Malware Analysis Report

2025-01-03 07:56

Sample ID 230426-x7st8adc61
Target SecuriteInfo.com.Heur.24719.4239.exe
SHA256 e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998

Threat Level: Known bad

The file SecuriteInfo.com.Heur.24719.4239.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

Script User-Agent

Uses Volume Shadow Copy WMI provider

Checks processor information in registry

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

outlook_win_path

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-26 19:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-26 19:30

Reported

2023-04-26 19:32

Platform

win7-20230220-en

Max time kernel

149s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\58af4aa07693df14.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{70574EF9-29D5-4F84-8E5C-A64C671E7548}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{70574EF9-29D5-4F84-8E5C-A64C671E7548}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{3309F490-277F-4739-AA2B-6BA56511FD64} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 308 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1204 wrote to memory of 1736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 1736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 1736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 1736 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2604 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2708 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2708 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2708 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2708 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2520 wrote to memory of 2772 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2520 wrote to memory of 2772 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2520 wrote to memory of 2772 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2520 wrote to memory of 1680 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2520 wrote to memory of 1680 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2520 wrote to memory of 1680 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1204 wrote to memory of 1516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 1516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 1516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 1516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2056 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1204 wrote to memory of 2308 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 238 -NGENProcess 1d0 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 26c -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1d4 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3499517378-2376672570-1134980332-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3499517378-2376672570-1134980332-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1ac -NGENProcess 260 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d0 -NGENProcess 23c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 1d0 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1d4 -NGENProcess 23c -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 23c -NGENProcess 1ec -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 23c -NGENProcess 1d4 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 280 -NGENProcess 238 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1ac -NGENProcess 1d4 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 23c -NGENProcess 1ac -Pipe 280 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/308-54-0x0000000001250000-0x00000000013E6000-memory.dmp

memory/308-55-0x0000000000BF0000-0x0000000000C30000-memory.dmp

memory/308-56-0x0000000000550000-0x0000000000562000-memory.dmp

memory/308-57-0x0000000000BF0000-0x0000000000C30000-memory.dmp

memory/308-58-0x0000000000590000-0x000000000059C000-memory.dmp

memory/308-59-0x0000000005E30000-0x0000000005F68000-memory.dmp

memory/308-60-0x000000000A5A0000-0x000000000A750000-memory.dmp

memory/1252-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1252-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1252-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1252-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1252-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1252-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1252-69-0x0000000000660000-0x00000000006C6000-memory.dmp

memory/1252-74-0x0000000000660000-0x00000000006C6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 d079675794398c4aec92a7d7e9b45323
SHA1 a72bc263291e9682418b43d614044cdf796878ed
SHA256 2e7e74d7962daab0dba5756756bf59634d5400d65b288873d74f55a1fda60733
SHA512 4b7aa8fa74ab0074915ce49b7efa75734a3088462d67cc4df24ad6acdfb79431efe7a545983bfa5030baa5f965d58ab018b43663b20b45be44d3d23de0ae55c3

\Windows\System32\alg.exe

MD5 d079675794398c4aec92a7d7e9b45323
SHA1 a72bc263291e9682418b43d614044cdf796878ed
SHA256 2e7e74d7962daab0dba5756756bf59634d5400d65b288873d74f55a1fda60733
SHA512 4b7aa8fa74ab0074915ce49b7efa75734a3088462d67cc4df24ad6acdfb79431efe7a545983bfa5030baa5f965d58ab018b43663b20b45be44d3d23de0ae55c3

memory/1160-82-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1160-88-0x0000000000820000-0x0000000000880000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 12e9208549088f0ac30839ad2db8a6f9
SHA1 74e20ca68b8b3313a6e441f9e8d592aee54561d9
SHA256 322e64fdfdcc36ff053c41e5c0001cf41fcf08235fd99d818e9de3d00d5976c6
SHA512 7f98bf7317cf083a28811dd248151d5b63978982125d0d8ff4e095a224f6e840735a14d5388f94ed73140c86971f9c77bb54ac9b0e84ec20f7275a4b99eabf62

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 12e9208549088f0ac30839ad2db8a6f9
SHA1 74e20ca68b8b3313a6e441f9e8d592aee54561d9
SHA256 322e64fdfdcc36ff053c41e5c0001cf41fcf08235fd99d818e9de3d00d5976c6
SHA512 7f98bf7317cf083a28811dd248151d5b63978982125d0d8ff4e095a224f6e840735a14d5388f94ed73140c86971f9c77bb54ac9b0e84ec20f7275a4b99eabf62

memory/1252-94-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1160-95-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/564-97-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 08f6c3d136d5a8b4857e39deffcf1636
SHA1 87f0db60a7ec8dea58bd0e62e83d47c9a29934fc
SHA256 48321ee50d7cfaa1f23afaa9163938cd0cb7242118f22c592a62b1f86a25fa90
SHA512 651e8db40cbb3991a919ba00465c86367d52337aa9e94018011af6739ace681626283368cc805abe3dda2cf4f18b46878611e8c56e5c6ed73f4682073eb714c3

memory/796-103-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/796-104-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/796-105-0x0000000000090000-0x00000000000F6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 892765ab4749602e05f7d25fbe57ac18
SHA1 dd989b6b6101c2712623d2633a58bccaa63480b4
SHA256 f8a5a67e87a87f134c6050f999a33faec6d339bf5200fb6a7abb6edab27df7bf
SHA512 47b7329d385d749a3a05b39e4a51c4b8de2b7d7ce7cc67d6fc95aed87ada6d2ed12961c1de9c64e825598a9b96062887e6fd5f264dce8caafc86c0f9d6d24da1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 892765ab4749602e05f7d25fbe57ac18
SHA1 dd989b6b6101c2712623d2633a58bccaa63480b4
SHA256 f8a5a67e87a87f134c6050f999a33faec6d339bf5200fb6a7abb6edab27df7bf
SHA512 47b7329d385d749a3a05b39e4a51c4b8de2b7d7ce7cc67d6fc95aed87ada6d2ed12961c1de9c64e825598a9b96062887e6fd5f264dce8caafc86c0f9d6d24da1

memory/796-109-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/796-111-0x0000000000090000-0x00000000000F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 08f6c3d136d5a8b4857e39deffcf1636
SHA1 87f0db60a7ec8dea58bd0e62e83d47c9a29934fc
SHA256 48321ee50d7cfaa1f23afaa9163938cd0cb7242118f22c592a62b1f86a25fa90
SHA512 651e8db40cbb3991a919ba00465c86367d52337aa9e94018011af6739ace681626283368cc805abe3dda2cf4f18b46878611e8c56e5c6ed73f4682073eb714c3

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/1204-119-0x0000000000230000-0x0000000000296000-memory.dmp

memory/796-121-0x0000000004C10000-0x0000000004CCC000-memory.dmp

memory/1204-125-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 892765ab4749602e05f7d25fbe57ac18
SHA1 dd989b6b6101c2712623d2633a58bccaa63480b4
SHA256 f8a5a67e87a87f134c6050f999a33faec6d339bf5200fb6a7abb6edab27df7bf
SHA512 47b7329d385d749a3a05b39e4a51c4b8de2b7d7ce7cc67d6fc95aed87ada6d2ed12961c1de9c64e825598a9b96062887e6fd5f264dce8caafc86c0f9d6d24da1

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 fb258dcc583fdf87749cf44068a59ff1
SHA1 545c3eb5e7d946fa933d60ebd99f15947041e92b
SHA256 009cc51f3a56efafb32011b5f1c3835b2d9bde3146d9b358886778f2248398a2
SHA512 e3613b55d8c50959f2ebfb498a8fc896aa0b224570fde2de12cd59d956482e686f67853b7e6b42100645cd61f9b6427fbc98a56e5f48994f774d23bc12198501

memory/1424-131-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1100-133-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 974681f09b32705d732d4cb6ad4fed1c
SHA1 76d9fa88f6ec8ba7788e4da15a55925cd2856298
SHA256 d1a76bf15ca37afea5900b18376a2cdb54aa83f745e1221dc2c94fbc7a302dc9
SHA512 f2288513748d35c9fa8b81416eb249239b56d3c979efed4984a0046a6389e7504872fb4f621667eca4b6c60a14136b27cb19e170529d43c18fa30742fd0486ce

memory/1204-137-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/796-139-0x0000000000D60000-0x0000000000DA0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 0479f24899b32a0e49a1052c1b3b451c
SHA1 9bf0db25b1ac98f5f1bf8ddb3998abbc34af47b8
SHA256 30d64d9663431e3e7ecc778597f97ff2496dc6e3261b7a50b69d229ab39c2b8b
SHA512 5d409d4e2d613efca70236941a63611cda5bbc6c7b6e19a72598665be3ddf2ce9a09e60a230fccd8a32fcd8955c0ccc02e817b7252d50d827e257c124435ad0f

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\System32\dllhost.exe

MD5 d7e3952ed091f484040dd26c99eb8ea0
SHA1 6f8646952a3aefffdf610d7514c4184fc044ccdc
SHA256 b2d9c40a2658c5e78491bb1e057bce977412eb918451ced1de111c5129f19892
SHA512 4e52f8a3551aae867926bcdb07a5c988fc64d5df579726f08c7e83b2f7186764950f0bbf27934efc67208ebc8ec4ac6960bfc41a9320b95d3ef1a4f0b173d854

\Windows\System32\dllhost.exe

MD5 d7e3952ed091f484040dd26c99eb8ea0
SHA1 6f8646952a3aefffdf610d7514c4184fc044ccdc
SHA256 b2d9c40a2658c5e78491bb1e057bce977412eb918451ced1de111c5129f19892
SHA512 4e52f8a3551aae867926bcdb07a5c988fc64d5df579726f08c7e83b2f7186764950f0bbf27934efc67208ebc8ec4ac6960bfc41a9320b95d3ef1a4f0b173d854

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 0479f24899b32a0e49a1052c1b3b451c
SHA1 9bf0db25b1ac98f5f1bf8ddb3998abbc34af47b8
SHA256 30d64d9663431e3e7ecc778597f97ff2496dc6e3261b7a50b69d229ab39c2b8b
SHA512 5d409d4e2d613efca70236941a63611cda5bbc6c7b6e19a72598665be3ddf2ce9a09e60a230fccd8a32fcd8955c0ccc02e817b7252d50d827e257c124435ad0f

C:\Windows\ehome\ehrecvr.exe

MD5 43337a2b81a94f3490cb19228dbde3d1
SHA1 54944460e068e0cce696a182b925043c7e0d1664
SHA256 6acb979c501259e1b63ae9f294a263170aaef5ad8fa0f28b4dc2d008eb6ad314
SHA512 41ab2316dbb90350e8bf8fab28d01b1bcb54b7614fa9c3ae681907b232a366aa2b44c510491d084b61553b0b2f212e688223e90d495c02e394a19a0a972ba9e4

\Windows\ehome\ehrecvr.exe

MD5 43337a2b81a94f3490cb19228dbde3d1
SHA1 54944460e068e0cce696a182b925043c7e0d1664
SHA256 6acb979c501259e1b63ae9f294a263170aaef5ad8fa0f28b4dc2d008eb6ad314
SHA512 41ab2316dbb90350e8bf8fab28d01b1bcb54b7614fa9c3ae681907b232a366aa2b44c510491d084b61553b0b2f212e688223e90d495c02e394a19a0a972ba9e4

memory/1832-151-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/1832-157-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 b1dcea37b4ded6fb733eb88831f038fe
SHA1 55a2abc2b459b3fe36317add8f732516fff06e29
SHA256 1e04bf4f15414d7ee6f45dff18144927fa3665dfea81eda25d91b1df59247f5c
SHA512 f1c9fc8554ee07c8642c395a4672c93d95b237395803bb325f860263586245d96e2eb8076a580f612e633c7cf05e078db2ec4c462f23998830bab3a8fe1f59d2

memory/840-162-0x00000000002A0000-0x0000000000300000-memory.dmp

memory/1832-163-0x0000000001380000-0x0000000001390000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 b1dcea37b4ded6fb733eb88831f038fe
SHA1 55a2abc2b459b3fe36317add8f732516fff06e29
SHA256 1e04bf4f15414d7ee6f45dff18144927fa3665dfea81eda25d91b1df59247f5c
SHA512 f1c9fc8554ee07c8642c395a4672c93d95b237395803bb325f860263586245d96e2eb8076a580f612e633c7cf05e078db2ec4c462f23998830bab3a8fe1f59d2

memory/1832-166-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1584-165-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1832-167-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1700-169-0x0000000140000000-0x0000000140205000-memory.dmp

memory/840-173-0x0000000140000000-0x0000000140209000-memory.dmp

memory/840-174-0x00000000002A0000-0x0000000000300000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 3ae0fd144c7403a42e6f990d24cd54e1
SHA1 15489b2152ff6dd5a92950f13d1d9573f7be78e7
SHA256 70225c1f7dd08b8435d95bb5aa0fd74b3473ebd792ff4014294741ff56d49051
SHA512 60ef076fb4a5dab3c02a71a49b785345a80e201cf8cd94dd815cfca73062738ae1e7d93f3416defcd862324e1f4312708f91a7bb5b4ad654d8ac232662da7cd7

memory/1104-179-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/992-181-0x0000000000160000-0x00000000001C0000-memory.dmp

memory/992-188-0x0000000000160000-0x00000000001C0000-memory.dmp

memory/1832-192-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 bf598547268e2b69aa6fa4e1b008c0dc
SHA1 e63c5d10f51bbf5249ab01842fc89c31f8d4a178
SHA256 15dc7c15babf20fcc2dfbed418a50158ef3b90548138576273109f809c99fab4
SHA512 5fe603968998e7690b0ffec2edb693f1d822637eddc1294dc21f868eb46f7b5874d08c3eda945f9986a9c5b6896ea3639f0acf3d023aec2e4d1f129a16b91745

memory/1104-194-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1624-197-0x0000000000C30000-0x0000000000CB0000-memory.dmp

memory/992-201-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

\Windows\System32\msdtc.exe

MD5 647c2f4b40ffe0c6d9e4c8bf89c737a8
SHA1 e735e386092a0c0165aa11f5bb92b0405f008d05
SHA256 50de595198e46c801bd8a76f7d96f1109a663cbc08c84950daa3f805795d6ee2
SHA512 7b4dfd9795f8bdf2b7849e2c481beea85d153903f48e9b70f5235323e6a0715c2e3aed96c6c0943d3e3210fb62e9222cb4b01c55042ad3c2b50c8f55da1674a4

C:\Windows\System32\msdtc.exe

MD5 647c2f4b40ffe0c6d9e4c8bf89c737a8
SHA1 e735e386092a0c0165aa11f5bb92b0405f008d05
SHA256 50de595198e46c801bd8a76f7d96f1109a663cbc08c84950daa3f805795d6ee2
SHA512 7b4dfd9795f8bdf2b7849e2c481beea85d153903f48e9b70f5235323e6a0715c2e3aed96c6c0943d3e3210fb62e9222cb4b01c55042ad3c2b50c8f55da1674a4

memory/932-224-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1736-226-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1460-229-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/2120-241-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2176-242-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1624-245-0x0000000000C30000-0x0000000000CB0000-memory.dmp

memory/1460-248-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1736-249-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/2340-263-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1252-264-0x0000000000400000-0x0000000000654000-memory.dmp

memory/564-265-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1624-266-0x0000000000C30000-0x0000000000CB0000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\8f96978fc46d9f00d8780351026924d7_e5bb12bd-5c29-4c03-8405-2e8855cd8e1a

MD5 db733e033c397fec5917611957620271
SHA1 6f94d1daa0fc4ec1b2d4cbcb93730d8edb77a2b7
SHA256 1f3ffadd3b80c7f95be06e245410768e8302a24e573868da3c6fd91230025bdc
SHA512 9a9bb4cf6380bb0a73ea414ca2226a344c7da003e49610dc38bd10892dc17244e4c88bf8a466131027e3c064c693ad99014e6853fff51edb21cb690b926b962f

\??\c:\programdata\microsoft\ehome\mcepg2-0.db

MD5 b201535a8b9914e84e02502e41010322
SHA1 503bee7881e7bd358aad5a85835c157690c83f03
SHA256 65fcfc7baafa42c097114cb922a56e95351c54f7f079e27afb196dc593d732df
SHA512 031b88228e16d56fd99102a43f4c9c2af8b9cb50be01807722cbe889aa4dee475e58771b62b92a63b3907fc209a17932bd3129163b041d66f06f250de30783a9

memory/840-271-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1832-270-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2476-272-0x00000000009F0000-0x0000000000A70000-memory.dmp

memory/2476-273-0x00000000009F0000-0x0000000000A70000-memory.dmp

memory/1104-274-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/2176-286-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2604-287-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2340-288-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/2708-292-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/2604-309-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msiexec.exe

MD5 4d0b42a20324379bac038be9bedab4ca
SHA1 14cd2c1d64217f7ea63846aa0e9929acfcde88dd
SHA256 e3bfc2c75164b1cb3654abb4de7e3784056d94cce68a1aaa5d30a69cb6a7a86c
SHA512 162b5aa9bce82e8f28f377a422cdec22ccdfbc000741225454353d9ca7bb28f24180f1dcaab6761639c4a5b06d1a434dad2b97ea9c5dff4a3fb912705b1ccd29

memory/992-317-0x0000000140000000-0x0000000140205000-memory.dmp

\Windows\System32\msiexec.exe

MD5 4d0b42a20324379bac038be9bedab4ca
SHA1 14cd2c1d64217f7ea63846aa0e9929acfcde88dd
SHA256 e3bfc2c75164b1cb3654abb4de7e3784056d94cce68a1aaa5d30a69cb6a7a86c
SHA512 162b5aa9bce82e8f28f377a422cdec22ccdfbc000741225454353d9ca7bb28f24180f1dcaab6761639c4a5b06d1a434dad2b97ea9c5dff4a3fb912705b1ccd29

C:\Windows\System32\msiexec.exe

MD5 4d0b42a20324379bac038be9bedab4ca
SHA1 14cd2c1d64217f7ea63846aa0e9929acfcde88dd
SHA256 e3bfc2c75164b1cb3654abb4de7e3784056d94cce68a1aaa5d30a69cb6a7a86c
SHA512 162b5aa9bce82e8f28f377a422cdec22ccdfbc000741225454353d9ca7bb28f24180f1dcaab6761639c4a5b06d1a434dad2b97ea9c5dff4a3fb912705b1ccd29

memory/2476-320-0x00000000009F0000-0x0000000000A70000-memory.dmp

memory/2856-323-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2856-325-0x0000000000550000-0x0000000000759000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 97f8fdeeea85b91c88fc30524f1f1f02
SHA1 d512ef2ba27eca3bc71b559b3e4a30b7a30cada3
SHA256 bec47d4eeaf83bda50c2be63792a506ff95702cd9640d1772647e4464690b7bf
SHA512 3ef673adb6eb39c032598e3b2c23d2614d4ce62be7401cf807dc938cecacf4bb01518212eae484dac17940f3da2a9d04bd81caaa94205e1759e589afb8a9bc2d

C:\Windows\SysWOW64\perfhost.exe

MD5 54a10d8dce6445878728a56e8cea60d1
SHA1 6215cabc86a7169324d8abfc8ae8d50b355aebb8
SHA256 9a2ed2c364735f8298953e4868f14480257ce41d5c949320757dc28e10aede3a
SHA512 dbabd8f90f6e9d26f09c4c23ece71f8bb9a4fd78191f4e17136143e3cd9b2d4ccc700019365656095e130c0739a71dd09c3f9dd2ec2b0c423df9930fd987c5bc

\Windows\System32\Locator.exe

MD5 04f46591cf5457ba994f01d6f98fde9c
SHA1 b475c37f26025c14e023947053feb154be6aec52
SHA256 aac313e506d0fdb4b0d42ed7d85ffc3b48bc62ecf50230678293811d52f3860e
SHA512 e64ff228eccab4e2d17b9721d018aff4cc9d3ff23d37d3ec369e7f09d33a50ffeb4b22b63ca6cf77cbe57cf50d594be3b6fdf5a61382bb5f087c7258eeac6341

C:\Windows\System32\Locator.exe

MD5 04f46591cf5457ba994f01d6f98fde9c
SHA1 b475c37f26025c14e023947053feb154be6aec52
SHA256 aac313e506d0fdb4b0d42ed7d85ffc3b48bc62ecf50230678293811d52f3860e
SHA512 e64ff228eccab4e2d17b9721d018aff4cc9d3ff23d37d3ec369e7f09d33a50ffeb4b22b63ca6cf77cbe57cf50d594be3b6fdf5a61382bb5f087c7258eeac6341

memory/3036-343-0x0000000001000000-0x00000000011ED000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 ceeaf2e5577657abbae66633e0a462b3
SHA1 1d502c1152d6031ecf607799a00fe9b17d8aa860
SHA256 47ac0454bef1db45203af57fea9de38cd2246f04f80e385e148fc6aef55ce821
SHA512 c43ab5192f521bea6a893094fa457c995571178ecad5f104ceb831f0e3f8595322d64770794c7754da75b15efa7ab34f706e549fe295b4d430864ff1c76fbf10

C:\Windows\System32\snmptrap.exe

MD5 ceeaf2e5577657abbae66633e0a462b3
SHA1 1d502c1152d6031ecf607799a00fe9b17d8aa860
SHA256 47ac0454bef1db45203af57fea9de38cd2246f04f80e385e148fc6aef55ce821
SHA512 c43ab5192f521bea6a893094fa457c995571178ecad5f104ceb831f0e3f8595322d64770794c7754da75b15efa7ab34f706e549fe295b4d430864ff1c76fbf10

memory/2964-348-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/3064-350-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/2708-366-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 be83ff2bd23138552fa50a78c5da0ef8
SHA1 ebd19ab029dc717054736050bc9297afd3ad6dd2
SHA256 7ee22d74652c2680fb220d7f62591cb25e09b539832f8e0f41b835b08122cff4
SHA512 17f74e78db45a066715445e3ea134f64e425871a4846f8868d489dfdc811eaa4ec47c5b410b288fd57017e29d6214b508bbe63a6a877dc31f5c2d5d0ec983df3

memory/2164-382-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2392-384-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2052-386-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/440-388-0x0000000100000000-0x0000000100219000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 26ac29c21b8e96b9f43beb5ccb8e5e2b
SHA1 e187367978bf8767c51b52c7122d0d503549d529
SHA256 b2cf7dfb99961895c37c6ebeaa700f7819dd569e01d8520b3b82f7118f4c54f3
SHA512 f61455535b4ece2b8057b941faa7224cb43720ad792c4486e0ac3efa190c2e5e8c5402939fc6010f5ea6c4b422579d289605539e02b6fbb25bfdbbcdadce0cdd

\Windows\System32\wbengine.exe

MD5 26ac29c21b8e96b9f43beb5ccb8e5e2b
SHA1 e187367978bf8767c51b52c7122d0d503549d529
SHA256 b2cf7dfb99961895c37c6ebeaa700f7819dd569e01d8520b3b82f7118f4c54f3
SHA512 f61455535b4ece2b8057b941faa7224cb43720ad792c4486e0ac3efa190c2e5e8c5402939fc6010f5ea6c4b422579d289605539e02b6fbb25bfdbbcdadce0cdd

\Windows\System32\wbem\WmiApSrv.exe

MD5 5295f3bc2795a2a0fed4b4d64cd5ca3b
SHA1 491b57ae7c36f698668d48c141ed1cfa16ad18b8
SHA256 1a5f3df093caf74e649aac11fbc96f3dff1141657fc5ca734f638bb7e8c859f2
SHA512 2ba6cebce6e07d92e11e4dd1d3d857dd91a4eaff6645248f7c27a71ece5d5d87cc7ab65d15b702b7fc2b48af517a6c514c5e68b6f348e7f48955cf8b52a1c74e

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 5295f3bc2795a2a0fed4b4d64cd5ca3b
SHA1 491b57ae7c36f698668d48c141ed1cfa16ad18b8
SHA256 1a5f3df093caf74e649aac11fbc96f3dff1141657fc5ca734f638bb7e8c859f2
SHA512 2ba6cebce6e07d92e11e4dd1d3d857dd91a4eaff6645248f7c27a71ece5d5d87cc7ab65d15b702b7fc2b48af517a6c514c5e68b6f348e7f48955cf8b52a1c74e

memory/840-413-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 be6b3f1f1082b366d5f66bfe094e4e33
SHA1 567e2a248e39c2bf52b1f54c087af3672de6fb82
SHA256 5026c16503277d24fa1f61e5e58c97eeec0cc6a939b260523dc1b907e5a16bad
SHA512 2d509ebe6ff760479a4d1681639dafd2447eca391c34e68b08d084af49f8203581b5ea4e8a6b21431d60a0a6c56032012ca0455c0b89e6f29b0ed7eef22dd673

memory/2768-429-0x0000000100000000-0x000000010020A000-memory.dmp

memory/1384-431-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2424-436-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2520-438-0x0000000100000000-0x0000000100123000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 d29973db8cc9986b245bce0a21d3fa5b
SHA1 591fb6a0f026503992e830a354f44b4a9692a401
SHA256 cd6ea3a57abbed894ce5e6ce51f0132238e09fb13a624d17898a9e92323fdf6c
SHA512 9e7a605768eefaf8e254c2b26bc985becec0888d5403203bc8ae39220ac684e22d2b217eea0e5ab7a2588b7bf0ec73e4381239cbec50522f0ae3cbcea97194d0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/2052-569-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

memory/1516-580-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 b35434e7d241f57b425913caa0db3070
SHA1 125fbf40800934e2107b172ac78ea2f492ba12b6
SHA256 70495b2c4641b676c9489b27d6c8427c1ab8d09731e00b07c87f52cee48c2a65
SHA512 f51ea0b0ac356f72440ce7cfde79060ab44408e44056b93496b673936105c90a2c2977d7665d432125f1a7ccf4168ad2586544d35a5db39e1c773f6cafd133ea

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-26 19:30

Reported

2023-04-26 19:32

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e64c811cea807a0f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007b013818678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8be45818678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005fc7e898678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecc58e8a8678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000093c1d898678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000872467898678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db62a0898678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e91235898678d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4196 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 4196 wrote to memory of 3332 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe
PID 3332 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3332 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3332 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3332 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3332 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2024 wrote to memory of 2192 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2024 wrote to memory of 2192 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2024 wrote to memory of 3448 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2024 wrote to memory of 3448 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.24719.4239.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 20.189.173.5:443 tcp
NL 8.238.20.126:80 tcp
NL 8.238.20.126:80 tcp
NL 173.223.113.164:443 tcp
BE 23.55.97.181:80 tcp
US 131.253.33.203:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 przvgke.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp
US 93.184.221.240:80 tcp
US 52.152.110.14:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 deoci.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 udp

Files

memory/4196-133-0x0000000000D00000-0x0000000000E96000-memory.dmp

memory/4196-134-0x0000000005F30000-0x00000000064D4000-memory.dmp

memory/4196-135-0x0000000005840000-0x00000000058D2000-memory.dmp

memory/4196-136-0x00000000058F0000-0x00000000058FA000-memory.dmp

memory/4196-137-0x0000000005B40000-0x0000000005B50000-memory.dmp

memory/4196-138-0x0000000005B40000-0x0000000005B50000-memory.dmp

memory/4196-139-0x0000000007AC0000-0x0000000007B5C000-memory.dmp

memory/3332-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3332-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3332-144-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3332-145-0x00000000035E0000-0x0000000003646000-memory.dmp

memory/3332-150-0x00000000035E0000-0x0000000003646000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2d3c5fba332954bb8d99424feb4ff60e
SHA1 3417e28e3f08a384f152318edbfb95b19e7678f8
SHA256 da2adc0f300ae2aa0b177d5499128267ee804e2cd1eb565ac2dfc082f5431b56
SHA512 a5619f0e87bf712a43073c161799dee6515d0545f913b21ce87082461b34a5c681674fac99e86185034175f0fe9dbc5f69b1e27bffff62370c40c4efa5a57a36

memory/3228-157-0x00000000005C0000-0x0000000000620000-memory.dmp

memory/3228-163-0x00000000005C0000-0x0000000000620000-memory.dmp

memory/3500-169-0x0000000000650000-0x00000000006B0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 297e73a07709d82e57871cdc1da5e15c
SHA1 8d307c866623de870bc17a70a3738cb19096ee28
SHA256 88c81588c15f4a2afa7bff70bd1c1bb54c64598ede8bf7d6e3782813d53f215c
SHA512 563a242c0da22c0a72e0143990d0e1f60d4418b7ea3578eeb962da1b306dfc009b6660ddf27b5fbb91ced6cb9e7db8c7c598bd041ef3378be03b08aed9e4ae55

memory/3228-172-0x0000000140000000-0x0000000140201000-memory.dmp

memory/3500-174-0x0000000140000000-0x0000000140200000-memory.dmp

memory/3500-177-0x0000000000650000-0x00000000006B0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 f48a90451c74b5cb6ac982dc56bbe52c
SHA1 829c9b55e2979a244f704411dfeb6ca0e33ad93d
SHA256 ce5c4ac65bd18d3d7c0ccac35f59333eb82d2fdeebe45e709f7919f0a6d48424
SHA512 49739aba1025aeaa5818bd5f47c559557cec96274ceb12ce2b16fd260fe36108cf1644d1fc0954d71a3e7173bb025d4068c11b9863e72160e3c5235ac85d22f9

memory/4648-180-0x0000000000B00000-0x0000000000B66000-memory.dmp

memory/1252-182-0x0000000000E40000-0x0000000000EA0000-memory.dmp

memory/1252-188-0x0000000000E40000-0x0000000000EA0000-memory.dmp

memory/1252-192-0x0000000000E40000-0x0000000000EA0000-memory.dmp

memory/4036-198-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4036-196-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/1252-195-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 4d66cfc9c219edb9359eaf72b7c3bbd1
SHA1 1a5b7cdf34474f840f79446eb9077236498a2a12
SHA256 6c9570b8661dfa31cba1eefa9054ca489a4dba888df4f0460f366b72476bef0f
SHA512 7a97298a09389f7a302f2e616efad18d95c75532d9900949b68a4457675c6d08cbe58aa1bb97a754ce01f5f625d4da225cddacd1dcc5f53a963915d0dc971234

memory/3332-200-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3500-210-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4036-211-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d7dfeab5894d679932d510f780df4e1c
SHA1 d51d346c47519f3729b598679cadeb1a10d0136e
SHA256 7ffe6b8984c8130b406eb3877b296e14e17d1c665bf677ddc2edfbd91711891e
SHA512 d6a496581bc55b85c652400c5f25f8beada0df0b5bf52556e46274b346d6fd4d080870ee64e2dc5d9ca4de2598653fe962fe08d608e6033eeba1c1e3e6f35280

memory/4640-214-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4640-220-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 322fc278922d2b72410d016110ec81f0
SHA1 a3df931741d099de375dd0e407dfbf77a18d723e
SHA256 a9b27beec4315fa2bd1fd742bf2cdd2da963f5b5c2883b02f11ada9538aafdcd
SHA512 30c75486a0590ab71396d79a6ee4923a2afc59d51ee80df62b36b0c5ed392954e0b5dc2b21a8d62505f751fcdcb6b8abe0f2951013311490c631c62606b79b0d

memory/3816-224-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/4640-229-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3816-231-0x0000000140000000-0x0000000140221000-memory.dmp

memory/3816-232-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3816-236-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3816-238-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 63bbc84ff17f2aee763a20d00a6d06ee
SHA1 9161b3f1f5cdec4db9656da786b999c8f6afdbcc
SHA256 d043bc838a39a1e226bdb71ee0bf24b63480ea762f1e0ce77caaa4a1dafb026f
SHA512 c805daef0fbc3e156f0ddf1b0135661d56d818c2a19ac6e9db9b85d93ea7f369406c1516f6ba32f635f252caf8ee0d2aef872791d4a2c86299a6cfe1786057dd

memory/4036-240-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2612-241-0x0000000000CE0000-0x0000000000D40000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 e8a6904d98db79c1530f4d8b55503c89
SHA1 73a644d0b750d36339094f3feabb78b51fa042b5
SHA256 8f03589cbc748b89e0ecf645d1b1971d4d11c302a585fc26b1501fc092204d0d
SHA512 c4650a4b2a6e687399a507222afa7652d50d0d74b83dea5b01e834baffba9751bd9f326878713a02bc4e42ca1d432d7f631d5e6225c6f7d81d49e213d1bb325a

memory/1892-256-0x0000000140000000-0x0000000140226000-memory.dmp

memory/2612-258-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 f6ec7243bfd5aa9460986a9973b9ead0
SHA1 633fddd3e7b901a8f0784bd3ab817fd7ebb5dddd
SHA256 3d4ad01fa64f74ec240d9db9b6b7537ce94114e7c93a20a003348553542d7e3a
SHA512 937133967eff81e4dcf9ce2aacbb28e337b7086fd56149abe3900c8e9b0a20df163934060559f576650e51e13069bd64ff548ecdd3402e326fb257d17b432159

C:\Windows\SysWOW64\perfhost.exe

MD5 cc982a8c1e9a51b529ee8521082e2c54
SHA1 37cad7441bb3390a590d2b65a4109ab2793d46ea
SHA256 59e9144a4f2510bb774a7c14c2d9caff43582fedb8cfaa01b776fa2e4971f22e
SHA512 e798ddd6c5478c8edfaa30c94b989be63009ef4cf40618542468f083784489cc16be6f4f13b2525159605abb6ee08f9d63a55a29bd7c09add04a3e38746b76ae

memory/1372-278-0x0000000140000000-0x0000000140202000-memory.dmp

memory/3240-280-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 1a396e0cf2fdc2378bbab0c03daa3bf0
SHA1 a1dd014477181909b6fd228f06723f73d24f078c
SHA256 99234ff634daabce9ff789d29b65955814e65cd86319bd809310c1a1e24cefc7
SHA512 76c3622b9b642467319270533798e8ab2c92fa95546c11ea5471ff6eed9035cf481fff3c98b0793ffe4676a51ea487136da5d4d109ea0f8efde82c8eb2c8078a

C:\Windows\System32\SensorDataService.exe

MD5 5da8d47f02195ca44d4145a2dc5ee1ae
SHA1 d0b091d72ec8c84a03483f4bc61e15be1fa5f20d
SHA256 3cc39ff2e2f6933de615d385e8f1213fe38a554faa2edd4d3c7a246d0fcab456
SHA512 5f156120f3863b96246d8e8467d868e148e8e68fda84f6149f3a58ce93c77b85fc568b0f429fe6e769e8b0649a2412f066e3938afba584f6829e89d7347628bd

memory/3452-308-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 506fede5d75c621ca4150c9df1addc2f
SHA1 99d98d5c4e9c3be9f90a724dd411534cb1d60358
SHA256 d42650e940fa0236e732abac33f1a7093439784be5734f9e356d9fb054a21d09
SHA512 1c95fca3d03f3363b809373a4449ab29e6b88c65c3b68ef86f5214576f66cc49340a957c61f03b425c6c9dd36791807008efbf8cf6248bae37c70dcb1a202db1

memory/1696-311-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 6d434f019f2b58663f2a796d6e90ceb7
SHA1 b4b0ff84fd12bea2138627bcecbc7d2abd29be57
SHA256 4185e59bc984aee9d83aa0efcf5002960a1fc431a542ee2f27df61080a200402
SHA512 bff4f2f020bc21b121a359dfc46dd059bfc85fb155d77855e57abb07f445270ef75c377df067f5cce5c4cec32b4621d1ebccba16fc6f1e3ae0e1fd5483e47897

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a7048c69d805dfb7119adb8866f71b2c
SHA1 2681e9811c4bd1dfa726f5056d7524b9be3b5394
SHA256 3e3bdee38df0179d58f08ae10f1265a3c96c8ec9f3b77307e12ee64cf7fccc0e
SHA512 d71581b7dbf7d4f95eec0ae409ebe21c7adf68559c5a8ab60770a1fc89850f0e7916515b5fd6a86faad0aaad43a06cf94f20b5f6af097c2ccc2f91a6d4b61d8d

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a7048c69d805dfb7119adb8866f71b2c
SHA1 2681e9811c4bd1dfa726f5056d7524b9be3b5394
SHA256 3e3bdee38df0179d58f08ae10f1265a3c96c8ec9f3b77307e12ee64cf7fccc0e
SHA512 d71581b7dbf7d4f95eec0ae409ebe21c7adf68559c5a8ab60770a1fc89850f0e7916515b5fd6a86faad0aaad43a06cf94f20b5f6af097c2ccc2f91a6d4b61d8d

memory/1900-333-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3980-335-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3824-337-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 b707e8ee2d4cb6a06162e4de3e7fe7e0
SHA1 5cf9f69ba0dbcff9403ad711ddc3a1a573c39cc6
SHA256 3696ec2a28f228c24f3de214b185cabdde00adfe9b637c508404cc42e5b73147
SHA512 b95e8306251de66acdbe18ce8692cc3f213dc497e23836783cff5b4ab8f4917b5c6da5d4c3489452e99a33eb1254f6a51502af73d414c8d07657ec52629cd591

C:\Windows\System32\AgentService.exe

MD5 25984cb79fa6320f7a8c17cfb8343059
SHA1 4f738046438369427aa98b987dfd65b7ec93f9ec
SHA256 5560b6e352333ca6ae4c8cdd0464e78b7173551e473eb612e75533fa76a3d0a4
SHA512 47dee71391a2a3f90a9c544aaaab2a9868cf838539a222cccfc6055e59e21f7102f84bccc36e948022b110ba3470f34316f9390bbf2b796bcd247af77d7aaf32

memory/4360-366-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2488-367-0x0000000140000000-0x0000000140239000-memory.dmp

C:\Windows\System32\vds.exe

MD5 a729e6926a36142d4b2b9bf69d52852e
SHA1 679bb564fde7d80cbc88e0602e7eb6c643c21c43
SHA256 beb1a83e8e95903ecb03ebfeac021ce2526f1fa21805d6eaff67cc74a8063d6d
SHA512 f7fc9ae8896db792156ade77ec678476c75eef2a23e12a3ab15a7889dfd09269272ed657731dcd53c201b8c83e5e13a78dbf340d7a3513feb6404e133463212c

C:\Windows\System32\VSSVC.exe

MD5 6b706914f6c0fbdb629b0d32ed3974ba
SHA1 882f49b6d492fc3b984517d7b6872deceed05d44
SHA256 b537e57565ea874041e8246545d853f45ada0dbe441f234af152243ac5dd17f2
SHA512 5b7701e88f23991933628a0fe5452cef793c803475d1caab9fc46116a0fee4914c1a63d3760d548a0995bef00bc03feca4e04a3cf393198bc0fccdfa772462a6

C:\Windows\System32\wbengine.exe

MD5 f2477bd30f0df762665813e80422125b
SHA1 2d8312b537d1cce0aa22a399130286dfa011fc75
SHA256 0511583e9920a1c0a5299fc671fb7ed8de6c875eb07a7ab689411d73caf7eb73
SHA512 3b8a0d21ae7ec1f8db1d4cd9a398657cc9cd93945a2653dae92cd2af510413de54ec9c716950b20e097a79ae18707e8715bbf3b1fc74400d1cdbb34790052b84

memory/4232-389-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4656-390-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2952-393-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 19295e96e919856d0ff9b75c8e72f278
SHA1 1c8f74759670685582d6f4f8a2651389d98d8627
SHA256 c9d3354316646b18f03a780f13f54b048f7fde5bb6b4878c066a8e8e8891cf9d
SHA512 12094c37191b9527411f93a9ada9b85f764777fcb5b8c1f8400739ef080dd2d577026edb3d9472e05a7db9f63bdd5066601af177eec883f6271ed79518410836

C:\Windows\System32\SearchIndexer.exe

MD5 0e4a37364f913d3c2492cd973f2e5175
SHA1 96feb09ec2013a46d9772998a94e392369b8949b
SHA256 4484c236547102c4d0f14f85b20286cab03b84e7d66936ec7ee45aa9497639ad
SHA512 0eafa7ca11037fad8a7153ddd44271253af776f65e09a699af5a692566c300c7da419c12857048cb01b0853250579abcca449cd49d577b80966ede03ca95b46f

memory/4932-413-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2024-414-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4640-535-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1892-553-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1696-583-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3240-584-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/3980-603-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3824-604-0x0000000140000000-0x0000000140259000-memory.dmp

memory/4656-618-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2952-619-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4932-622-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2024-623-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3448-637-0x0000019EAD810000-0x0000019EAD820000-memory.dmp

memory/3448-638-0x0000019EAD830000-0x0000019EAD840000-memory.dmp

memory/3448-665-0x0000019EAD830000-0x0000019EAD831000-memory.dmp

memory/3448-668-0x0000019EAD830000-0x0000019EAD840000-memory.dmp