ba8314e079d69e18d15129603222d6a3a4b937b6023a1b60ec4e57cd

memory/2948-314-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 65e8e28ac7733fe2c00fdf1cb535f720
SHA1 acce67bdfe02866adf627d006225a05d4ae369c7
SHA256 d8d52bcae3bf257169e271b73915c5979ab9c4e2d2caab63ca0441b728fcfe3d
SHA512 df7ebea75590dc187f9378887604d3149a589340dc1e6c357b84139f9bf631fd56e346e483556ceee580a1f54aee7146f7849f0a28cc1b91987446fd993c20a9

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 65e8e28ac7733fe2c00fdf1cb535f720
SHA1 acce67bdfe02866adf627d006225a05d4ae369c7
SHA256 d8d52bcae3bf257169e271b73915c5979ab9c4e2d2caab63ca0441b728fcfe3d
SHA512 df7ebea75590dc187f9378887604d3149a589340dc1e6c357b84139f9bf631fd56e346e483556ceee580a1f54aee7146f7849f0a28cc1b91987446fd993c20a9

C:\Windows\System32\TieringEngineService.exe

MD5 893282efd68adb11a07fffdee8c04265
SHA1 31b1e126998deb7a97edae2d3c459ed2c3051120
SHA256 1cec23bbc819315025106c679cd0de4e3b39226d6df18f9f929ceb5262ca044e
SHA512 37671c63dded56aeb7c06fca6cbfc70ca5f1ed51ac451ac2d112868f0f3ad6852d40a13c737142b56e2f09d179e9541679e9f4acec640b951250e8f1b7a1907a

memory/1400-340-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3820-342-0x0000000140000000-0x0000000140259000-memory.dmp

memory/3792-344-0x0000000140000000-0x0000000140239000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 0f565177f69b54e48c7c463d6e08dea1
SHA1 20f27d8803d6deb75aaf6ade5a5d1806babb3d24
SHA256 9dc1ef4495160412564d13e5630f3402bb622ab619a50383b3558a4c5f7eddff
SHA512 762d07d9d2cc5d186f3f0d675dbdef1f2525447537f66c573cbdb01f803d24b75b473eaff3578166ba7b9375cd3b88782c0f551d4b93a39657adc6fafd9ff035

memory/3620-351-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3620-361-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 d86b429835ffe0c721ab24fd21025b6f
SHA1 b862d3ff5e1e0f0a6dfec3c163361a3b8335e979
SHA256 40ad743325aba384374e2c19f8dca7478d61f3e4956f72c66fa1a5c6c5691928
SHA512 a80ec80d43fe0219a05eecb9f67099b7cf6d0cbee008d618268c71ce43c301eec3f272ec1702adb2ca80cd5c2f7e067c92d9395bdab8457a1b9222e204efb6ce

C:\Windows\System32\VSSVC.exe

MD5 6ae7d0e1fd3ae675a54153ab8e0a1c55
SHA1 154063eb4685c2e7c6a8a6da5608604965c66625
SHA256 275ff9422367f63cdfdf9f1ce796c705458d185b3dad6b6ffe52077493054abe
SHA512 0ee902d7ad6d5080a9639ec57c0bf7986f4caeabcbbfd6e70cde45432e3dc31c33af5ffcc425d166027afc32f821f87a63c7159a3450b9065eaca61b46fd7459

memory/4952-373-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3916-375-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 d6db03f3a934a91e45a42d7f14c8907e
SHA1 6617a612ebc0d66b9525b0e8f29c7d93a5b80fe5
SHA256 07f00d65238cc3e09e705bc7eefe33ae81a9dd15f9a673d0171713b09e2340f8
SHA512 22efd46e0af43cdb39d3c89cdeee6bb0c609085b93e1af7ba98e7519e406b3b58c39b86c28ca383c1c66ffb75f910558e7d9ffc4105d9c74b7959ae52fcef55d

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 cfa90b7246ffab6e1d6656933b1747b1
SHA1 94fd6fdbef313a80058b5ee5622ee4af94a71f52
SHA256 60cddd18d250571a59d178fe23b6c6077b3d6f83282b7f31e674ef4f338e4276
SHA512 224340e84c743693995bf85391957e4339705736b45c6d5b98eecde0c344861ce25575ce3d55a44b60e404b8438fadf621236f068fe44bb3eed250c99decc723

memory/2376-402-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3476-404-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4224-405-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3288-407-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 614f9b6efa426ce1066864058ddedf91
SHA1 50c2df4fd5cc000cac7ec5c25171dbaee1780036
SHA256 97458fdb975db507c50a8a77b61605ef8f572390ef92fd074b107856ac6a9229
SHA512 fe1cb622014a06356607bdd95e11373f8746791c45f5be4cb16584840ff7b327aadd8280c4c04acf1e9e128856b84e0b3fc8997fc28fe02a1b1916d8588a260c

memory/4040-445-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3776-497-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2484-498-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5068-539-0x0000000140000000-0x0000000140210000-memory.dmp

memory/1548-561-0x0000000140000000-0x0000000140202000-memory.dmp

memory/2304-577-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3792-604-0x0000000140000000-0x0000000140239000-memory.dmp

memory/3916-609-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3288-655-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2172-657-0x000001E98A4A0000-0x000001E98A4A1000-memory.dmp

memory/2172-656-0x000001E98A490000-0x000001E98A4A0000-memory.dmp

memory/2172-658-0x000001E98A4C0000-0x000001E98A4D0000-memory.dmp

memory/2172-660-0x000001E98A4C0000-0x000001E98A4D0000-memory.dmp

memory/2172-659-0x000001E98A4C0000-0x000001E98A4D0000-memory.dmp

memory/2172-661-0x000001E98A4C0000-0x000001E98A4D0000-memory.dmp

memory/4040-662-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2172-705-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-706-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-707-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-724-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-725-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-726-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-749-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-750-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-751-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-752-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-753-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-754-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-765-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

memory/2172-766-0x000001E98BAE0000-0x000001E98BAF0000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 f96d2255427844e9cf836ce53d04db3e
SHA1 37d575ea730be0579785d204f5d980f347e0349c
SHA256 93fb52f8897bc9051eabb0c4cbfe57c1769e1ab85104fb47917206c8e651a0e1
SHA512 09967623e2245050fc4fa098e1cc2d9660f1b278c04ad63ec21be1f4ac12fa2c752611c2514078649d81408db9062dfc882e3ac5b994d7fdfd1bbfaa1dad08c2

C:\Windows\system32\fxssvc.exe

MD5 4f4358a0d053aac8287395c8ecf795e8
SHA1 5d965b2b7e286336ccf16cfeee2132848b5267b0
SHA256 eff2d868edf93f157d70cec2d65f93e92b3795b841ba8395782e2018b5e33e8e
SHA512 2b34dc272f728f60100ef0ac91cf4e42ef2b813bfc73e1a392bba12fc1a8dcd3836ac36cdd11e8b6d68673a3f3207d1b7bc0ed26f8a5de3e891e13c74accbe1d

C:\Windows\system32\msiexec.exe

MD5 1b6b348bec427f046377bf15f8c2023a
SHA1 f46459d11ce29969a19d4a4ac997e0228ad63b6b
SHA256 dc3a202d0809260298d5dcb60b6f7b99ef51dd4971efacb67de8b8bb231c2b1a
SHA512 636a8b75ef92bbc82e0c25378b334f351652aa4d8f6785e2483d9c7b21b6ac9df7302235f10f7691250ca2758a1edc63082e9b57f9fa4ff987e1005071f4a98b

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c3227bc486eb250b86db0e477322a2c8
SHA1 1c1946f144a49e2011c7e5065ce9ffffb119a889
SHA256 fb472bebd4aae4c9bec299a1b5fcddda8b1261e35af9518475587e5f42fa816d
SHA512 e9556956473435bd0b9049e1675ac4b1ee3a6e327485d6a581685f8340d63ea7c63047692580b5c4965f825e7c8e5561394d7cda85e64dd0abc08a2286de0a13

C:\Windows\System32\SensorDataService.exe

MD5 f279364869e93b04f31e878cc34d018b
SHA1 2642aa80d7d2d93d0b3a4524a232ec12f1006fc6
SHA256 72886bdd4050f4f728204e89638ad0cfc66b0f5cae27b7c2607d2ce70c1d6328
SHA512 cc90f59b1b4daa9a1bfe7e243e201c51f16442b06f2a27ffcf301c79edd5d2da69d52fa751ec70f11a0c78d26e556f7e205d070af5fd6dfffc424899078356b3

C:\Windows\system32\AgentService.exe

MD5 0d03ecd9441b3cc26e8f586cd880b000
SHA1 7c3c3b7f574fb86e18a606276d0483b672a4405d
SHA256 b55d31e75afc8af6b972e93970825f40df4fb796ab8bd832d20a1f65250342b3
SHA512 48d91f47ead121a6e2429d647f099389e08b585681d210362a711d5078da8442ff1ade28eb336c2a44a5852f34e9889bb587a79378ad49b7bc37e1a8387e22dc

C:\Program Files\7-Zip\7z.exe

MD5 bb320ec14d9f6297e8061649aef90fe6
SHA1 fb0bd543fabe5b98bb4595c082bdb23891f97b40
SHA256 363968a3c16f34b7445399fd61ff9552c7bcf83dceadbde1c593b786b91b6c87
SHA512 0aee57754b7cce04b6da395cb881ff8d7714e33348803fe9151815788d5adb3a7c736b0a8d2943ff9538d3d882e1b003a963fda7bc69cf7aa47845d41a7305fc

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 0475830bf8a6bfbf1ccb830603772e25
SHA1 58bfc7ca6706b4424d231fc3861c1dbf51788076
SHA256 0e4226bb724b68fa737968c63572be55b360af05efa8641854933e34c93922e7
SHA512 62a8cc3be6a4d70d79adc5bc873940d094d842f8cd1d95d7521dccacce4e8d8271f216e0ddb09eb18d737fbdd6345c6622c6f8a5620788973e4f5500bcd1f426

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 dac3aaf109de92738b33fac70814433b
SHA1 f6270abb56c2f2dd5bbc63ebd5a82061d910dc70
SHA256 3581f939926ecbfc7ef0087c3923984925396e1ead28f89dc60c74b359842cfc
SHA512 54c7a4166e0ebea8e1b1a6152fada0d48c636fce6b7381a7d12af7f0d2fcdbf3c667f46585a29ce3ebf59beb263ecaa8056c6e73264c2ce9e7a5731f3e8a1b9b

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 218eb103c6b93201a5e1df24e5ec70db
SHA1 f7b400814f4f2499c80534b035aa3bea467f5aa8
SHA256 f7d548ad6c77fc7dd58b37633cd2c479db999a97a95b004f5da099dfb6471513
SHA512 8d31980d9aef01de853a911f57b48c62e5e8346c8e2b18745c3bce0911ea497e41910784a11038d5dfa8850a52ed78826d2cac76edfb971c04f47cab55f77829

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 98ca6b52fceb963a1d9d125aafa29ab2
SHA1 906a8acc2e87e35b36c193101ad58d8d96d6582f
SHA256 217f4452468b2aa4aae8e9f88ce5db2bac4b8d9791a08744c5f3a24880ecf9ad
SHA512 2ea5d67838563d34f0629a70e5c235dc7264f1d6a86674223ec7b1c9e534a1742045007832bf0bb44a6ab912d5c4f8dfe3afbadefc63bd6abe1eacacfc1eaee0

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 5b1b1202f00f2bf56955b381e48b4d10
SHA1 bc1f477f8914d66fdcc610549a11289195ca6556
SHA256 850cf9fd8f27f942843511f73f605d41c308054a51e009397815e9da7819d2d3
SHA512 87e8f955ec01bbcec77f991b5695bf839ed1f5d1a88afbc590a3a712723a509d35a8cda0ebe644ac06151912aa5fbe4921572c46eb4ef04d5506b0c9407a4e4a

C:\Program Files\7-Zip\Uninstall.exe

MD5 9d342c75d1f369b80476b41f202c7b75
SHA1 9bd49eac96159f30d267cff86197b9bed8ce1043
SHA256 7c7561bc1ba0a7f6d2cead7c62e24dc0d5c230c74fb45a40d2618b3276cc7a82
SHA512 ffabae0d84863bb388bb4044cf5f285497bcf7c90466ff87317c509a99ef287152d10273b889c2c2830db885af851d302214c5ec6060b652066fc059bb43cc47

C:\Program Files\7-Zip\7zG.exe

MD5 250520bd491dcafee3cc0969dcc6bee4
SHA1 1a1b8813a004a0ad55da8ac062bc436ce9f66a90
SHA256 790c6a6e4e9c8f4f3a3822d4e341c2139356c7fea35b88e07f7cf040d7c77c79
SHA512 dcd72d62912e3bc77b8860bf41efdf1caf8ba72dfe8da4ee33d909f19518e44fb68a2afc8e83986535e52ed6a81886edbe4dc3d39337d8eb251b1a88902e3646

C:\Program Files\7-Zip\7zFM.exe

MD5 50d41e7d55d89aa25484d396e2f775a3
SHA1 9255216c953cf6ba1de6073c4f41543a54351f79
SHA256 35d11c0108923133d023ba33ae8e56b5ff03dac5e9125ee30790748307d3df71
SHA512 d046ddbf9362d55465a0be84cfb5a7a5fcb43acee57657088ea1b23cd42d39c509fc493a4ef93fd4f9020663142a05442792af82e4989e079452ae5eec9124b9

C:\odt\office2016setup.exe

MD5 969bafdcee7f4b39dc75a440ad9c6cd0
SHA1 fc9f5a53102b1ab6bab4fe0a4f19e9fcfeaf5a19
SHA256 8e7b0635f324b85d6b3b43b3d549a151372e271b0f1e92a84d2c4bd18c4fee6b
SHA512 500bd3576378b5ac2bbc6dbf7ed282d00264f15bd326ceb7e97b85923f10985d36e349d76d025d8a92fd3d842e7b4e5f14862add585d1ee7f6f346e4f66fe757

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 e03f174fc000651f0d024930d7837432
SHA1 53b8dbad9294c0eaa62f4bb009698292e244c102
SHA256 c38a77070b20b2ed91d51f9329ae9d1c09d1efdb0b81e6a3a1bcb245cfbff033
SHA512 c58fdb23e283e4e585d2ba9182336d9b1b5b2b474ec481239c39925e2e9435b6d91031f69b892ae589e9d19d7df0a817437dedf0d5a1b5022196929e02288d85

C:\Windows\system32\SgrmBroker.exe

MD5 fa71b9be6a05da3313a936c342770a01
SHA1 17616f90e95c5652b8b969d55fc7b813826c8d49
SHA256 38789f1eeb587c32abc52a607473acb468f6ef79a3ce683826551c1680aceb2b
SHA512 f3468bec370ead4aab858dc2e86695fbc1377beb92352585e9d1a194816be95817f808d70a08c4f9832584471318aa68299ba6fe8fa699cea2b153db987da6e1