Malware Analysis Report

2025-01-03 07:40

Sample ID 230427-qrsqyshg3t
Target tmpj_mcuumo
SHA256 bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61

Threat Level: Known bad

The file tmpj_mcuumo was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Script User-Agent

Suspicious use of SendNotifyMessage

Suspicious behavior: LoadsDriver

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

outlook_win_path

outlook_office_path

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-27 13:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-27 13:30

Reported

2023-04-27 13:32

Platform

win7-20230220-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\968642126401d5da.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1856 set thread context of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 268 set thread context of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{DD62BD56-530A-4B64-8A6D-04FEE2038985}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{529E67C4-AB7E-48FD-9165-0D67753666C4}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{529E67C4-AB7E-48FD-9165-0D67753666C4}.crmlog C:\Windows\system32\dllhost.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{CF47542D-9EFC-4163-980A-F56286316DB2} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1856 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 268 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1316 wrote to memory of 1324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1324 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1880 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2176 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 2744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1316 wrote to memory of 1148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2152 wrote to memory of 2120 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2152 wrote to memory of 2120 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe

"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"

C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe

"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 25c -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 23c -NGENProcess 260 -Pipe 258 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1e4 -NGENProcess 25c -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 238 -NGENProcess 268 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 250 -NGENProcess 1dc -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 270 -NGENProcess 268 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 1e4 -Pipe 274 -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 25c -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1914912747-3343861975-731272777-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1914912747-3343861975-731272777-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 278 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 244 -NGENProcess 25c -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 244 -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 244 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 244 -NGENProcess 27c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 250 -NGENProcess 268 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 250 -NGENProcess 244 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2a4 -NGENProcess 244 -Pipe 294 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1856-54-0x0000000001360000-0x00000000014DC000-memory.dmp

memory/1856-55-0x00000000049A0000-0x00000000049E0000-memory.dmp

memory/1856-56-0x00000000005C0000-0x00000000005D2000-memory.dmp

memory/1856-57-0x00000000049A0000-0x00000000049E0000-memory.dmp

memory/1856-58-0x0000000000640000-0x000000000064C000-memory.dmp

memory/1856-59-0x0000000005E10000-0x0000000005F48000-memory.dmp

memory/1856-60-0x0000000007F30000-0x00000000080E0000-memory.dmp

memory/268-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/268-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/268-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/268-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/268-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/268-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/268-69-0x00000000001B0000-0x0000000000216000-memory.dmp

memory/268-74-0x00000000001B0000-0x0000000000216000-memory.dmp

memory/268-78-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 45fc580469aab327d350fe57bbdc710b
SHA1 195016cf2f8dab6ece4f7256f85ab4da53c69a3b
SHA256 616f2c00a5db1d6734c35245aa80d778209e762a806186a4c2519f31a1922372
SHA512 74f866eb619e2a01b42f61dc0b0371e77a18d5752350e8bdd846e6ba2c554addbbf9e2f82847a54a8f8df0e19540fe84a46aeae2eeaa45c565a2b2c7a7468647

\Windows\System32\alg.exe

MD5 45fc580469aab327d350fe57bbdc710b
SHA1 195016cf2f8dab6ece4f7256f85ab4da53c69a3b
SHA256 616f2c00a5db1d6734c35245aa80d778209e762a806186a4c2519f31a1922372
SHA512 74f866eb619e2a01b42f61dc0b0371e77a18d5752350e8bdd846e6ba2c554addbbf9e2f82847a54a8f8df0e19540fe84a46aeae2eeaa45c565a2b2c7a7468647

memory/292-83-0x00000000008E0000-0x0000000000940000-memory.dmp

memory/292-89-0x00000000008E0000-0x0000000000940000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 8a8ec87655a43f03b2a2c6e8eb8827fe
SHA1 82a314934595155fb01fd436769ebb162124e929
SHA256 1e1058e493a5dfc5922071ede4c11e749313c405e45b8fd31f184b72dd08785d
SHA512 546b0271616340db5a6c6ea75382ebe351ff7ca5b204d6a52c33417014a8c2ea8d5966c8bd98a16c3b878af1949fe0eb6bf13ed1ec5c52e2c0e852180813b2a6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 8a8ec87655a43f03b2a2c6e8eb8827fe
SHA1 82a314934595155fb01fd436769ebb162124e929
SHA256 1e1058e493a5dfc5922071ede4c11e749313c405e45b8fd31f184b72dd08785d
SHA512 546b0271616340db5a6c6ea75382ebe351ff7ca5b204d6a52c33417014a8c2ea8d5966c8bd98a16c3b878af1949fe0eb6bf13ed1ec5c52e2c0e852180813b2a6

memory/292-96-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/2044-97-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 bcb30a46eb90656da49a61ae15280cdc
SHA1 81cbff8297af0e38b60e0d7d93dc7f3f725b376e
SHA256 6b27b8ba48bc2e7bbd3f349f6c98bfdf6bc4ce98555a28418fd44db362349e44
SHA512 28cf57f45234a75a5e95c7fe080f7fb27471a5b002cba4651d25c1c4894cb212aac65053cd0d59afa96e7126bb00651862f48301a2ab750ca791df2a057ccf9e

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 05983cf83bb084cc43fee8fc060f05e8
SHA1 47ae6b0fa3066fb273a1533aec40de2d64a3b240
SHA256 8adc58508750ec0530475b5004a40e2984da57fb22cf26fb9e194808e500a14c
SHA512 26945844e3debc10b820847b54bdf89679e857c3f57b79a046e44d08d114e233550536d70aaa1e247654bbe91bd62c1a514e0a4028346fd2e09a98558b8a60d9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 05983cf83bb084cc43fee8fc060f05e8
SHA1 47ae6b0fa3066fb273a1533aec40de2d64a3b240
SHA256 8adc58508750ec0530475b5004a40e2984da57fb22cf26fb9e194808e500a14c
SHA512 26945844e3debc10b820847b54bdf89679e857c3f57b79a046e44d08d114e233550536d70aaa1e247654bbe91bd62c1a514e0a4028346fd2e09a98558b8a60d9

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 bcb30a46eb90656da49a61ae15280cdc
SHA1 81cbff8297af0e38b60e0d7d93dc7f3f725b376e
SHA256 6b27b8ba48bc2e7bbd3f349f6c98bfdf6bc4ce98555a28418fd44db362349e44
SHA512 28cf57f45234a75a5e95c7fe080f7fb27471a5b002cba4651d25c1c4894cb212aac65053cd0d59afa96e7126bb00651862f48301a2ab750ca791df2a057ccf9e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 05983cf83bb084cc43fee8fc060f05e8
SHA1 47ae6b0fa3066fb273a1533aec40de2d64a3b240
SHA256 8adc58508750ec0530475b5004a40e2984da57fb22cf26fb9e194808e500a14c
SHA512 26945844e3debc10b820847b54bdf89679e857c3f57b79a046e44d08d114e233550536d70aaa1e247654bbe91bd62c1a514e0a4028346fd2e09a98558b8a60d9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 4b924b30841a816769b64dc9a97bd139
SHA1 9233ebb1e798072ac065500b181f9056327e573b
SHA256 7164984acfdae4826e784c3493df5150e5c9a29fe13a999a8bd7c6758b313754
SHA512 dc8d99b1fcc1192d224f51f7fab83d0a2cee57fb92b854e6c2d152db4d1ad96cacd550bef7be764621dad4415bac58d3f1e9909d5c0d5b6ec38364e4ba59580e

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 8eb9b44b2a340f18018ad16eefa60506
SHA1 5c92d543761af29fb4c200bea0a09f7efb260cf0
SHA256 08c0be74047f3a8e7bd5d43a872c915cfcf1b9292c64fe516662b822e3778790
SHA512 1173f23ab041f4ef4bb17d23d8ddb86418504b80474d12c0f064766c5655c886ffa9e956ee0522efcdf736dbd545257361ab97f7fda5d5c853296b3934938221

memory/608-116-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/636-115-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/936-117-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/936-118-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/936-119-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1316-122-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/1316-125-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/936-124-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/936-129-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1316-131-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 3d0b57c290dc6077984f32feff1ecca7
SHA1 a325baec363df59cf347d46da72dadb93f89d606
SHA256 b3f43d13d3402fcebd9ebaab1760fb3c80b5e9c469ada01f2d4f4b3baff9177a
SHA512 201e9b03048e0de0679d3df7e15a213787fefe97720055c83527798fd1f81f4ec0cdc4645abc07e67cd67a1169b2efc361ad16cfe941af1d388206813d88a67e

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 3d0b57c290dc6077984f32feff1ecca7
SHA1 a325baec363df59cf347d46da72dadb93f89d606
SHA256 b3f43d13d3402fcebd9ebaab1760fb3c80b5e9c469ada01f2d4f4b3baff9177a
SHA512 201e9b03048e0de0679d3df7e15a213787fefe97720055c83527798fd1f81f4ec0cdc4645abc07e67cd67a1169b2efc361ad16cfe941af1d388206813d88a67e

memory/936-144-0x0000000000980000-0x0000000000A3C000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 9754509a7fc20b782d85a1d12882aff7
SHA1 32aab93c3f8fcfd0571eee8650c1121dd2f8b758
SHA256 e61c067b7db2ef5a6e82c9c94375321f6ca1b7c98b64ebdbbcf05127c71d4275
SHA512 cd4f176f9dd2fdd729f779a5a05992f1a710bdce832f3c04a5c29526493b7e68e7b76c2a6411e6cd232e430f41c7551e2854a26c6a15943edf8ac4bf1746f76a

\Windows\System32\dllhost.exe

MD5 9754509a7fc20b782d85a1d12882aff7
SHA1 32aab93c3f8fcfd0571eee8650c1121dd2f8b758
SHA256 e61c067b7db2ef5a6e82c9c94375321f6ca1b7c98b64ebdbbcf05127c71d4275
SHA512 cd4f176f9dd2fdd729f779a5a05992f1a710bdce832f3c04a5c29526493b7e68e7b76c2a6411e6cd232e430f41c7551e2854a26c6a15943edf8ac4bf1746f76a

C:\Windows\ehome\ehrecvr.exe

MD5 1979cfe32c59cee01c101ad9f5ee3809
SHA1 408dd4813541d6c46255df8e5b456a39f32ff4ac
SHA256 9edccb1ea5e1bcb769f2be153175b0a07ac5b1ae6fa878bebafd7081091bffe7
SHA512 70eb1a6cbee01d0da30af94c1c7e040798b6ba05136fbcac7b97d1e63ccc710681bcb1c0a05186c6f15e0f7147e392aa879906512892b62d4ab750b5af485f73

\Windows\ehome\ehrecvr.exe

MD5 1979cfe32c59cee01c101ad9f5ee3809
SHA1 408dd4813541d6c46255df8e5b456a39f32ff4ac
SHA256 9edccb1ea5e1bcb769f2be153175b0a07ac5b1ae6fa878bebafd7081091bffe7
SHA512 70eb1a6cbee01d0da30af94c1c7e040798b6ba05136fbcac7b97d1e63ccc710681bcb1c0a05186c6f15e0f7147e392aa879906512892b62d4ab750b5af485f73

memory/1320-150-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/1320-156-0x00000000008C0000-0x0000000000920000-memory.dmp

memory/1572-161-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1684-163-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1320-164-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1320-168-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1636-162-0x0000000000830000-0x0000000000890000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 9145989cf7118de728e9f50fbb64ee39
SHA1 ccb542944e92a4b92ded96eb576ae72c49f71445
SHA256 a44aaa14df32e9e20b0f18906293e4286938f2ecdfca84c1801eab0bedc67b5c
SHA512 dc457803164c80686fb4f28147d332f5aee97db1b30b50d4e59fd54f9cad9dc32755e995248ff5e900fee197d1af0494193add59614c542a88640097070a79a3

\Windows\ehome\ehsched.exe

MD5 9145989cf7118de728e9f50fbb64ee39
SHA1 ccb542944e92a4b92ded96eb576ae72c49f71445
SHA256 a44aaa14df32e9e20b0f18906293e4286938f2ecdfca84c1801eab0bedc67b5c
SHA512 dc457803164c80686fb4f28147d332f5aee97db1b30b50d4e59fd54f9cad9dc32755e995248ff5e900fee197d1af0494193add59614c542a88640097070a79a3

memory/1320-170-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1636-173-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1636-172-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 21c7c9ffe7f8f9ac117b48341f74d082
SHA1 f3f43644bc9403c912cd8d6d1e789768f63944ea
SHA256 f7008cfec485c16ba937bc95746916a2b7c915479d79aa139d9d118f6325a167
SHA512 727dae9c52c60c68928ec0be5afc64785474c020d825d295a10c6e2317ccb230abf3068d47fb753dd9fdbb7977b63badaad2e55c6fe738d5a658c348cf5b7c03

memory/1596-180-0x0000000000310000-0x0000000000370000-memory.dmp

memory/1596-186-0x0000000000310000-0x0000000000370000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 6cfd52013082ab4dc401fa7b5ef6d671
SHA1 c9a8380714c56d298669de4c0392dbc11c359292
SHA256 04bdadd56890b3d800a3d004dfa10be942c36d78fe8704193d447c6414ae8154
SHA512 789a939006ce4b65dba4446f7ede0c13570c3e88d28e2cbd78132f7ba5ad4bc75dfd78584dcae3ba52847739e76a72e9b0ce8f1075196a5758f76c4230ddcd97

C:\Windows\System32\ieetwcollector.exe

MD5 6cfd52013082ab4dc401fa7b5ef6d671
SHA1 c9a8380714c56d298669de4c0392dbc11c359292
SHA256 04bdadd56890b3d800a3d004dfa10be942c36d78fe8704193d447c6414ae8154
SHA512 789a939006ce4b65dba4446f7ede0c13570c3e88d28e2cbd78132f7ba5ad4bc75dfd78584dcae3ba52847739e76a72e9b0ce8f1075196a5758f76c4230ddcd97

memory/2020-191-0x0000000000850000-0x00000000008B0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/1320-203-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1596-207-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1176-209-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/1324-211-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2020-210-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/1324-223-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 9f59635e25c1359c4ebd1a9107372075
SHA1 9c2327dab6e7c7e5f3dfa107dd2c74cb8e8a11f4
SHA256 50f86b4bf0808fc6749bde9c90dad72b0a43b3193a18a0c19e9431bc09afe696
SHA512 0351cfdd9bc12857c321df12f1942f02196847e151036cb8bda225ec5eede37cc7837a3fc040936664f5287ec60c31f876109ef34c0182c064f112f32ef69bbe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/1508-240-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/428-243-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1880-244-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 96eb788f772c2fe8d9d89903306e76d8
SHA1 c22fb587e956f5c1ad0f519e86fd9092adff2670
SHA256 1435e20b77eaed34e78c7fefd7848bf22995fbf9ac2a1fdefba3756ee53fc004
SHA512 b8730e2b76e48c39aabe4e949a3ff369ee34024c2299a01cb383713f02deb6add8b7e635b4624ad5d0ca7d8b5ab4fa260a44264f2dd0590f73a0c9864736e88a

memory/2212-257-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msdtc.exe

MD5 1aacbd8c45c80d29174e444f46a2a37f
SHA1 127ebe280bca27a6f6b2d2c7d61653ffba47a294
SHA256 10e086ee116f3a356c4155d9c4a75f390153be1b896a9021db11cddf26808697
SHA512 fca5aa84bcdc2ed0080aae790c6b3e1a3bd80dd32c7d2625a63fe1865c20824ca81fcc1f97374e17d077d935f6f091b0d13e1e95e52aaaefc5b092a64a4cc755

C:\Windows\System32\msdtc.exe

MD5 1aacbd8c45c80d29174e444f46a2a37f
SHA1 127ebe280bca27a6f6b2d2c7d61653ffba47a294
SHA256 10e086ee116f3a356c4155d9c4a75f390153be1b896a9021db11cddf26808697
SHA512 fca5aa84bcdc2ed0080aae790c6b3e1a3bd80dd32c7d2625a63fe1865c20824ca81fcc1f97374e17d077d935f6f091b0d13e1e95e52aaaefc5b092a64a4cc755

memory/1176-273-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/2212-272-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2320-274-0x0000000140000000-0x000000014020D000-memory.dmp

C:\Windows\System32\msiexec.exe

MD5 4cf9a66cc5159eaa5626a58e5df5f943
SHA1 d3ea064ec0f183773604698e12bfb9de523f1436
SHA256 acdc0beaf42799465bd8827d4138a7a7e5bf6566488d65ef9311a5a4b07baedf
SHA512 753e2805f0c69e751809d66a4208858ea833004d723301075ca48ddc0d6d2a7f1bc09fc9a7945810fca62ae91413869f61cdd36e158ffc1cf001e6fc390805f7

C:\Windows\system32\msiexec.exe

MD5 4cf9a66cc5159eaa5626a58e5df5f943
SHA1 d3ea064ec0f183773604698e12bfb9de523f1436
SHA256 acdc0beaf42799465bd8827d4138a7a7e5bf6566488d65ef9311a5a4b07baedf
SHA512 753e2805f0c69e751809d66a4208858ea833004d723301075ca48ddc0d6d2a7f1bc09fc9a7945810fca62ae91413869f61cdd36e158ffc1cf001e6fc390805f7

\Windows\System32\msiexec.exe

MD5 4cf9a66cc5159eaa5626a58e5df5f943
SHA1 d3ea064ec0f183773604698e12bfb9de523f1436
SHA256 acdc0beaf42799465bd8827d4138a7a7e5bf6566488d65ef9311a5a4b07baedf
SHA512 753e2805f0c69e751809d66a4208858ea833004d723301075ca48ddc0d6d2a7f1bc09fc9a7945810fca62ae91413869f61cdd36e158ffc1cf001e6fc390805f7

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

\Windows\System32\msiexec.exe

MD5 4cf9a66cc5159eaa5626a58e5df5f943
SHA1 d3ea064ec0f183773604698e12bfb9de523f1436
SHA256 acdc0beaf42799465bd8827d4138a7a7e5bf6566488d65ef9311a5a4b07baedf
SHA512 753e2805f0c69e751809d66a4208858ea833004d723301075ca48ddc0d6d2a7f1bc09fc9a7945810fca62ae91413869f61cdd36e158ffc1cf001e6fc390805f7

memory/1880-303-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/2472-313-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 0cebe719a8f1f2e4ffa608c04ed1eba6
SHA1 b2e1327f5a4689a8abd769eb2f9c42715c776dee
SHA256 78d4a201ffd5c6665d392f682d3a6e9b15f238afe232e504cadf097e95ab6f62
SHA512 66482650e3ed59962f75b89aab8d6cc87b234f2cac53a04ae0c174a9ce683f2192c47291c59c24d010e3e839ba1573de3db0f068d04a88bd71459d4ed7f8dabc

memory/2692-316-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2444-318-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2772-319-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2444-320-0x0000000000570000-0x0000000000779000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 c2c66b3e998800063a599fcb3ae80375
SHA1 eff9134a91dbc8cb5ffb2b2a5c8aa5f4a9cb0666
SHA256 5a24a83fa63e5d1773e069dce5a545a4ec0b61ea74fdfe39fc3b45604caf0c8c
SHA512 655d8d9eeac1d07926466cfed475b4212d7d77888386dff545f1a1062fb5f21e8b9c2c5dd7c9716543fe594b3ac0fdb91e259e5814338721034b18bf24830dc8

C:\Windows\SysWOW64\perfhost.exe

MD5 b98b85d03193cf6708a00c88564da607
SHA1 6c6c3c54688a647e9294d2e962cac1d30b7dc4b6
SHA256 038c1f2ece5032e518f28d660ca9e940b070ee79c57f76734afaf34b39275802
SHA512 dfd336ba82c287613001e0a75fe008e37e0097d392a528d09d037430ba59ea120791dec603b42bb1bab8a14030f668de3e6128a3976509da315a6bd8ebe2d887

C:\Windows\System32\Locator.exe

MD5 2e3fca8f1d102543f129260b85e7b4a3
SHA1 2e956e6c75b9306029027bda272adf6b6240cf01
SHA256 046b89c0ca0daa09a186b7096a80f1b3532db6ae67b34a669a230b65cd48c3f9
SHA512 c2dcce4da8e0cbfda2a861c308beb93589837724ca55b73fd9b1300b1a212eb2b34826f14c4afd0a60501fb67c97a59847eb81da8f0f7e1870e517f63905815e

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

\Windows\System32\Locator.exe

MD5 2e3fca8f1d102543f129260b85e7b4a3
SHA1 2e956e6c75b9306029027bda272adf6b6240cf01
SHA256 046b89c0ca0daa09a186b7096a80f1b3532db6ae67b34a669a230b65cd48c3f9
SHA512 c2dcce4da8e0cbfda2a861c308beb93589837724ca55b73fd9b1300b1a212eb2b34826f14c4afd0a60501fb67c97a59847eb81da8f0f7e1870e517f63905815e

memory/268-351-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1176-355-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/2848-354-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2928-357-0x0000000001000000-0x00000000011ED000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 3d71c6f28b9cd801a2c0fa41e0a2346c
SHA1 b54c830e4756f1f077d9eae37947d3c12438d230
SHA256 c7f4a782caf3aabb1b8d01ae522fb93485de1b1bc905491fd96355d8caacc456
SHA512 c64e5d2197326c9aaed87145544f1d4ca8e9bb415406adfc6e4f3b2ae65dd1ac855a097ee16585293fd80aa2eae736cdf87871c3793c1bcfefeae7c64a82c434

\Windows\System32\snmptrap.exe

MD5 3d71c6f28b9cd801a2c0fa41e0a2346c
SHA1 b54c830e4756f1f077d9eae37947d3c12438d230
SHA256 c7f4a782caf3aabb1b8d01ae522fb93485de1b1bc905491fd96355d8caacc456
SHA512 c64e5d2197326c9aaed87145544f1d4ca8e9bb415406adfc6e4f3b2ae65dd1ac855a097ee16585293fd80aa2eae736cdf87871c3793c1bcfefeae7c64a82c434

memory/2964-358-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2980-365-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2692-378-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

\Windows\System32\vds.exe

MD5 cb380798cc24e4bdacc70a32777f2cd2
SHA1 aff0b0d8432705b4b717ca9fd584282adbba6b84
SHA256 0fb2827fe23b6214aa1d24b56cb4a602e481983f03903700acc889c86e57d13f
SHA512 57c3d3949af158781a438a9a02e5cd35aa43e7fdb0bc1e3321f0608e9e7a8af5c75ad53e9b7cf4e5cc05803aa6badc2e1550a2fa5eefb652fd8ee4e96f4661db

C:\Windows\System32\vds.exe

MD5 cb380798cc24e4bdacc70a32777f2cd2
SHA1 aff0b0d8432705b4b717ca9fd584282adbba6b84
SHA256 0fb2827fe23b6214aa1d24b56cb4a602e481983f03903700acc889c86e57d13f
SHA512 57c3d3949af158781a438a9a02e5cd35aa43e7fdb0bc1e3321f0608e9e7a8af5c75ad53e9b7cf4e5cc05803aa6badc2e1550a2fa5eefb652fd8ee4e96f4661db

C:\Windows\System32\VSSVC.exe

MD5 b4d9e729081211c20ac79d0cc0faf98e
SHA1 17c1d092ce8ea65d7e4494eb3779deb928fa3cde
SHA256 5da8b605f1af178e0091b4b43bebc82d4e7a792102a301f9132d49a140cd14a3
SHA512 b2b5b449ae7e51482244ae36289b6f5b3866569ad5578310bc3584fce11c94f94896e743778ec72c07c3811c2fdf45f685958de9e8bdf597a8d5a22adaaf0a03

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/2044-398-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/2264-402-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2116-407-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2412-410-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2216-413-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2964-415-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

\Windows\System32\wbengine.exe

MD5 23be0583050fda899621c3ed0d7eba39
SHA1 548852d0aa823b7c3838b9f0b3c42ad50ef9433e
SHA256 05ca6df809126cbf951680f54bb9c6eacf3126414ea1f6a898e7849d7317857c
SHA512 4fa0e5ebedfd21e1027fb3be94abc189dc12692b1ae9807fb3490b7b542168891e819bfefcfa3614be478a719315800a8aacccbe20c4e88549ce6576238cc06e

C:\Windows\System32\wbengine.exe

MD5 23be0583050fda899621c3ed0d7eba39
SHA1 548852d0aa823b7c3838b9f0b3c42ad50ef9433e
SHA256 05ca6df809126cbf951680f54bb9c6eacf3126414ea1f6a898e7849d7317857c
SHA512 4fa0e5ebedfd21e1027fb3be94abc189dc12692b1ae9807fb3490b7b542168891e819bfefcfa3614be478a719315800a8aacccbe20c4e88549ce6576238cc06e

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 df5816b4042e289ee189f52f728d84de
SHA1 0e866d026137d71227fabcba188f907389249f05
SHA256 861f328972c55980c0741dbf655e44fb00571b8509a3eb84f2515879165e7ba3
SHA512 4bee9835a82b8d7ffcc64843738237b285bb61070f12596a0fe005eb4bb3d0669a7222a74fe7b4f32f5d59f3fa30ed97b95586c4ce97504ae2e5a64cd93cc823

memory/2216-440-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 df5816b4042e289ee189f52f728d84de
SHA1 0e866d026137d71227fabcba188f907389249f05
SHA256 861f328972c55980c0741dbf655e44fb00571b8509a3eb84f2515879165e7ba3
SHA512 4bee9835a82b8d7ffcc64843738237b285bb61070f12596a0fe005eb4bb3d0669a7222a74fe7b4f32f5d59f3fa30ed97b95586c4ce97504ae2e5a64cd93cc823

memory/1316-438-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2176-446-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2660-448-0x0000000100000000-0x0000000100202000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/2176-462-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 3680222160b10534de56d030f855617d
SHA1 2d8bc7343a38016c2c33ad093efc7972837b0245
SHA256 3a0b31d78eb3944b66d2d9d5e94df49a7e5b3c8e80a6b2558cec58c7a45152ef
SHA512 187285c219a4a1bf48e1726f2886e04c467fd67b5f4c80f906c94f7bf86b39f3796822cf2c3f3b7a67e2f2c359907a734ec1d7807e14be1fa1d7c1659a3ffb9a

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 3680222160b10534de56d030f855617d
SHA1 2d8bc7343a38016c2c33ad093efc7972837b0245
SHA256 3a0b31d78eb3944b66d2d9d5e94df49a7e5b3c8e80a6b2558cec58c7a45152ef
SHA512 187285c219a4a1bf48e1726f2886e04c467fd67b5f4c80f906c94f7bf86b39f3796822cf2c3f3b7a67e2f2c359907a734ec1d7807e14be1fa1d7c1659a3ffb9a

memory/2948-482-0x0000000100000000-0x000000010021B000-memory.dmp

memory/1320-483-0x0000000140000000-0x000000014013C000-memory.dmp

memory/608-484-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2744-487-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 bb454187ed7688c0c4fbb62862be329a
SHA1 bb835dbbb78820639f9ec6bdb17c561d68fa1060
SHA256 36cc299fdb8e95e6e6623800ecc0ac7fc38518d75761459dc61a54577fdb07a1
SHA512 e1613aca020d7f3bc3465b31a407278e596e1d54a0af24c90934fd6f5dad8f577ce07c40bb8216ec4295e08078198477cdbd98e7001dcae648e22b4ffef24c2a

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 3680222160b10534de56d030f855617d
SHA1 2d8bc7343a38016c2c33ad093efc7972837b0245
SHA256 3a0b31d78eb3944b66d2d9d5e94df49a7e5b3c8e80a6b2558cec58c7a45152ef
SHA512 187285c219a4a1bf48e1726f2886e04c467fd67b5f4c80f906c94f7bf86b39f3796822cf2c3f3b7a67e2f2c359907a734ec1d7807e14be1fa1d7c1659a3ffb9a

memory/2060-488-0x0000000100000000-0x000000010020A000-memory.dmp

memory/1636-512-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2152-515-0x0000000100000000-0x0000000100123000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 88d038531a944ba056a7f1db658f3c3e
SHA1 914c033529873436d898c3279554ecd8da2a2330
SHA256 94becd64cb89ecb34b220d715a6328cbf1ff8ff48c9975bf58cc0bf57efe8af8
SHA512 a31dd73d6b60bf0c9586d8c0ff66ecb212bffdfe4f4b279a922fbb2f0c690a5622c29f959b5763315dfeebed8d5213c12fae9ecaa4a0b78dc61def27eb47d7c3

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

memory/2020-632-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1596-630-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 191d4cf70b498d3577d5a12c2256117b
SHA1 c4aeb4fb12cd072d0d4dbd29f30e7d8d22c35ffc
SHA256 9cba92bad0b9fa7b0676d824ed09349c13197533e9c8d604a524706115778e1e
SHA512 e3e7f869234621a57c96548387aadef8742bae45ed9242cab1bb83d294be67401869b95f16e27b4d242789181070373b8094ada97bc40855fdcec3a9dec9cf05

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-27 13:30

Reported

2023-04-27 13:32

Platform

win10v2004-20230220-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\593999f8c94b1c77.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 408 set thread context of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1208 set thread context of 864 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{FFC11392-3607-4D9F-985B-7818929ABFBA}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bce83a551d79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd9986531d79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8fb2e551d79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e5d6f551d79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf4cff541d79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6fd69531d79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 408 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe
PID 1208 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1208 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1208 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1208 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1208 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2936 wrote to memory of 4732 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2936 wrote to memory of 4732 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2936 wrote to memory of 1668 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2936 wrote to memory of 1668 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe

"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"

C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe

"C:\Users\Admin\AppData\Local\Temp\tmpj_mcuumo.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 knjghuig.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
NL 87.248.202.1:80 tcp
NL 87.248.202.1:80 tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 254.135.241.8.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
NL 88.221.25.155:80 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 199.21.76.77:80 deoci.biz tcp
NL 167.99.35.88:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp

Files

memory/408-133-0x0000000000F30000-0x00000000010AC000-memory.dmp

memory/408-134-0x0000000005E50000-0x00000000063F4000-memory.dmp

memory/408-135-0x0000000005940000-0x00000000059D2000-memory.dmp

memory/408-136-0x0000000005910000-0x000000000591A000-memory.dmp

memory/408-137-0x0000000005A90000-0x0000000005AA0000-memory.dmp

memory/408-138-0x0000000005A90000-0x0000000005AA0000-memory.dmp

memory/408-139-0x0000000007B20000-0x0000000007BBC000-memory.dmp

memory/1208-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1208-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1208-144-0x0000000002DA0000-0x0000000002E06000-memory.dmp

memory/1208-149-0x0000000002DA0000-0x0000000002E06000-memory.dmp

memory/1208-155-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 a89c061bf8792fe7e69877e04231d78a
SHA1 15d43a1bba454d3d07df7684425feacf4834247a
SHA256 9fbaf496c7dba350325a5fbcc06de7fecd06ff182de5346fbd957d2bd8accbf2
SHA512 2947d2f2c97c7f557e10df65ce26f9b3d69f581cbe256a8a8a6080d2a81924941e21f149da1c69cffc443e1642e9381463f5792276b6c1d95b3e482caf0b2afe

memory/3864-157-0x0000000000660000-0x00000000006C0000-memory.dmp

memory/3864-163-0x0000000000660000-0x00000000006C0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 c417c709ee70b78c9e3a3d49b6fa53fd
SHA1 fd8b5f00700cb22ca59c7cb34d89088752ab5766
SHA256 b20b4c3e20b70f545c0360d83aba38a11c142c45bd697ea3cec5231ce39b3486
SHA512 5c065a74dc06f1da49483b5ce009953afdef722787fd1e0387b2b472539461bc8579e74db700c23a1bdb034920854d16557490d152f532bfdb817323c389daea

memory/4128-169-0x0000000000700000-0x0000000000760000-memory.dmp

memory/4128-175-0x0000000000700000-0x0000000000760000-memory.dmp

memory/3864-178-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4128-179-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 157963d97d34ba01d7e25c96735e92e8
SHA1 1ee7faad5b215d587ac5e79b8280a229dd3f9004
SHA256 244b3ad8f284eec8e74f812ca8b9ba43d8cf31fd4077eae4af6c57092ad4db03
SHA512 3f4e8d558cdffaa595b30726b260a4a26f8806f11a17dec961da40dcb1a47f78a9a50122bad58683000ed76169702b597a0b20f51cb8c52bbeacd1a4a50807f4

memory/2572-181-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/2572-187-0x00000000004F0000-0x0000000000550000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 cebc35e679016eae5d268ec204754858
SHA1 9ea2de64aabd34034b52ee651286bb6da2cb1aa2
SHA256 54f2fc1ea7e029482cbce5065144aabe7502a71e5c6aa3d6f232fe98c1f0b3f1
SHA512 0d9e8b0265589eb62668f0ebe03de1ae02aa8737f15f7d2226f64c659622a1245c2417d7c194f4c5e3d182fe26db7e27b4b9ff8c41e5f97c358ebcaa5b889b51

memory/4480-191-0x0000000000D00000-0x0000000000D60000-memory.dmp

memory/2572-193-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/2572-197-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4480-199-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4480-201-0x0000000000D00000-0x0000000000D60000-memory.dmp

memory/864-203-0x0000000000B50000-0x0000000000BB6000-memory.dmp

memory/452-206-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 3ede665c088ae4ac24347b126127f77d
SHA1 44fe3eeeea7cfdbbac26140155fa9c0f124facfb
SHA256 61d1809d1d1d5fdddc14e5f479bde9828890ed8e239f28968379433745ec410d
SHA512 173853e4883b19771385dbc5b44a1ce1dee3232b502080e66025f7cf447372f36104171871ee89a6bac36308b53f95b1936ad95fbae12a405de1a55ce57210fd

memory/452-212-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 5e3802e57b6b58f2c004375887fe9e3b
SHA1 1dc6963de219d31f62730c141dc7c0e6151de0cd
SHA256 b9e42dab7cfa4180d4fba7522b77fdac375cede2885ff78a07311a155c19d0f9
SHA512 54d1e8ead5c7a631be9102fc00baaeec65373a4f63dfe7bb287dccd7c4c782759cbd3c3b410806abbd753f1d31ecbf6b6abfdf7375d9b7314ce103c115b1ecc6

memory/1040-217-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1040-223-0x0000000140000000-0x0000000140221000-memory.dmp

memory/452-225-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1040-224-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1040-228-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1040-231-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 e89fafe59236fad396b50071f12d8fbb
SHA1 25bee6f1f3ff74846a2caf90c8eaf043cf2a002c
SHA256 a320511f8ed8bbdcbfb4178945126053cbedd83435c875ede9c87e6b0ac0fdf1
SHA512 ed5a4ee22d0f6ff623d2c1771eb160e0c54d2cc66901718d07a9668740c5295bb53daf97fdadcd3679fdec2d917e49f9c1ba15ecdaf98925115c425119c7b65f

memory/5104-233-0x0000000000D20000-0x0000000000D80000-memory.dmp

memory/5104-242-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 79353f865b59744aecb1e6bdf438f2c6
SHA1 0719fd58e19bcdf50eb2bd723d07be8b5cb82701
SHA256 7230654075ad0fe970360e9c6214fb40741c1d1b989f7dfb6198404236757f32
SHA512 406e236de12e023d4799a8378d3acd83022442b55dad271ed125e6faa148480255a890000bf5b72ea255ef42c39cb4eb0a9a7187e7c91ae91f5f2e543a55a6f0

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 334e7825b5725d490ac0de94256e35c3
SHA1 79eac24e03a625042ae2692d45f5971b9b220c99
SHA256 72f85a4054e9d36ab8936fb1ca3dd842a16b9191c781b21a7e7c35a446931d07
SHA512 25ca2bc54c0a015e511ab0688f42d665652e3a177f55683cc6b4de233d3d92ed395355bc1a38bf161c5bf65ef1bb4f78c2f529e2bc3531c5991b9e5e723e732d

C:\Windows\SysWOW64\perfhost.exe

MD5 7659b3f877e1a32651b00040d88ae4d7
SHA1 83dcd599803dae86859ded7f26a5bc0ba5a3b29e
SHA256 e30efa047b618974bda30a2326f6a0f4cdcf6521c99410faa85275a81c1ab2b9
SHA512 8ab1177d5186b186a4c21c7d06c5bdc560008c303e1275d507f69960c94f9cf78fdad52d6c0a2edc96b8a027c81636b0af5b1fac550c52f9a24e8df4cf20f33e

memory/216-273-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3988-275-0x0000000140000000-0x0000000140202000-memory.dmp

memory/4424-277-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 e323b32ef4850421f0289a1c1525cc29
SHA1 70d9db7cbb8e26cac35904ea4533c4ef5abadb17
SHA256 4a3e25d729c58053de7cd977e76fd7784a27be9caad3b1e5d801f1daee493786
SHA512 8f0eea40c01289cc28493ad3a46702ce4aaf72854d5210b43613178761e95a9876a99f45b8157457539c27466e70bae762e4b07213f927ad7cab9d6a85355176

C:\Windows\System32\SensorDataService.exe

MD5 5c6b37102605aa4187db98ec5f033de6
SHA1 2ff63fbff1e11ce9c890427352d41eefb9f8dbe9
SHA256 5fb86363ad1006f33e338c5f79d5afcbc5aa063d726b063672197d2a61eda287
SHA512 f697c05aea5c71bb6b7838ff398fcabaf5999b782b30d40c350e04be665b9f013deae82c0ed053bd3edc8e10a649bf96963a33e5dc2c8a04f1cf8725021d1083

memory/4728-291-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4312-294-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 725155c54d11e0b082415bb5858ca8b3
SHA1 d26b160e37b4a9d09e62dd567563ad67402cc821
SHA256 f769620b9e7e921fe88c1c4697954ae6d69f927034fedde354cce3b9724b1699
SHA512 e821203fb4ae604837d3e3bdef60b69d66b469e30d227017e170542739909dcb2a4d0ab5c0c0abab93d98aab9784ff941693629305e15cdf391665edb58ee3de

C:\Windows\System32\Spectrum.exe

MD5 1acbffc8f5c21648ff4fca795003aace
SHA1 487bdb52d22395b990c44a74778ef4f3eff44d49
SHA256 ce724a0254cb2c1a8e24499e02b3bfaefe6d56ae7781292efd9f6f82eb4a0378
SHA512 4e0a1e3977c21d9da64ef8932b0672a8f67cec28ffb7dab0b0fe9bbfd0cbad822188f6fa755774b1d16c64bef932df8ebb2627878aea651a6fc7b002122fc991

memory/2960-321-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/5008-322-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 9b2ddb3de0dbf523d3dc22d35a506bd9
SHA1 1a221328df90dfa7ae5c23b9c95e8bd499886212
SHA256 e421f24d32e23ec33984abfb654374a04613dc0f949a207e2268325bc9814cac
SHA512 3039d6c311372bdf48e11da4443df7463132bad52e8990e6e4512ebf58b029289c3c95b496507c3085e37b825a4005268e8b359c92df0909a7a824a53db1f798

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 9b2ddb3de0dbf523d3dc22d35a506bd9
SHA1 1a221328df90dfa7ae5c23b9c95e8bd499886212
SHA256 e421f24d32e23ec33984abfb654374a04613dc0f949a207e2268325bc9814cac
SHA512 3039d6c311372bdf48e11da4443df7463132bad52e8990e6e4512ebf58b029289c3c95b496507c3085e37b825a4005268e8b359c92df0909a7a824a53db1f798

C:\Windows\System32\TieringEngineService.exe

MD5 9ee8785708f72fbb4e5cd0d82f0f0493
SHA1 ae69c1f179862993c51e782a312963672e6c67a9
SHA256 6ba634a35626fc61b469dabc37a623fafc9833f1ae283c5a388f0898dc14ea72
SHA512 f549ffaae2d82bcc9b6725b6cab6232d5befba50b4164441bb825a8cfe56ac507c8dbd21e29d10bcd295526e44dd5bf697ac0a48f48a585e872d793111df2829

memory/2120-345-0x0000000140000000-0x0000000140259000-memory.dmp

memory/4888-346-0x0000000140000000-0x0000000140239000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 aba724265d7424a501c975be2956acc9
SHA1 12f080c2de25fd68076f700c1686a346d0bc8d03
SHA256 c9ab0d4f528e247cb1a8a7c952ae15e80982a1c5451f1f778f3def4ca3bfd709
SHA512 762a77fe1c2206b73e74aad09cd40d8dd19575356e4e61d88a47561aa07523a07ef0d847200b9dcac2b632df06c6d033387dfa640123591713dcecad900c0e2a

C:\Windows\System32\vds.exe

MD5 5bcc4ce12a9244af90c0405a122b3672
SHA1 f93c5e30be9ee41f31ea36f623f794f47a7bb532
SHA256 01a76b89ea6b62ad0399da6582ee9d5b0bcfe44211551f9177fcdc5e12eae5dc
SHA512 5db283823a74aaf83f04f7b605bcec664a4192df624c8de9d9bb6b0fbfaef0edbb33874536a1a765e027ae7bf00b967d66953d19f3a334a6a8351fdfa50b23d7

memory/4456-359-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 893ba674ef83b1809691e1043453b50f
SHA1 017a3cb2f6bc6b6d83b42ae646c0d59756098ec4
SHA256 46098d52b5b316a4f9d7b820a0407e442a64e7a122c5418d0c151abd708f98fd
SHA512 9951b6ae34b6a4029e01e4d45d85aae8f8fadf7f932caf2c79f81f0c10c34a5d7d0eb2415bb08cf56475af354b448aefb6fe36252e8da148acb4b3a53496112a

memory/956-372-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3032-375-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 65c444ed15f2ebd6295e862c39b1839f
SHA1 730d43f5b4eb48ec4e637c72e9cc280913735bc3
SHA256 e744277e0146509a96d41f44036efddfead7e986e96746f9c49f3e1bec65c908
SHA512 fbcb7da0b73d70282d20a9ff350e004e6e032c45bdcfefc69709bfacb8d78c2e66f716c6840bebc62adcd602bb75ddbf5a9579f14379f8c1676d4b491b7803aa

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 445099cba53f2f16ec38b618e08f6d8d
SHA1 62e2a4ec98398ed621fea8428c133855db9ad00d
SHA256 e0b54cf46bb796538feb49b7d935ab800c6de9050a159172347d266ba93a6da3
SHA512 870791686b895c3b6145a95bde317bacf4b59b1cd80573f56f9f301816330236fdd17bfc49ed475e070e442cecb824473372db1b78d38e76a1513dcc881b8888

C:\Windows\System32\SearchIndexer.exe

MD5 c33abc957a84e259df436af72adc4cd9
SHA1 03a6fb90941be0f00307f52299a339c2ed9863e4
SHA256 2ac36badae5c605ade37f78335e12b634a3d7dbcdfc24304bbac735b8458e5c0
SHA512 abe65310641c3139f86b72819b16a2ad439e43f09a4c44aa401564ed6efba9dcf47c3d69f79837058cffdde6a787963a45b3f0146f0775d3a01bbbd442603223

memory/1208-404-0x0000000000400000-0x0000000000654000-memory.dmp

memory/4264-410-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4716-408-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2936-412-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4480-501-0x0000000140000000-0x0000000140237000-memory.dmp

memory/452-541-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4424-576-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/4312-583-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/5008-593-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3032-609-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4264-619-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2936-620-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1668-631-0x000001A998720000-0x000001A998730000-memory.dmp

memory/1668-661-0x000001A998730000-0x000001A998731000-memory.dmp

memory/1668-662-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-663-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-664-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-665-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-666-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-683-0x000001A99BE20000-0x000001A99BE3A000-memory.dmp

memory/1668-684-0x000001A99BE20000-0x000001A99BE3A000-memory.dmp

memory/1668-685-0x000001A99BE20000-0x000001A99BE3A000-memory.dmp

memory/1668-704-0x000001A99D330000-0x000001A99D340000-memory.dmp

memory/1668-769-0x000001A99D320000-0x000001A99D351000-memory.dmp

memory/1668-773-0x000001A998730000-0x000001A998731000-memory.dmp

memory/1668-774-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-775-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-776-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-777-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-778-0x000001A99B050000-0x000001A99B150000-memory.dmp

memory/1668-779-0x000001A99BE20000-0x000001A99BE3A000-memory.dmp

memory/1668-780-0x000001A99BE20000-0x000001A99BE3A000-memory.dmp

memory/1668-781-0x000001A99BE20000-0x000001A99BE3A000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 fba504700d87820d97f9efe2fe84702f
SHA1 7bcd34ac6fda9ed2555b09bb7ab4b82ffc38be3b
SHA256 c83635d360c1c65f9d1da16c753d1b7af290015c8f71cfc5ea709ed56a4c8f6e
SHA512 4f8403f8cd154a799dfd960e888f6f45a6a3a1e6705d47419c698130dcf5faf8b0367d29d37b48d6e1119222de222ea78b81265894a70708adb9eeb5a3cb8823

C:\Windows\system32\fxssvc.exe

MD5 157963d97d34ba01d7e25c96735e92e8
SHA1 1ee7faad5b215d587ac5e79b8280a229dd3f9004
SHA256 244b3ad8f284eec8e74f812ca8b9ba43d8cf31fd4077eae4af6c57092ad4db03
SHA512 3f4e8d558cdffaa595b30726b260a4a26f8806f11a17dec961da40dcb1a47f78a9a50122bad58683000ed76169702b597a0b20f51cb8c52bbeacd1a4a50807f4

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 5e3802e57b6b58f2c004375887fe9e3b
SHA1 1dc6963de219d31f62730c141dc7c0e6151de0cd
SHA256 b9e42dab7cfa4180d4fba7522b77fdac375cede2885ff78a07311a155c19d0f9
SHA512 54d1e8ead5c7a631be9102fc00baaeec65373a4f63dfe7bb287dccd7c4c782759cbd3c3b410806abbd753f1d31ecbf6b6abfdf7375d9b7314ce103c115b1ecc6

C:\Windows\system32\msiexec.exe

MD5 eb41c1c49490b3c0b4ab60a29d7623a0
SHA1 5f62c4faa58df5bb1630032f7efa2945f11a886e
SHA256 2ea5aa557a4bd975e79453a7d289e0486ca3b3196185407eb9f001d6ae6907fb
SHA512 825241ca548ec795c058f87f8ee037f7037d12d5e1603df7a309140f2e0fd33edf2a4704aa26d13081da9a98905d48e3be069d47143da254f240c0efbf8b6112

C:\Windows\system32\AgentService.exe

MD5 aba724265d7424a501c975be2956acc9
SHA1 12f080c2de25fd68076f700c1686a346d0bc8d03
SHA256 c9ab0d4f528e247cb1a8a7c952ae15e80982a1c5451f1f778f3def4ca3bfd709
SHA512 762a77fe1c2206b73e74aad09cd40d8dd19575356e4e61d88a47561aa07523a07ef0d847200b9dcac2b632df06c6d033387dfa640123591713dcecad900c0e2a

C:\Windows\system32\SgrmBroker.exe

MD5 2f6f4d8765cd123dc0ce79829abed6a9
SHA1 52f8e1554cdabacccfd2da93860d2d9b0c8d6b82
SHA256 f9f2e18db74e1ab78bf81ac83dbfad54d4abb94bb0d6b8d52b656f3f9a6417fd
SHA512 eab98e98d90ebf51f7ee141e4088a77e013bb60b8305da441ec8434755108e22d53e18d83f5c0f367fe6c26693454dc105fde7fa5556147f5f717a442e636367

C:\Windows\System32\SensorDataService.exe

MD5 5c6b37102605aa4187db98ec5f033de6
SHA1 2ff63fbff1e11ce9c890427352d41eefb9f8dbe9
SHA256 5fb86363ad1006f33e338c5f79d5afcbc5aa063d726b063672197d2a61eda287
SHA512 f697c05aea5c71bb6b7838ff398fcabaf5999b782b30d40c350e04be665b9f013deae82c0ed053bd3edc8e10a649bf96963a33e5dc2c8a04f1cf8725021d1083

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 d87958a182b8ff6e197ee0c1b45fb73d
SHA1 80cabb44b0986b72222f58a03fddac4a49d38942
SHA256 27a507913ec48b9d77cf002f006b10381cb3eb0e9241e8d0a8dfbfd5f623b091
SHA512 9b554792e20bc5e714988077aee2ee3f69abdebe1d23b2feced5556b683a68e06449fb2f694ec86a574e8b7e11153dafeed0a6a492ac19639a82cc67242b551a

C:\Program Files\7-Zip\Uninstall.exe

MD5 b293792a41c3dc236e6a2cc5701ac60c
SHA1 50ecfffa83796e830a586a207c610d5a02948a48
SHA256 969f3896692477fdf1e424cdf37094b7c8719fa1aecc8f1941f07bfad0707d5b
SHA512 dbdd95d512686eb7218471aee5a6f7e924a7e98d42d4c9a9fabad5b292ef04f28c1155cc9fcf0306754aab57338af40eaffb7caa3fcbc07d4a6539a74b5cac65

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 1cdad4545008ea7881e90208d1d6728e
SHA1 eb2bd6849b06ad693429fd8cdd02e3cf42ef4bc7
SHA256 7be2ce5dfa3b049cfcf169d33d2a00307752472a496346016d0288021136cb3e
SHA512 507abafb9fd018bdac7971941710283ef1136f7f62779ce9a6b1449fe5ab816695f01e082cbe04ea889b8a37a5248ea97bacd302ce93206c0c09faa847d9ae1a

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 fb2b480d2ce9d996bc1ed84419ab2778
SHA1 3b3d2fa42f766166d3d976c85585b9d2e599ef9e
SHA256 44b18dca9766860bb2cc9a706356696e006ec45ca397ddef2285dd28658b0de5
SHA512 2ef30a32b61e5bd87ea3b0c91e658943566fc5d1aff50bb7e41ec442cf22be00ec13799219cfa985666783b46bc89ba24abaa590fed99dd02cdb4480613ad929

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 200a3973ac543eb73691b333e920a304
SHA1 68dcf17809cd696362784b272b0086d6c75bafc7
SHA256 02115786575efc0f41b51b7e6858c2b4017220bca450609cbb960186e1ecb2ab
SHA512 77b50c418ca0ac92f635f44302cb070cb4afbe6190f7e23ef90fb5329fd5316486cea046d248627d9a93e28c17d47da7eceaadfd20dc2dc90d5b1e60a625c418

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 465c9f4880ef1e718066ef2bdc8535cb
SHA1 6e88a9ff2f0b81e415dad2055e89b9bc155e36e4
SHA256 8a0e7d2df31f00829d53213c017772b2f700ea7e71d1fe5a74da0acc017f5cc7
SHA512 087d81dc62716f7c1222bcbc94d61210688d09de3da035f34244692d7f9a4a3ab1c4c53afc21a0b8954a208747175254e60150c47c8dc4270da1501463417bca

C:\Program Files\7-Zip\7zG.exe

MD5 0266bbf669202a68c69f76941767976d
SHA1 749f39745d92262f2cfc21f68641c7f1acc60e65
SHA256 647c294f32b44b89dba1f9e401be172dce164380c78d6cf0892f8253db5354c1
SHA512 2ea34251d686cb89b53957f4e5dfddd29a253a9b0bfd307ba2713cc39df31529d2efc23c121ece6fdfd782b1f40625ed6019f10e234e0c7c32d1467c622e9db4

C:\Program Files\7-Zip\7zFM.exe

MD5 614512a5f873f5397d0c4e47dbca583c
SHA1 18fb82a153ceba1d18d7b56ce37976cb61edf84e
SHA256 f7278ea605b7d0703bddf3039e26608a387ba15b71e0c1dd96565b67ec5fee1d
SHA512 763507c335c70633ebefc29a052d382d253fd0500aa53005ea116aa9aae137bc4382d2927f4c41a161047e96228634a3a5f61ef4c8934b7ca525b4cf93c414f0

C:\Program Files\7-Zip\7z.exe

MD5 ea23b234ba0f69d69cde20a000d21f19
SHA1 0b0c2886583935fde554515e54a9be50fe6a95c5
SHA256 2e86feb7a2d90cbd9907bd2b2c9409004803385a4a31905f46eabbb2e74417ab
SHA512 b91722894f6bfd9835397ba4180cd80c025b3e2a7939fd87a5cc69fa51c021e9e34049516b84defc8c524f3e2ae5534ac06b7626584f1f59dcc8d8759a076710

C:\odt\office2016setup.exe

MD5 5c0a665d1ee90357b6108abc8eff2f54
SHA1 189625531594678f3e65c3f8f338cc7dada37b27
SHA256 6ebb45b8271a7e18c26837931b54bce6bd8ffabc8bbc5599d53ef134ad0501c3
SHA512 905b987113305a548e7b5bc9a958a8144213d0c0d1716f184020085fbc8b8531ea355473a873e8841591ef5c3ee2aa4cda7d239a0415743318ceb8aa5224f7d5

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 1815816141dc766ef8c0739a91dd0d4f
SHA1 654a39c4d82a341c26eb14f748b34cb6f53179f0
SHA256 15c979708d1bf194b70714ad626b9deb5c8672b68ad7a0299f0386bd6bd8601b
SHA512 4ac73294223465aca37d854bb8042cb811ec7e8c49d3377db194bcee4ab024b18cac5a4441bede04574fa9a43067e8548f87b72ca0b9a8712ba78f8d43fb60ae

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 b10c46dbeef05f160242549d1e6d1927
SHA1 c74fae1e84cf810a80be6a0a1babbdd297efcac8
SHA256 fae6c9cbb65a02b9887400fa36a930af78c63533e95edcdb88f502d1765247f8
SHA512 67de071c8c7ab58fea42830fcee73db378be550622897af48b624ac6b65592c5458b9fcb8ea8c6eb07fd6f957523419a0aead3c7562b79dd772f0ea8ecea184a

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 06a8a21a113741ee8469222484f7f315
SHA1 86951f6853d3423efc1b5b884e830410e1ec4b2f
SHA256 0de882dae54b4e023e5311860c8551aeee867ef0c66422be669ddaadcfab4ee7
SHA512 c649ca57a70fe51a6c671e0a548c93e9bb634cf16b2fe39bf82c88e4bb8578f77d08204619a4bec9c26fa8ac03d1f0d3357a13459d60d2aff649c14833045061

C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

MD5 e8dd3f7d1fe142dee6f724efbd755881
SHA1 b87acb01387dc92eae45b74d0d095e7f70f4372d
SHA256 2ed216155780096642c76c4992a47df1c1afb331f9dea25b829c9a3208685168
SHA512 598f60d504760a83b3b67c3a38c79a224b014dec64f1f40faebef1271433e30f7348e1374e23cf5b888471150f7a3b8dd7588a198b46fa9ad04dcb9be168d60f

C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

MD5 db0c154aebc7531577478a4dcf449dc0
SHA1 34054da0fa7c95ead6f9cd78b3cfb13e3c3edae4
SHA256 19276f5b8b404e4bf3294cf7094c01bb103b99e193bcd295c6655c6bb29bbfc6
SHA512 69fbf008afb9252503807a3bf36c5ff72002108332e59d1e924bace1970d9f4ccfbd1af1eff2c7c1b14620e5e3573ad7c607db9bb0179e63c66639174c66755a

C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

MD5 34b35c2a14e2aacf0fed56c0bdb43714
SHA1 830672be8befd23c785150b7f4b03030005d9828
SHA256 0c29cb0d184c68c9a230025e86ff94ffa5c709650cc41d408c8f08b7df8dfc6e
SHA512 846f48400cdc985b08653e9aebed75ebb96df95af1e71216c19c33a8eebd999d72dd3704cad78095aa931e57e7624cbf30a1dc8c0fed8d9d1d9e74afe83a5f2e

C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

MD5 e09951022923726e74a1e810a7431260
SHA1 b77f5ca9573a33414292d3270237b6202d5b4012
SHA256 9e9eea2c2bbbdd268ed385e2c5e803588bbef3ec625e7749aad2a8a7dec2922e
SHA512 32d767117c07c54d8d54495c7979defda2b207c4758a948c1fe329b2c8c74dc0eac0eba04290a71bf79fdd8d987badcd3133597decac25e36cd83ce3c0e5a13b

C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

MD5 adfc8df9b178b18a676689bf11dcbecf
SHA1 c3e0408666d5b7a9d8e83b448b98cfbfa006c0d9
SHA256 20540b57e92c993a12f6fd3e42930a89fc07855cf91ed44747a69a6b49113174
SHA512 3796224eea4db328300d6db5da08e600ad01ef9e2ed1ad17629f8d0ed45c7803b1789679309d0a46ebbd7e2759a1041e6aad45fbbc5c94e1b4d9c054342245f5

C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

MD5 217ae86554906014426acad719bd4b91
SHA1 d5992875f4fbe49467b1b0df0de316cd0f2017c4
SHA256 a878063def76db715181b3a83848123624990ed5f6e9f5505ed798b8fbc80cf8
SHA512 55564d3142afd425c7b3e6981867110faf68c27b707e24d4437e27ec3bb90348d3488c6e9e5290e235b49a7b2250212d63a822e7d6dafb5e95bdaa68c5e9a7c5

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 0304636aad6dfc54cc29e4de60edcbf0
SHA1 15e74429a887ccc3500105aeba21dd16c7ca5c94
SHA256 2db13d6d9c8cac38e2ffefabf8238def80be20715d0badc92fa8534e635fe48b
SHA512 9493acbcece9e4f11e5ed60e80811afc233290e0686391d13235008d44c743cc16c51d2e861efd22adddc4a93084c62d211fcf403fe76dbc131cbae546c194ed

C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

MD5 6110d6099bf50b59b2bc291e50556271
SHA1 bbcf63a78c47952292c3ca9661f2faf123c0cd7e
SHA256 197e1f22e8c1eb25f422b13a6e393635d0933b96136f7c3ab0384f7086c0a108
SHA512 e8218440f131556bed7c3b64522f54c396e6a3d076c6f954549b689cdc4ae0b8591fc057ffd4414fd583d61011587702856725e3b1bfeb6c3297b62ddd982b50

C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

MD5 01aa742fd92367ff403fe115b078e79c
SHA1 bca9d2a4f8df9b0d0a4c0e7fd43c97856d550f6d
SHA256 fb127e93128a3de5607852ac36fb3db954b804fc4aef28dc6a5f0c803a086b32
SHA512 7242a20a02fbaa62d5aeac1b0fd55a6643fd90b62d99bb7e6dab08b08153d90a1e533317df9ca3ea9708d05c2a04a2d7852a754d247987517ac8f21be64a48ec

C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

MD5 67a6f64b25b947675b49e0c4924b4c19
SHA1 df8d5fae55643fa4cb95cc38bcc5458ad3218ad2
SHA256 0dd22b9ebc8daedc5358b86511d201217a523462f34bfbf86db8fb325ccce986
SHA512 b296f0eb50af86bba8df2c6c66ee69adef9206b4abbc63cd7c956187b31ab5923433cc134d9822d44cb03add9596643ad3eaccfb8ad490bf9f46377e9e4652ea

C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

MD5 e95b554b01c0913490ba18587c37cd52
SHA1 c228542f4f0c05c73b2dd1de86c614a38b40276e
SHA256 d42509e7617068244bb2bb8608354fc1dd09c06bfdadb7f4b011841722e49ee2
SHA512 334ef51eaa5b03aa41e4a6f9714523fbc5583518bc12e3254ad09cf3e2e71e6969458e8f6647f67a7df062900194a10dfb918d74536622e8216b2810a0923f59

C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

MD5 b22c75b4be8edc7c3e2a4b1f0522dbdc
SHA1 c3fe1e6ed7772528d497e03ee767b1c7328c8161
SHA256 a0b0a923d69da7c3c9afe58f2fd7e900d7582227eeebca1de461900221e1ec2a
SHA512 7efc0f467ef7fb550d86f3f463ef9ca66de19274bb0db0572f0dd7e38f271dd038fe5e0f471a8496ac2abd2fdf023c569bc7e3d0d94af270d7e8b2ac489a7ff1

C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

MD5 a163c85eef9878bf291c37e8ec611556
SHA1 19de9462283fb9b013d78e7f84a87b0dbaf24118
SHA256 a76594db0f9daffec41ef7a74eb04953387a5f329d3f39c2ebc6c98863a0b64d
SHA512 f720e64bfc1c5d7f4757a9d6226318222dcca8a08d156ba10b08bb0dca6a9f8514ba4e4e2b48ebe579ba62dfa23eb9a4cf8a088108800dffea0d9dd008f35890

C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

MD5 bac8542a3594c50d6261542376304c22
SHA1 64c62b08e611b4471feba887fda83616e0dc7d5d
SHA256 20229fc63ec152773bdfe317ee004098850cb4fa3dfc19e549c04a7be76df5ca
SHA512 bedd7992cf0070a44c5533b08a3f3618ca1d77fa132db21b62961bfdc0d32b8e57cdf3a6f22daf5549c7928d7111ae148c3fd8fa22dfb51ec0ea8251bcc0f035

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 7d373183394b89b6071438cb4dd8e202
SHA1 a972cd4b5c40ef7cd2ef56a1c278ec349cbd85d6
SHA256 18b83d206355e4d21ff64ec22c49e92d09e9b605fc736a2effc3af08ed793dca
SHA512 3481ab9237e928c5aeda626fa148f69d8548989aaa3db17f081608e911917b5758c5d3447ce5f5964d4058d62c87da1fb65109465199e8d0adfc08dca7056cad

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 2eb20d934af9ec7b6ecd2550fbc52ffd
SHA1 a7bb21764d58df260450d2f69766c80f6a281bde
SHA256 c7a238c9a555c2a4c5df586e86be2d71cb3d05092000dde3fdb2800f5f0e8ac8
SHA512 2a7c2a81b535473eb59fdca890ad28caf4b050ca8b80ba1365ffb517bde6c71a3d8415a733de6498d84c3da03310dd9f80d96fb98c5921c56f52ccb1a28f393a