Malware Analysis Report

2025-01-03 07:43

Sample ID 230428-rvdxmsef56
Target tmpfkfb5hd_
SHA256 66190693a0bc90c29db018f37585b54fe7a3d42bfb01dbfcdee7567f37e7f8c8
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

66190693a0bc90c29db018f37585b54fe7a3d42bfb01dbfcdee7567f37e7f8c8

Threat Level: Known bad

The file tmpfkfb5hd_ was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Modifies data under HKEY_USERS

outlook_win_path

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Script User-Agent

outlook_office_path

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-28 14:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-28 14:30

Reported

2023-04-28 14:33

Platform

win7-20230220-en

Max time kernel

151s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a6a5abca826a969e.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1220 set thread context of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1160 set thread context of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{46060F4F-172B-4018-A4C6-3DB64E37D591}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{46060F4F-172B-4018-A4C6-3DB64E37D591}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{AE9617AA-346F-45A2-A3DD-6826B1725617} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{AE9617AA-346F-45A2-A3DD-6826B1725617} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1220 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1160 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1340 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1700 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2000 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1704 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1404 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1340 wrote to memory of 1876 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 24c -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 25c -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 1d0 -NGENProcess 260 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 24c -NGENProcess 264 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 268 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 26c -NGENProcess 264 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1d0 -NGENProcess 264 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 23c -NGENProcess 250 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 23c -NGENProcess 24c -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 27c -NGENProcess 250 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 240 -NGENProcess 1d0 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 280 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 23c -NGENProcess 288 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 250 -NGENProcess 28c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 250 -NGENProcess 260 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 290 -NGENProcess 294 -Pipe 268 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 290 -NGENProcess 24c -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 27c -NGENProcess 29c -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 27c -NGENProcess 280 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 29c -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2ac -NGENProcess 2a4 -Pipe 2a0 -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 17c -InterruptEvent 168 -NGENProcess 16c -Pipe 178 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1283023626-844874658-3193756055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1283023626-844874658-3193756055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 168 -NGENProcess 16c -Pipe 184 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1220-54-0x0000000000B40000-0x0000000000CB8000-memory.dmp

memory/1220-55-0x0000000004E10000-0x0000000004E50000-memory.dmp

memory/1220-56-0x0000000000460000-0x0000000000476000-memory.dmp

memory/1220-57-0x0000000004E10000-0x0000000004E50000-memory.dmp

memory/1220-58-0x0000000000520000-0x000000000052C000-memory.dmp

memory/1220-59-0x000000000A9D0000-0x000000000AB08000-memory.dmp

memory/1220-60-0x000000000DB10000-0x000000000DCC0000-memory.dmp

memory/1160-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1160-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1160-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1160-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1160-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1160-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1160-69-0x0000000000A60000-0x0000000000AC6000-memory.dmp

memory/1160-74-0x0000000000A60000-0x0000000000AC6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 d27ebb0cfd0bfa15dc311e68f40418b0
SHA1 5ef0aa618e87bd641d864f4d88085fb82c139976
SHA256 19811d4ebba8231ec82859f7258c556c3d3492c03c2f29ce3b38214a599d7cdd
SHA512 1da41f0da0e89194bd248d1bddcbe8a0277f5bebff98e50b567cc7855e6c5436d789cf39f67dbe44eb83f6fbcf3781f2e3c269054f116a5997bf6d346d9a7439

\Windows\System32\alg.exe

MD5 d27ebb0cfd0bfa15dc311e68f40418b0
SHA1 5ef0aa618e87bd641d864f4d88085fb82c139976
SHA256 19811d4ebba8231ec82859f7258c556c3d3492c03c2f29ce3b38214a599d7cdd
SHA512 1da41f0da0e89194bd248d1bddcbe8a0277f5bebff98e50b567cc7855e6c5436d789cf39f67dbe44eb83f6fbcf3781f2e3c269054f116a5997bf6d346d9a7439

memory/816-82-0x00000000003B0000-0x0000000000410000-memory.dmp

memory/1160-83-0x0000000000400000-0x0000000000654000-memory.dmp

memory/816-88-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/816-90-0x00000000003B0000-0x0000000000410000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 42e4062e090b9aaee7785215706689d7
SHA1 466e96c9fe0f4557bac4167cc6c93e4a48bf551a
SHA256 efdff539bc8bb2ad65998cb49849051d1be70508d7502e4df0b09cbf3330cc1c
SHA512 59cad875f1db8d3b6322f6ea7eb43f1859bf909a19982bbb4e192278c4ab60b25282fdc613e6dd2a7524dacc3de5815d01c521d54f8e7df022cce5756a0414dd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 42e4062e090b9aaee7785215706689d7
SHA1 466e96c9fe0f4557bac4167cc6c93e4a48bf551a
SHA256 efdff539bc8bb2ad65998cb49849051d1be70508d7502e4df0b09cbf3330cc1c
SHA512 59cad875f1db8d3b6322f6ea7eb43f1859bf909a19982bbb4e192278c4ab60b25282fdc613e6dd2a7524dacc3de5815d01c521d54f8e7df022cce5756a0414dd

memory/1548-97-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1556-98-0x00000000002D0000-0x0000000000336000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 118395a879431c93c39fac2a00ea6b04
SHA1 e19201267f607942f731fcd3b19729a07c78da10
SHA256 f3f9e9e7669ceb8262c983e0c9ccacb5d24374701f76887ec1973130545abc77
SHA512 56421408896d1c3c802142a3b70efbee2ac673f5305d490c6072eb24d310cb0cbd585f2ab8bce2d82656b975d54a61f61dea32c84c2e26fbfe27851e64464edd

memory/1556-99-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1556-101-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/1556-103-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/1556-105-0x00000000002D0000-0x0000000000336000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 0bec7b427062122cd17eccc043c28b78
SHA1 4639f5c4d6df59aa81d4529c14895cd27f70931f
SHA256 7e86337b0f9b94066aa92b70e2f526b274469fcb8a3f7fbb006da12f1236a4d0
SHA512 6b9b053d751dc32b44387c884c055de2a285f983fbc6aef1d95090999d7439802a6e5f60ecba6e24e50c4e5b5744aefe4145517096ac3f330373d764c2c26571

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 0bec7b427062122cd17eccc043c28b78
SHA1 4639f5c4d6df59aa81d4529c14895cd27f70931f
SHA256 7e86337b0f9b94066aa92b70e2f526b274469fcb8a3f7fbb006da12f1236a4d0
SHA512 6b9b053d751dc32b44387c884c055de2a285f983fbc6aef1d95090999d7439802a6e5f60ecba6e24e50c4e5b5744aefe4145517096ac3f330373d764c2c26571

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 118395a879431c93c39fac2a00ea6b04
SHA1 e19201267f607942f731fcd3b19729a07c78da10
SHA256 f3f9e9e7669ceb8262c983e0c9ccacb5d24374701f76887ec1973130545abc77
SHA512 56421408896d1c3c802142a3b70efbee2ac673f5305d490c6072eb24d310cb0cbd585f2ab8bce2d82656b975d54a61f61dea32c84c2e26fbfe27851e64464edd

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 fd09f3bf74cde7bedd95bbf216774f34
SHA1 4055aa95b77be96664e12c41a6e3300e7f44a624
SHA256 038096c5f3af8b2a7a68105d3da7a284e84d2225e434ddde4da0ae8b20065201
SHA512 2d1c29d2ebbd7d6e5452568bf984eef776c6ccc97e9a54cbc2657bf853cc74c38501711cf8c1d7fb1f0e02a84e82d4f989f0673473f52f49841c8b169ce9fa49

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 0bec7b427062122cd17eccc043c28b78
SHA1 4639f5c4d6df59aa81d4529c14895cd27f70931f
SHA256 7e86337b0f9b94066aa92b70e2f526b274469fcb8a3f7fbb006da12f1236a4d0
SHA512 6b9b053d751dc32b44387c884c055de2a285f983fbc6aef1d95090999d7439802a6e5f60ecba6e24e50c4e5b5744aefe4145517096ac3f330373d764c2c26571

memory/1556-121-0x0000000004480000-0x000000000453C000-memory.dmp

memory/1704-122-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1692-123-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1556-124-0x0000000004E80000-0x0000000004EC0000-memory.dmp

memory/1340-126-0x0000000000BF0000-0x0000000000C56000-memory.dmp

memory/1340-131-0x0000000000BF0000-0x0000000000C56000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 75e00f0869f9b033a5307301ba6f5b2d
SHA1 e29863ce6aec053de39967db40067e36afe23c3c
SHA256 9d3a805b846d6ddab393bb9fc655d7bed537dc34a09cbccd1d7de2a55e38de5c
SHA512 fe8418b06b418a6a021174cf02625141587ea5b18ae401d8272600524b619b0659f48a435f2f0cc5906d82e02c1e900cfffd21b293d83bcaafdcaa8bad163687

memory/1340-138-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 11cbb1c018e4e63494f393f55bdd2b05
SHA1 31a15def8abecc54330c97071d4a43975a06defd
SHA256 7be5fb01a586d19467748f227f646b25c97f9fc059b0aae1d816363273e5834b
SHA512 822f04397c21f682234b6a29ab18c048ce19ebae7550d6b2ed556d86eb36da3cef97203a500c200560cfef98a5f87d3cdf681c3e573d86b31f7f5881ac80ac14

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 11cbb1c018e4e63494f393f55bdd2b05
SHA1 31a15def8abecc54330c97071d4a43975a06defd
SHA256 7be5fb01a586d19467748f227f646b25c97f9fc059b0aae1d816363273e5834b
SHA512 822f04397c21f682234b6a29ab18c048ce19ebae7550d6b2ed556d86eb36da3cef97203a500c200560cfef98a5f87d3cdf681c3e573d86b31f7f5881ac80ac14

C:\Windows\System32\dllhost.exe

MD5 f78834515befe936791d818ec1d390d5
SHA1 6dc4af492a0821e41f7dab87fbf89729bb249c8d
SHA256 7634cb9f517353698d40d0fb171e624f32360a51b46393aea7f3cca52f5a8a18
SHA512 21aa4860463fc3817c5dd6b6d04645526df4db1ae8c78b361186f9e9b1d1ba747d7ee8d09d5ca72ef5cad70e0f2bde6ee556620765c68bfed9064afd18e84532

\Windows\System32\dllhost.exe

MD5 f78834515befe936791d818ec1d390d5
SHA1 6dc4af492a0821e41f7dab87fbf89729bb249c8d
SHA256 7634cb9f517353698d40d0fb171e624f32360a51b46393aea7f3cca52f5a8a18
SHA512 21aa4860463fc3817c5dd6b6d04645526df4db1ae8c78b361186f9e9b1d1ba747d7ee8d09d5ca72ef5cad70e0f2bde6ee556620765c68bfed9064afd18e84532

\Windows\ehome\ehrecvr.exe

MD5 58c97ee4f81eb87b354b51d577c61674
SHA1 94aad34bbfde12f9464a241adb29a773799b4b48
SHA256 0584e79a3c791ea6c1c6d78df83a736fee69cf7ff0ee781eeba63ea27b82b3ad
SHA512 2a4ce066e5e9e845af019e1c3878342bae16fd329323588136557febf9981cc29468ca94a34afbdeb440d30de7f32a9dbdd1302a81dec9e398272ebaf6b7cbe4

C:\Windows\ehome\ehrecvr.exe

MD5 58c97ee4f81eb87b354b51d577c61674
SHA1 94aad34bbfde12f9464a241adb29a773799b4b48
SHA256 0584e79a3c791ea6c1c6d78df83a736fee69cf7ff0ee781eeba63ea27b82b3ad
SHA512 2a4ce066e5e9e845af019e1c3878342bae16fd329323588136557febf9981cc29468ca94a34afbdeb440d30de7f32a9dbdd1302a81dec9e398272ebaf6b7cbe4

memory/1496-151-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/1496-157-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/864-159-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1496-161-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1924-160-0x0000000100000000-0x00000001001EC000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 0c4347a440ed7a1749dfeaa41de0b5f5
SHA1 dda8bcd3a2432b1f9c4f948c90ca98539d2e5af8
SHA256 f6e345e980c6395caa455f4d7452b379acd2e949e8a951ebad96a67e55b24f5b
SHA512 e88fc58e1f1c2c9e4840e70050218db50d371e127ed28e70917ee163dac91d36012d74163d1bc2d74845f58e4898519e4f51f1c9ddee9bb20c337c9612658256

C:\Windows\ehome\ehsched.exe

MD5 0c4347a440ed7a1749dfeaa41de0b5f5
SHA1 dda8bcd3a2432b1f9c4f948c90ca98539d2e5af8
SHA256 f6e345e980c6395caa455f4d7452b379acd2e949e8a951ebad96a67e55b24f5b
SHA512 e88fc58e1f1c2c9e4840e70050218db50d371e127ed28e70917ee163dac91d36012d74163d1bc2d74845f58e4898519e4f51f1c9ddee9bb20c337c9612658256

memory/1732-165-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/1496-168-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1732-170-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1496-171-0x0000000001390000-0x00000000013A0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1700-175-0x00000000006C0000-0x0000000000726000-memory.dmp

memory/1700-180-0x00000000006C0000-0x0000000000726000-memory.dmp

memory/1168-183-0x0000000000260000-0x00000000002C6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1168-188-0x0000000000260000-0x00000000002C6000-memory.dmp

memory/1496-192-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1700-193-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1168-194-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1168-205-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1404-208-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1944-211-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1944-228-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1776-233-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/2000-250-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1304-259-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1704-260-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1704-271-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1160-279-0x0000000000400000-0x0000000000654000-memory.dmp

memory/816-281-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/688-283-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2012-285-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/2012-298-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1548-305-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1404-306-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1876-320-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/768-326-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1100-343-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1004-344-0x0000000001B00000-0x0000000001BBA000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1004-349-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1996-366-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/1496-374-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1776-376-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/280-377-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 65b54bf4d75afd6105b6e2e743954c6c
SHA1 a24abc5781cf1db909cf8107ff16618d3aa8bb4c
SHA256 995b2b544e7e4d9cf39ba8b00b63fb5124d99e1bdb8449da039cbb6d09900bd0
SHA512 d6fa7d418b7baf19e88a278269bdeed04d75b8fde534c6f6703d9848c3f66dfbd0b4c5e2c49c158f7199b2aeff514e1d1fcc5f98c7f1fed0bf55868d16ab8510

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

\Windows\System32\ieetwcollector.exe

MD5 99729f391f7af21072ec6d6dcdf5397a
SHA1 a9bf6f96da2e2866d82df699161b09bcf6486ca2
SHA256 a4178e617df411e4f48783d346268819c2fc511aeb5060011df09969f8a0e37c
SHA512 565e9f76a5c7884ffaa65f7b2b53713e9718f331ffec3a0db182a2e343bdad4a6f3b17ef27c33c986af045a174a9243c10913062083913b829bb2f3353f68469

C:\Windows\System32\ieetwcollector.exe

MD5 99729f391f7af21072ec6d6dcdf5397a
SHA1 a9bf6f96da2e2866d82df699161b09bcf6486ca2
SHA256 a4178e617df411e4f48783d346268819c2fc511aeb5060011df09969f8a0e37c
SHA512 565e9f76a5c7884ffaa65f7b2b53713e9718f331ffec3a0db182a2e343bdad4a6f3b17ef27c33c986af045a174a9243c10913062083913b829bb2f3353f68469

memory/1540-409-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1500-411-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1620-412-0x0000000140000000-0x0000000140205000-memory.dmp

memory/280-415-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 a0079ad397332e2f3efae400259a724c
SHA1 0c82b69e32482e30545091205a0cc3602d42fe5b
SHA256 e9b2436d7571633efadb34f09ed5d4eea01c8a896dcc332fa0695ba2b138aa50
SHA512 3890aa9158886adb3fa7b3ab8a20a1cccb481030d51d1fc265e716e84a4aa3560a365927f9802f9700d7c6bd46a32c2ff4f507a48a3fbe3304d9bc3c92690ebb

memory/1304-426-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 7cdf71870d3457d7d0a939f02a543630
SHA1 81bbfb3032c9c9b13e1ce194d9db96bc66720727
SHA256 e97b2b4ebd15dfdb87ac97f1acce8cde83c8d5f6c27d5f72b1ae29de7b51f228
SHA512 22425e6b58697b97b27fe06617b2a54af0184d123bb268434b53b318ea101e53a2321be736be754fa9dde3e24afba4d01e31a28158201dc461c017316890d963

\Windows\System32\msdtc.exe

MD5 eb45f3a4bd24340ea44089d1e5ff9bb0
SHA1 0f2516b4ed5bfdfe56a65ff12b705648a024d00c
SHA256 96b51c098865b6b8a51b6cd6853001f56a835461e4b877a2de5374652f70e9cf
SHA512 c4966eec06cd650f9a102fbc07b0499edf6b4067de1580fbabbdfa9c004f0e630ba9bd8ecac7a6f30c79b44b64d1012a41cfe82df040d3798e1b8eabaeac3839

C:\Windows\System32\msdtc.exe

MD5 eb45f3a4bd24340ea44089d1e5ff9bb0
SHA1 0f2516b4ed5bfdfe56a65ff12b705648a024d00c
SHA256 96b51c098865b6b8a51b6cd6853001f56a835461e4b877a2de5374652f70e9cf
SHA512 c4966eec06cd650f9a102fbc07b0499edf6b4067de1580fbabbdfa9c004f0e630ba9bd8ecac7a6f30c79b44b64d1012a41cfe82df040d3798e1b8eabaeac3839

memory/1760-444-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1704-447-0x0000000140000000-0x000000014020D000-memory.dmp

memory/1760-453-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\system32\msiexec.exe

MD5 40855fd6765e76449cf86455b3818514
SHA1 bbcd1e5696761194408bfe4beec59fadc51be084
SHA256 7561b531cea02f25c379b41d5cfc5d313d6aedcb157feaf37d62bc670905ec3e
SHA512 7f806a5f112cc92730d590cdcf38c07ee89588ae82c4f1ea13614515bdad534ccbedb3e5fa36808d813744fb5c0fba6be4081412c58abd9df51206c1264bc76c

C:\Windows\System32\msiexec.exe

MD5 40855fd6765e76449cf86455b3818514
SHA1 bbcd1e5696761194408bfe4beec59fadc51be084
SHA256 7561b531cea02f25c379b41d5cfc5d313d6aedcb157feaf37d62bc670905ec3e
SHA512 7f806a5f112cc92730d590cdcf38c07ee89588ae82c4f1ea13614515bdad534ccbedb3e5fa36808d813744fb5c0fba6be4081412c58abd9df51206c1264bc76c

\Windows\System32\msiexec.exe

MD5 40855fd6765e76449cf86455b3818514
SHA1 bbcd1e5696761194408bfe4beec59fadc51be084
SHA256 7561b531cea02f25c379b41d5cfc5d313d6aedcb157feaf37d62bc670905ec3e
SHA512 7f806a5f112cc92730d590cdcf38c07ee89588ae82c4f1ea13614515bdad534ccbedb3e5fa36808d813744fb5c0fba6be4081412c58abd9df51206c1264bc76c

\Windows\System32\msiexec.exe

MD5 40855fd6765e76449cf86455b3818514
SHA1 bbcd1e5696761194408bfe4beec59fadc51be084
SHA256 7561b531cea02f25c379b41d5cfc5d313d6aedcb157feaf37d62bc670905ec3e
SHA512 7f806a5f112cc92730d590cdcf38c07ee89588ae82c4f1ea13614515bdad534ccbedb3e5fa36808d813744fb5c0fba6be4081412c58abd9df51206c1264bc76c

memory/2100-466-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2100-468-0x00000000005C0000-0x00000000007C9000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 7e8976032a4740d05b5c963eda2ba7b5
SHA1 88d8c270a707d3d9536c8d29b4ec3a4f6bb273b3
SHA256 1183408b85a3e99c3861e3055f8f70bec743fdef1763b0b3f7bca7d14508860d
SHA512 4d387729b2dc2cfaec222166fb8dc59ac0cb67740b4e053524a3b48a6ed31eed0756d963af7366dc9faad788b95377699f14af355e18c2b1b15a77ae2969e4f0

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 1bc2aaf0faf323daed7d452673487249
SHA1 b5d079d6eb0814a1d035e0715fd70c7cdbd68efd
SHA256 9cd13c6e83da608dddc0983e68a994ed2341b6e320544bc6b56720991e907a2e
SHA512 dd5b0e4da97170970fad8eca277ff2e8a3551208824ec908a43ec4bc91ed454bc7794e5b699701d22372ceaa4e6c8924d4771ad1c3a034decda72b8cc459f99a

memory/2196-480-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2228-481-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

C:\Windows\SysWOW64\perfhost.exe

MD5 e3d1ba482502bb6e48230b2729e99409
SHA1 eb0a9c361e3d909d02d7eed47d80c11b6d107e36
SHA256 c3cd842e859812e7bf5d8ce6ca5d16b4866099c31cfc578095299e932c745f8e
SHA512 5c36ca9285d78b880406f9c0553fa3015153dd6d713be7b9b9d775f2882221d1dd2cabce64a930ac9f742afa42c83f37b21f3602452e2e43dc6e76a60f7633bd

memory/1500-495-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 17c62727ee9efb1372eaf509dfa1102f
SHA1 20de032994ee97ea33b255afc4938f50fdfea534
SHA256 b24d869d1efcf45a3bbf0562cf750821fe80b4edfb164bd70bf0914e3b8bb5be
SHA512 679d163b250e89d54fc8397f1e5682069a39ad13f8e75add7387e1d2a0712bde68d2900fd53ec790ba907330426621ae6a6f7f724eff71c869beb3843d30f7f4

\Windows\System32\Locator.exe

MD5 17c62727ee9efb1372eaf509dfa1102f
SHA1 20de032994ee97ea33b255afc4938f50fdfea534
SHA256 b24d869d1efcf45a3bbf0562cf750821fe80b4edfb164bd70bf0914e3b8bb5be
SHA512 679d163b250e89d54fc8397f1e5682069a39ad13f8e75add7387e1d2a0712bde68d2900fd53ec790ba907330426621ae6a6f7f724eff71c869beb3843d30f7f4

memory/2460-505-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2360-508-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2380-510-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 f65e0445699da792010a0162bc87c747
SHA1 521b1e6f9feb14b7e5f28855173ef8f49bb9937e
SHA256 c626c65aef0aef4097adfa5924f85feb723c71a613c6dd603b42416b971bbbc0
SHA512 e017c22d68716cbdc7df82268b6f931c903ffe431ded23d1bd9dc02b6d02664289ebc9aeb917063d565e1d55dddd92c46edfe67f3875a37aaf30b5ea2650a23c

C:\Windows\System32\snmptrap.exe

MD5 f65e0445699da792010a0162bc87c747
SHA1 521b1e6f9feb14b7e5f28855173ef8f49bb9937e
SHA256 c626c65aef0aef4097adfa5924f85feb723c71a613c6dd603b42416b971bbbc0
SHA512 e017c22d68716cbdc7df82268b6f931c903ffe431ded23d1bd9dc02b6d02664289ebc9aeb917063d565e1d55dddd92c46edfe67f3875a37aaf30b5ea2650a23c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

memory/2572-532-0x0000000100000000-0x00000001001ED000-memory.dmp

C:\Windows\System32\vds.exe

MD5 3a92aa49340ef7a8f59d7d0048993fd8
SHA1 5f66a306590886c953830215b44f6ab6cfb9ca2e
SHA256 e780702c9270b5d85e504746691b19d21e504f9e51a05ac927155e4a1d2864cb
SHA512 f7e73538f3703875d371c253834918105e2814d9f684e733e82514144f31db2bf97152e016b761d80c5e66bfd7151867689f22a6a918506f52c786a7a6a6f771

\Windows\System32\vds.exe

MD5 3a92aa49340ef7a8f59d7d0048993fd8
SHA1 5f66a306590886c953830215b44f6ab6cfb9ca2e
SHA256 e780702c9270b5d85e504746691b19d21e504f9e51a05ac927155e4a1d2864cb
SHA512 f7e73538f3703875d371c253834918105e2814d9f684e733e82514144f31db2bf97152e016b761d80c5e66bfd7151867689f22a6a918506f52c786a7a6a6f771

C:\Windows\System32\VSSVC.exe

MD5 0d2701656dd126a45ae18e23e35aedbb
SHA1 d1f4e200ccba024a1b481dec7c2e09fdbccd69cd
SHA256 4c3dcca63e2ffc02d37b33eb53a28461d6cfc24595181cc1522e25b8dead7410
SHA512 109721740a11b08c5b6613b2034c29b2329d9e9633e7c4da14c7f28106231e40aa3f3c808bca7a7d3f541d284bb20d5d4e4a32f5c2459bb0a44be8a6f2008933

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 5c5b099179be90aed204882bee2119fd
SHA1 863c8cd0230b20742860ef7fd118ee9dcc136306
SHA256 073ca3944c949bdf1d65a84b7527869ad45477a449119f76cbfa0cbc10a73c3e
SHA512 a53521384c4f0112df53b748db1e563a51fb89f35f4f402f6c96de3326aac96196ccbf43974dfab3b1300c3dba4bb583c1bf237caaafd9b90f1207550eef033e

\Windows\System32\wbengine.exe

MD5 d3a2d1802be719dc91dc1a8ec95f506e
SHA1 b68cf74893561628197e7d5b05849e5f19ec102e
SHA256 1166167236983e5f071dd2e6290e7d79a1164f8d353567fd64bd9169e482f951
SHA512 8f78bea3accb250990bb2ec4bb52bbbe3c6021531940bbf377346a6abe183f472635a6e9253cbd6dc8895545ae94a2f513e3cfc97deeb4c9d0c5ed6141f1dcd1

C:\Windows\System32\wbengine.exe

MD5 d3a2d1802be719dc91dc1a8ec95f506e
SHA1 b68cf74893561628197e7d5b05849e5f19ec102e
SHA256 1166167236983e5f071dd2e6290e7d79a1164f8d353567fd64bd9169e482f951
SHA512 8f78bea3accb250990bb2ec4bb52bbbe3c6021531940bbf377346a6abe183f472635a6e9253cbd6dc8895545ae94a2f513e3cfc97deeb4c9d0c5ed6141f1dcd1

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 799d113a8c86b6cbace6bcf31b44ae92
SHA1 3b65338cc2472593acd647d19a010ce29d08f31d
SHA256 fceef6857cf96621c3bde221105dc8693f33282826248d0af03be72cf4fb7624
SHA512 1aa44b19466184ee8ded91698da2bdf99d9b55b217a7b56f63e48af96e0aa932bdeaf90ec686151b312bc8def771015820d533e2bfd18a9b45d4dea4d8e6e3b9

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-28 14:30

Reported

2023-04-28 14:33

Platform

win10v2004-20230220-en

Max time kernel

152s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\90d7764bc4600f4c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3084 set thread context of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3760 set thread context of 4684 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000616e2ffbee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000096143f2ee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046d412fbee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002846edfcee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c581ffdee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037d131fbee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034751bf4ee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089b2cdfaee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000491d21f3ee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2cfb8f4ee79d901 C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3084 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3084 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe
PID 3760 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3760 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4928 wrote to memory of 4412 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4928 wrote to memory of 4412 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4928 wrote to memory of 960 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4928 wrote to memory of 960 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe

"C:\Users\Admin\AppData\Local\Temp\tmpfkfb5hd_.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 20.189.173.7:443 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 41.249.124.192.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 131.253.33.203:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 udp
NL 167.99.35.88:80 tcp
US 8.8.8.8:53 udp
N/A 63.251.235.76:80 tcp

Files

memory/3084-133-0x0000000000560000-0x00000000006D8000-memory.dmp

memory/3084-134-0x0000000005660000-0x0000000005C04000-memory.dmp

memory/3084-135-0x00000000050B0000-0x0000000005142000-memory.dmp

memory/3084-136-0x0000000005010000-0x0000000005020000-memory.dmp

memory/3084-137-0x0000000005080000-0x000000000508A000-memory.dmp

memory/3084-138-0x0000000005010000-0x0000000005020000-memory.dmp

memory/3084-139-0x0000000007E20000-0x0000000007EBC000-memory.dmp

memory/3760-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3760-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3760-144-0x0000000002EC0000-0x0000000002F26000-memory.dmp

memory/3760-149-0x0000000002EC0000-0x0000000002F26000-memory.dmp

memory/3760-154-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 fcb917c18dc8e52608f46ce7082ec505
SHA1 30a2ae16a01c7b017b19b441554fab7fb0001a4a
SHA256 aaac2a403e0547ad34fe51e5f5cea6fb055d56153a7a2caae12b95ca574d0d08
SHA512 0d35d0410f015776596f4d080fc0136c4cbe96ca6f0a0d4da15f5977ac5171d668c0df2543e71fcac47eb2c0a0c92cbf272c0760716b79257b13515feb9bdc5d

memory/2060-157-0x0000000000660000-0x00000000006C0000-memory.dmp

memory/2060-162-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2060-164-0x0000000000660000-0x00000000006C0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 de4d51b9982aa93422b8b0279d07e03d
SHA1 bd34be5a4744845869919da72a3a85b74fcb84b3
SHA256 9c3fc144f044d7fffaf655c0ac7b68f3efff2ea4846734c411ad498b9d736c25
SHA512 593ae4b5df1dc12c6dfcb7436df7234683eea742269d5649685551f2e57fe8622f5f340d749d267b145e8cfc09913dc2cc78c3feb109a2a7e777f93cf3f9748f

memory/3388-176-0x0000000000660000-0x00000000006C0000-memory.dmp

memory/3388-179-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 c9166e8898e8dccc28c7e6387a9959b1
SHA1 472b699fd7b734285cc1bccfdfb4fcf545ef862c
SHA256 43d0db2153a8c8b75a63c42fa94fed329528c00f681cef8e842364625dd90e95
SHA512 a0a60facfa0580707da8b18911972e95e8c109e9e6fce57007dff1b080cc6ed0b5cde330c2837f1ad66c8bffdd86bb493dbe72796d7a93d0d0421d3501f2b8f3

memory/3584-181-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/3584-187-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/3584-190-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3312-192-0x0000000000C90000-0x0000000000CF0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 f6e5a3e7b2d824ecd2d97cd6945cb082
SHA1 336cf4ecec4bfd030305e50347c9659faf24461e
SHA256 a3bd2ac50bc6a82b6500420b5e79105ee58511fa9f521a2e8772647c134c4043
SHA512 c65084d890974cf783b7b28da5bda60255cf495615631b225d08cc2a7181f9adbb2f70b2ff8eac216d14494be2656dbd37d1cb44621342e342e3761987e1bb3f

memory/3312-198-0x0000000000C90000-0x0000000000CF0000-memory.dmp

memory/3584-200-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/3584-203-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 4677d794f52d2b301ce20bb3945d859d
SHA1 13c316cbc153b53014dc390c8fff450487e9de19
SHA256 92a048196f6bec5dcfd3aeb403350565b162bc1f5bade3a256c7eac27a328c30
SHA512 0bac3d98f7d637d27981b51c44f1dabf0e56f00108b02b0e088d4eac6478b2ac266f1e07c22b57ff1abd49256b6ca10b2f3faf72d09c6511a187a3b57d39ce5d

memory/3020-205-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/3020-211-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3312-214-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3020-212-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4684-215-0x0000000000900000-0x0000000000966000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 061ce407327661c2ac0a9e82debd8e72
SHA1 335d78dcd16f9ad5df925a2f835e20286a32f8cd
SHA256 5f462a5951d7183f0bed92f8e974d7408c8381d6d8164c947da704d4597a2aa0
SHA512 80d36809d4de2eb3c587d5483babcf155bada4323d4ae50dd31aa8a3d26202543b525f5378597bd326f900dfc1268886c98d261b6b06a166061ee0eb398a995c

memory/3188-218-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3188-224-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3188-228-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3188-230-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 a495a132104c7c6934a8f305392b9653
SHA1 729972c418e0c7d2f2468a665341d38ce5326dcf
SHA256 26e787d052d0834ad903a42ef2baa9e9a34de23ef79a9a18086878bb5688c853
SHA512 e99152f347736a33125425cb07a28956b423e80c29c3a50689acfc9e26c3e2ca3591d38d2a5b9e5a240770119e754c8e0acd712d3bb45a6cc093628f55274406

memory/4564-234-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4564-233-0x00000000007A0000-0x0000000000800000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 00f74b8a917c81ebb6a38bbeb41da38b
SHA1 80d22d89b16933eb1af9b235672b614a64b2c61a
SHA256 7adbcaf367e0157d085fe44e1406aae26225148c88b803f6ff64808907815d85
SHA512 410124beb9e0c19ef3cdf4721f868f69e5dd489e343e8a9faad9c56d9b40f84fb1d3c9007083b826e111f3f9251a93acd871d297e39d92fe2a053f55f17f8d51

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 b016a74ba87d442b59cd2cf10bf818aa
SHA1 92af747fab52654f6fecc7ce5d1710134205a136
SHA256 68e781fec9ef94d3181772ef0607f326efd5bc111663aa0baea9b108fa5e9ea5
SHA512 13f0225cd469710e50fe28974323e68b87d8a900356a00a8afda6eafbc8e1e8064781482ff3b88debbce1bc8636e8f59aac841d6b455c94db462f6b95b4519e7

memory/1756-267-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 d24f647a6b3db146ec7d8d2828023f49
SHA1 2b0e718c8498d6876130410af84b144d6e0b5963
SHA256 f2fa4a4cb45007855ff76808aa50a09156332ee118521c59b923ac679b0b99fa
SHA512 fdf7328af7572c51d9f952fd9b3b9e2dbe89b20ee2e98b728acb276940020ba1c8cf1e9323bdef4a5530efa3ba99ddffdd234d8135991befccc04821a7c2c7d0

memory/780-269-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 e3b304aeabefec144e74803d8cc35f1b
SHA1 1d46dda381fe5c7e3932f56b0c9c45d96d2724ec
SHA256 3d09f8071ebfc25f818feb7cf8e24e1f24fcd27e5f76a77ff0f8e3bb2a386965
SHA512 d954ee44d3eb4e36702cf818d4ea498d4363586a149262c4bdd2c9680e0ed64ee6de49d18576d3890ecbc8c0e24092e0736a8e520031b6069ba97f99a291b2bd

C:\Windows\System32\SensorDataService.exe

MD5 ef0fd025211469f65eec34324a13596f
SHA1 c5cc41594805a8ef24b4c86decc34243f17a8d46
SHA256 6fa6e401afed5042fe9af45073fb822940a94e893582bc0694c44b38af4190b8
SHA512 9d22a8b4e89229eaec9008d92668c388d368ba366f73be92844ad4de8a2235baffbe317526edf5c0ac64e4256e4dd644ec325e577d1a83d3bbd2b26e10f79871

memory/4880-298-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/5092-300-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 c052ca3410f3a234e44df248e57f12b1
SHA1 94b1294c95403bacbb5f5842e6e1e125e6a95329
SHA256 df0ed51e807c8f7879f248a6ec19fbd193f493711f32fb58a00e78aca06017cd
SHA512 7a5c776065227ff334efbd8e91925e1eaeaa0cc66c5a253c8f4515c25232747a37525bafeb79399297c49f218f6d76382961328fa931431494d0972f06ab818e

memory/4588-302-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 fa03a3094e7a04863b7b89790dffa4c6
SHA1 03a72f97c22548932391461c34e67e9ac9cdb6e6
SHA256 b7c474e968b26a12ceb42ef36d559b315e743058c3144254a884b5484fc8d3a9
SHA512 54ebbdf44f5c97beee10c80ff16de2ce849fd0a7b8139634d7a8603bb6d5dbad98ef80871133ca26dadcd35c7de4eedb66a733bc496149b6abf9c3e6ca0127b0

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 cdee448a736ae57615357e556b0eb197
SHA1 48898d88ee7917d3c82212f8b2b71b3f4fbe7b48
SHA256 523a931d0409d13ffd4d80ca4be51a4ab5d1ed6cd268c638917262a498627bed
SHA512 50bc61326822f931b8654ab027c3b8c4ef8b4cf832f1ca1a2c5f2d9a2217a6a4b09ce8910242c2253786d383513d9252a9e3cba03972b019de248d4bc189af6e

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 cdee448a736ae57615357e556b0eb197
SHA1 48898d88ee7917d3c82212f8b2b71b3f4fbe7b48
SHA256 523a931d0409d13ffd4d80ca4be51a4ab5d1ed6cd268c638917262a498627bed
SHA512 50bc61326822f931b8654ab027c3b8c4ef8b4cf832f1ca1a2c5f2d9a2217a6a4b09ce8910242c2253786d383513d9252a9e3cba03972b019de248d4bc189af6e

memory/1840-324-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2372-327-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4792-329-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 4dc592a85a63ac81493386bb7b95463e
SHA1 41dc61475a289262ea84f20b97bd50a2c6e070b9
SHA256 6a00ae702cc2f46aa109ac884d7100ae88d1d35cd628cf4beda06a53c91eae0b
SHA512 f494dc1be70812b3c7ed959f856143003ca726e968406d34b7bcc63b172511306515b3b9040bad561fa33d395660854547beb5b4744c856f635939cc08b6cca8

C:\Windows\System32\AgentService.exe

MD5 a0c03a2fb45f31f82e52026b06797581
SHA1 143e2769f7af87174c76d7f265e0aecdffa72c3c
SHA256 98c26aaab78b24acde24e35c898a6c4274fddf36f8d1a5b3f14fb1b64b96bdf3
SHA512 51cb7183cc9b73524d0dba7425e8aee4507735043f6a61e8b74befe508c7ffe988c9c467f6b65f30b20b5b3825774d6b904e8b18b3dbb402ca9cf04c0a28ab5d

memory/1884-347-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4988-359-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 ae84fae952935a98b77094b75cb95afe
SHA1 05c3741aa2e44a070f5e163ff64ef5190ad64c86
SHA256 518fd5e002183c0707c2682536a16f92e5bac74ae8952c2690feb04dccea5ab3
SHA512 809bbded95f18a2b5afe8f726c005ff48f3870798d7299e895e0c08416968c7e089eaa04f84dbf69e43c0a6b24c9da52ce2a04aad734ee737077fc9ee663d5a9

C:\Windows\System32\VSSVC.exe

MD5 c8bbc7d9a020cd48a74281d72b3e97b3
SHA1 82f7f5ae42201081598cf1b26c9e9c5daeb1cc70
SHA256 cad01cc27c2ec9cb758cba553c2f1bfd59c71271799c76a3f3659345c513d2ce
SHA512 c8ae866174410ae18279669283ab73bb4b4261307d662b7c1c3ee0a01e4f267ff950470ad9eac3cbe2a27a361f70873774dd1cc94554a57d8456b59f507da794

memory/3760-372-0x0000000000400000-0x0000000000654000-memory.dmp

memory/4612-374-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2668-376-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 d093024b04a9403865df2c675c820d5d
SHA1 0e5bbd1c6878d2de6b4fe246474d796bff08bd9b
SHA256 aca7df02d95445ff87d1799f6bd14b79031938d1e9d0c4cf1b2b3d8d4e8400b9
SHA512 6918b99ac4175f42e43d2cf1b91f42e82776014f14a7edbff1cd4c5b1cbf250801d60a0a63c5e3ee993e68b397a135e7fd186400cd3b58c0e37c5ed7afccfc23

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 0f550a93d0aebcb77b613df8d8d998b5
SHA1 685234bded7bc8e391b8e61135e3d4d8a6bfa5c8
SHA256 b89bb38f2d280b2629683d5bf43770e866aafb8aaf95801fad80280c38ad13cb
SHA512 13920c84af5c777a5acd77d14d4031f26274ec8112e21dbdcd3a72daab88a91212b75337c18c759fc2eddf3a4b5dba5aae0a164a5c9ec377df00ac51a1cc9505

memory/2060-397-0x0000000140000000-0x0000000140201000-memory.dmp

memory/3460-401-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2376-404-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 efe4f3ea821e402e8ad341442afaef04
SHA1 c8806c1abca2af96c35269f86f2972f256fcb1cc
SHA256 1868b68bc384f1b57297a947a5a6f176764cfca686931a25c1bbe0baa04ada04
SHA512 7be2cb3d6e75f3a2a331aa18fa98890c85e31961bec38bc77a3b72ce3a99b82b350333eeab17abd04d99aad4bb24987ade02751958a02f3e466bb68bfe351a66

memory/4928-419-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3020-469-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3312-471-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4564-507-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4588-525-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2372-557-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4792-558-0x0000000140000000-0x0000000140259000-memory.dmp

memory/2668-589-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2376-592-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4928-604-0x0000000140000000-0x0000000140179000-memory.dmp

memory/960-631-0x0000018EE2370000-0x0000018EE2380000-memory.dmp

memory/960-632-0x0000018EE2380000-0x0000018EE2390000-memory.dmp

memory/960-634-0x0000018EE2380000-0x0000018EE2381000-memory.dmp

memory/960-651-0x0000018EE2380000-0x0000018EE2390000-memory.dmp

memory/960-736-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-735-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-737-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-741-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-784-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-788-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-789-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-790-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-791-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-792-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-793-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-794-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-795-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-796-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-797-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-798-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-799-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp

memory/960-800-0x0000018EE27A0000-0x0000018EE27AE000-memory.dmp