Malware Analysis Report

2025-01-03 07:56

Sample ID 230428-y417vsgc55
Target PO_39100.exe
SHA256 6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c

Threat Level: Known bad

The file PO_39100.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy WMI provider

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Suspicious behavior: LoadsDriver

outlook_win_path

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

outlook_office_path

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-28 20:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-28 20:21

Reported

2023-04-28 20:23

Platform

win7-20230220-en

Max time kernel

144s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c0c2ed16328eb3a2.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1368 set thread context of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1880 set thread context of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A3A812BA-CF64-445C-BBF2-C0A148E29400}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A3A812BA-CF64-445C-BBF2-C0A148E29400}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{819AA7E0-7246-47B3-8459-129C32332588} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
N/A N/A C:\Windows\system32\SearchProtocolHost.exe N/A
N/A N/A C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1368 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1880 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1092 wrote to memory of 1196 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1092 wrote to memory of 1196 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1092 wrote to memory of 1196 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1092 wrote to memory of 876 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1092 wrote to memory of 876 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1092 wrote to memory of 876 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2092 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2240 wrote to memory of 2444 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2240 wrote to memory of 2444 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2240 wrote to memory of 2444 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1700 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2516 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1700 wrote to memory of 2148 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 160 -NGENProcess 164 -Pipe 174 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 24c -NGENProcess 254 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 24c -NGENProcess 1e4 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3948302646-268491222-1934009652-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3948302646-268491222-1934009652-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 240 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 248 -NGENProcess 1e4 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ac -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 244 -NGENProcess 248 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 25c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 25c -NGENProcess 184 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 24c -NGENProcess 274 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 24c -NGENProcess 25c -Pipe 1ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 240 -NGENProcess 274 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 240 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 244 -NGENProcess 274 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 244 -NGENProcess 240 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 244 -NGENProcess 28c -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 244 -NGENProcess 184 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 254 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 184 -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 25c -NGENProcess 2a4 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 270 -NGENProcess 184 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 270 -NGENProcess 25c -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 25c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1368-54-0x0000000000F90000-0x0000000001118000-memory.dmp

memory/1368-55-0x0000000000EB0000-0x0000000000EF0000-memory.dmp

memory/1368-56-0x0000000000290000-0x00000000002A2000-memory.dmp

memory/1368-57-0x0000000000EB0000-0x0000000000EF0000-memory.dmp

memory/1368-58-0x00000000003C0000-0x00000000003CC000-memory.dmp

memory/1368-59-0x0000000005C50000-0x0000000005D88000-memory.dmp

memory/1368-60-0x00000000060B0000-0x0000000006260000-memory.dmp

memory/1880-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1880-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1880-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1880-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1880-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1880-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1880-69-0x0000000000140000-0x00000000001A6000-memory.dmp

memory/1880-74-0x0000000000140000-0x00000000001A6000-memory.dmp

\Windows\System32\alg.exe

MD5 ea59c27eaa829f93fd95c199cb330aa5
SHA1 74929b5d77d27ccd5df304ee6116f52763542fbc
SHA256 4394717b177b7083247ea0d43ca45a773507edafdb48a9028a56ccb0abab190f
SHA512 d7a33340d54e07672af1437b98d95ce5ef5adcdd171385e4b4bbec0ba40c390bbfd1e3cfa6bb3a6573ec6fa50a7a2fb942fd71154d9028e5e953a6b686c13fc8

C:\Windows\System32\alg.exe

MD5 ea59c27eaa829f93fd95c199cb330aa5
SHA1 74929b5d77d27ccd5df304ee6116f52763542fbc
SHA256 4394717b177b7083247ea0d43ca45a773507edafdb48a9028a56ccb0abab190f
SHA512 d7a33340d54e07672af1437b98d95ce5ef5adcdd171385e4b4bbec0ba40c390bbfd1e3cfa6bb3a6573ec6fa50a7a2fb942fd71154d9028e5e953a6b686c13fc8

memory/300-82-0x0000000000170000-0x00000000001D0000-memory.dmp

memory/300-88-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 39a7585e66b4a32a4802c06c6cf612ce
SHA1 9596adf7b8208bc3e5d97f108011d96389d7bc32
SHA256 ae3eb16912c696a990192f367d02f3cd7b2e1236d50c9df4a4ed32e20732d867
SHA512 e555f277ac222583ed21866eb0822e87b4e09a976d15ab8441e64cee440cbf97b1f9f320f8606760bdb811dd68d3ce04da5520d859094115f40dfe31751bc06a

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 39a7585e66b4a32a4802c06c6cf612ce
SHA1 9596adf7b8208bc3e5d97f108011d96389d7bc32
SHA256 ae3eb16912c696a990192f367d02f3cd7b2e1236d50c9df4a4ed32e20732d867
SHA512 e555f277ac222583ed21866eb0822e87b4e09a976d15ab8441e64cee440cbf97b1f9f320f8606760bdb811dd68d3ce04da5520d859094115f40dfe31751bc06a

memory/1880-94-0x0000000000400000-0x0000000000654000-memory.dmp

memory/300-95-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/1288-96-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 dd55ea2e197948c0c8891b07121010ba
SHA1 34edc7aa3edb11e517bcd4107c701747084af140
SHA256 988bb0eecfa01d4227a288c0856841de8c1cfda5d868edf8e795ba3c8a2ec769
SHA512 f8cc8948a0a875ac75945d7e7a81072c1c1b2698b37f8f7dab6e4150232527ddffacd5399302fb579c6eb671c9b0e5e26072ef25949fba4890ba6b85aa0e8ce7

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 dd55ea2e197948c0c8891b07121010ba
SHA1 34edc7aa3edb11e517bcd4107c701747084af140
SHA256 988bb0eecfa01d4227a288c0856841de8c1cfda5d868edf8e795ba3c8a2ec769
SHA512 f8cc8948a0a875ac75945d7e7a81072c1c1b2698b37f8f7dab6e4150232527ddffacd5399302fb579c6eb671c9b0e5e26072ef25949fba4890ba6b85aa0e8ce7

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 9a89d9ba873065dd7bb2a8abe2be4429
SHA1 7df5e2e26b15a9b00f92b46a9e8dad7db7e91db9
SHA256 d960f0934f336127effb340ce8bf55d9366c55c763063fde14d0d14f52025be3
SHA512 4a922ab447e8356590675b5e4098d8bb901aa0a0aec9ab0bfd84c7e11584624bd847b523b8bac23bc13e83d51c20c412ae6f18999452a815a80ac2f8eada0f3e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 9a89d9ba873065dd7bb2a8abe2be4429
SHA1 7df5e2e26b15a9b00f92b46a9e8dad7db7e91db9
SHA256 d960f0934f336127effb340ce8bf55d9366c55c763063fde14d0d14f52025be3
SHA512 4a922ab447e8356590675b5e4098d8bb901aa0a0aec9ab0bfd84c7e11584624bd847b523b8bac23bc13e83d51c20c412ae6f18999452a815a80ac2f8eada0f3e

memory/1372-107-0x0000000000120000-0x0000000000186000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 c0ae5b7748a6dfbfeffba78263d2c421
SHA1 19d9a53697581459076829d886a678d0db0c22f8
SHA256 193f72d927732f631d78ec702ff82f2e4f0ab6ac51f3ce0ef3b293e718a88608
SHA512 f287d1fd36cf62d8cdba776dcc0f9ce46d62246b5a0f81d07c0d0df82ade955be97ac35e6b5f746875a409cd8455470ddcad1c637ae3f37484e58fb88ffed553

memory/1372-110-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1372-116-0x0000000000120000-0x0000000000186000-memory.dmp

memory/1372-118-0x0000000000120000-0x0000000000186000-memory.dmp

memory/1372-113-0x0000000000120000-0x0000000000186000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

memory/1828-121-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1384-123-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1700-120-0x00000000002F0000-0x0000000000356000-memory.dmp

memory/1372-125-0x0000000000990000-0x0000000000A4C000-memory.dmp

memory/1700-126-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1700-129-0x00000000002F0000-0x0000000000356000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 9a89d9ba873065dd7bb2a8abe2be4429
SHA1 7df5e2e26b15a9b00f92b46a9e8dad7db7e91db9
SHA256 d960f0934f336127effb340ce8bf55d9366c55c763063fde14d0d14f52025be3
SHA512 4a922ab447e8356590675b5e4098d8bb901aa0a0aec9ab0bfd84c7e11584624bd847b523b8bac23bc13e83d51c20c412ae6f18999452a815a80ac2f8eada0f3e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 f06811dd0810581e6adeff41952edb98
SHA1 63c8c1676cec5ccc264df8395330281dff545bfe
SHA256 f8b09692e5183c0acdb7f1445f5ccfb740ccdb4a3232b4d980f3d27c2fbd89af
SHA512 3bc8e011eec69556b25f4d03c7cc228f257f85a1ab851732ee8927a3a40daf46bd4fc5c5d14fee62a34d4a2fdcdb44579940bef7bcb17bb2457749362ea71037

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a33d3b64772c310c5cf6c95c8e30e0b4
SHA1 d5deddf2bedb4d461509eaf700a3c44e7a29477e
SHA256 d1e6552dfbe8d31853cbf555d5b429cfd527031416bcc00b5d801ad44dc1d3c8
SHA512 9598c55ee6fed89e26b0fd8c59adad0d8439b49e8cdd9ed457d5e3882a149c780d31c1bc7ac2b388a1d9691884d5177fb0eeae9ef37d532da77f0375b06bdeba

\Windows\System32\dllhost.exe

MD5 600335fa2151f05591955e58e307ab34
SHA1 447da0088af62a8328895dd535f0a0dcdc147491
SHA256 41c1041d3e66d8ba101b723f13d54120afc100e5b3418b240a32f3065af9d1c5
SHA512 96638e90a6fd1858859d046b4a9ba774dd62333cb6b7223b610402deea831b0124def86b18ea1fbfa7934ef76f610fdefd644075e6df38b71dfb2e85487c59ba

C:\Windows\System32\dllhost.exe

MD5 600335fa2151f05591955e58e307ab34
SHA1 447da0088af62a8328895dd535f0a0dcdc147491
SHA256 41c1041d3e66d8ba101b723f13d54120afc100e5b3418b240a32f3065af9d1c5
SHA512 96638e90a6fd1858859d046b4a9ba774dd62333cb6b7223b610402deea831b0124def86b18ea1fbfa7934ef76f610fdefd644075e6df38b71dfb2e85487c59ba

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a33d3b64772c310c5cf6c95c8e30e0b4
SHA1 d5deddf2bedb4d461509eaf700a3c44e7a29477e
SHA256 d1e6552dfbe8d31853cbf555d5b429cfd527031416bcc00b5d801ad44dc1d3c8
SHA512 9598c55ee6fed89e26b0fd8c59adad0d8439b49e8cdd9ed457d5e3882a149c780d31c1bc7ac2b388a1d9691884d5177fb0eeae9ef37d532da77f0375b06bdeba

\Windows\ehome\ehrecvr.exe

MD5 1546cbb0691198e76ac666435055cf12
SHA1 7938a09c8c19b15efc1fb111c71a35cf34606de3
SHA256 6550df350a39ec1b9b3c5342d99e75a675067eda13d5ed77919ab179aeb20029
SHA512 a3a6fbea7a0fe0aa9084a6913b3602a0c5735b369780417730ddca250f49742a787d7bfe28433bae37f392ae8ca3d17e025219361641dd5334713600da091181

C:\Windows\ehome\ehrecvr.exe

MD5 1546cbb0691198e76ac666435055cf12
SHA1 7938a09c8c19b15efc1fb111c71a35cf34606de3
SHA256 6550df350a39ec1b9b3c5342d99e75a675067eda13d5ed77919ab179aeb20029
SHA512 a3a6fbea7a0fe0aa9084a6913b3602a0c5735b369780417730ddca250f49742a787d7bfe28433bae37f392ae8ca3d17e025219361641dd5334713600da091181

memory/1048-150-0x00000000002B0000-0x0000000000310000-memory.dmp

memory/1048-156-0x00000000002B0000-0x0000000000310000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 4cd6d2b6c99159393c252c06bf83ed6d
SHA1 cdb487b027c700af661e2d75717dc379e5de40ea
SHA256 d3a73fccf56a9bf10dc80ca9457c6eb69015288a545d4b305542747a361abbdc
SHA512 971f07e17478fae519381d5af0da92116b0da69dfddef870cdb81748f1cfc9dd813bb4a79fa06c593c2657f592eb9a3a450551fd7f8b4f7a662f9371ce2d5d76

C:\Windows\ehome\ehsched.exe

MD5 4cd6d2b6c99159393c252c06bf83ed6d
SHA1 cdb487b027c700af661e2d75717dc379e5de40ea
SHA256 d3a73fccf56a9bf10dc80ca9457c6eb69015288a545d4b305542747a361abbdc
SHA512 971f07e17478fae519381d5af0da92116b0da69dfddef870cdb81748f1cfc9dd813bb4a79fa06c593c2657f592eb9a3a450551fd7f8b4f7a662f9371ce2d5d76

memory/1520-161-0x0000000000880000-0x00000000008E0000-memory.dmp

memory/1092-165-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2012-163-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1048-166-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1048-168-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1048-169-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1520-172-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1520-173-0x0000000000880000-0x00000000008E0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a33d3b64772c310c5cf6c95c8e30e0b4
SHA1 d5deddf2bedb4d461509eaf700a3c44e7a29477e
SHA256 d1e6552dfbe8d31853cbf555d5b429cfd527031416bcc00b5d801ad44dc1d3c8
SHA512 9598c55ee6fed89e26b0fd8c59adad0d8439b49e8cdd9ed457d5e3882a149c780d31c1bc7ac2b388a1d9691884d5177fb0eeae9ef37d532da77f0375b06bdeba

memory/1196-179-0x0000000000B00000-0x0000000000B60000-memory.dmp

memory/1196-186-0x0000000000B00000-0x0000000000B60000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 eae2501c5d9c5f94a10aff6f3b18c082
SHA1 bf2295009976cc660765c53eea9f762647deeae8
SHA256 cc03ec1005f89fd9a1b967d608b257fa5e1a3b84b19c935600c27f676d0e4da6
SHA512 6cb272dd51465e8cacc17774bcfe5acf566093d019229ebef8d3dbf9678f3f46e075b416a786cc9d284f5b9c923bf3e97740b611bd58c80345a21ec755e19b64

memory/1992-189-0x00000000008C0000-0x0000000000920000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 da9d3439c057abc82b489578d3524463
SHA1 9d821cb30aff0fdbd06f002aac774d0d9dee9336
SHA256 49ffe52f2075e8cc66a74aced5729dc9551ca9ef3ffee7bedd79e29a97c0d26d
SHA512 0956d2c9e24e4f32c00c46bea815cf37348f25de0bd79cc4a4794f096c74ad3b99f5aeb30f371203e7cf0371cf12f564663a237e0da47ba2604202fe54ab1b4f

C:\Windows\System32\ieetwcollector.exe

MD5 da9d3439c057abc82b489578d3524463
SHA1 9d821cb30aff0fdbd06f002aac774d0d9dee9336
SHA256 49ffe52f2075e8cc66a74aced5729dc9551ca9ef3ffee7bedd79e29a97c0d26d
SHA512 0956d2c9e24e4f32c00c46bea815cf37348f25de0bd79cc4a4794f096c74ad3b99f5aeb30f371203e7cf0371cf12f564663a237e0da47ba2604202fe54ab1b4f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a33d3b64772c310c5cf6c95c8e30e0b4
SHA1 d5deddf2bedb4d461509eaf700a3c44e7a29477e
SHA256 d1e6552dfbe8d31853cbf555d5b429cfd527031416bcc00b5d801ad44dc1d3c8
SHA512 9598c55ee6fed89e26b0fd8c59adad0d8439b49e8cdd9ed457d5e3882a149c780d31c1bc7ac2b388a1d9691884d5177fb0eeae9ef37d532da77f0375b06bdeba

memory/1048-213-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1196-216-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1992-219-0x0000000140000000-0x0000000140237000-memory.dmp

memory/824-221-0x0000000000920000-0x00000000009A0000-memory.dmp

memory/1316-220-0x0000000140000000-0x0000000140205000-memory.dmp

memory/876-222-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 239337abf9bcb7052e4c64a49e71184e
SHA1 ce3d51ac7a749bc199d08901caa5bdad2147d825
SHA256 e2faf8b539193fee00d7045187fad1f7ed969ec2432683700048efe2e1cde10c
SHA512 b4f49c9622304fb162c9d2c37acd0a663ab35fe42a6aaddf3f111aefa069ca1f74d5f9e1aec6c68db98bc59bf782b0cd998e548f248b14a58d0d93272de3315a

memory/2116-237-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 2b160b7ef585f73f6cfc414dee779feb
SHA1 2986ec5835e979c673404c2bb7adcc14e1efcfae
SHA256 7cf7dac75799c11a654c45d7975c73238cbeefa1880547065c2cebab9e9ff2dc
SHA512 123d0675adc6c68f8d33bf04c6cbd2d5e2f8640acca26a8f082fd9cafbbcd8049dd294724d8e5c779391cc63a4c72ce17e7e64542120e2f8c7e6bac045954463

\Windows\System32\msdtc.exe

MD5 01ed47f5bccc810c6301a98bc239c4ad
SHA1 0392cb8f6a819191f032653f43b1b6f2665689e7
SHA256 50e17a5fec39370e3d176b378b47cf07bf784253d9a8c8e8bec28fa84177e68a
SHA512 0ec0f10a295417320d95daaa4075cc6cfb0ec962a3ea7df340f094ab3028453ced685b58c86fb24a35b44c46a8e95c80f5b0716d4daddb5331ccc9228af845b8

memory/824-253-0x0000000000920000-0x00000000009A0000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 01ed47f5bccc810c6301a98bc239c4ad
SHA1 0392cb8f6a819191f032653f43b1b6f2665689e7
SHA256 50e17a5fec39370e3d176b378b47cf07bf784253d9a8c8e8bec28fa84177e68a
SHA512 0ec0f10a295417320d95daaa4075cc6cfb0ec962a3ea7df340f094ab3028453ced685b58c86fb24a35b44c46a8e95c80f5b0716d4daddb5331ccc9228af845b8

memory/2232-255-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2332-258-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2232-268-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 760c0f953cd372dfceaed177939963cb
SHA1 a765b099205311ff25d79feedd293cf498c80272
SHA256 d570483853f76617ecdb0ef11d2750b000cd0e7bca7686753d9f50aec09d9510
SHA512 4e399219858f94f41319f274086f3f762ae73dce5bb8f7037cf901795835a4373d5cf4c9699250ff632242b6e55ca3eb6fa6703baf63d690f29cfcbf67510ee2

C:\Windows\System32\msiexec.exe

MD5 760c0f953cd372dfceaed177939963cb
SHA1 a765b099205311ff25d79feedd293cf498c80272
SHA256 d570483853f76617ecdb0ef11d2750b000cd0e7bca7686753d9f50aec09d9510
SHA512 4e399219858f94f41319f274086f3f762ae73dce5bb8f7037cf901795835a4373d5cf4c9699250ff632242b6e55ca3eb6fa6703baf63d690f29cfcbf67510ee2

C:\Windows\system32\msiexec.exe

MD5 760c0f953cd372dfceaed177939963cb
SHA1 a765b099205311ff25d79feedd293cf498c80272
SHA256 d570483853f76617ecdb0ef11d2750b000cd0e7bca7686753d9f50aec09d9510
SHA512 4e399219858f94f41319f274086f3f762ae73dce5bb8f7037cf901795835a4373d5cf4c9699250ff632242b6e55ca3eb6fa6703baf63d690f29cfcbf67510ee2

\Windows\System32\msiexec.exe

MD5 760c0f953cd372dfceaed177939963cb
SHA1 a765b099205311ff25d79feedd293cf498c80272
SHA256 d570483853f76617ecdb0ef11d2750b000cd0e7bca7686753d9f50aec09d9510
SHA512 4e399219858f94f41319f274086f3f762ae73dce5bb8f7037cf901795835a4373d5cf4c9699250ff632242b6e55ca3eb6fa6703baf63d690f29cfcbf67510ee2

memory/1880-282-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 06538df6c2984d96c7d45607379ae8e9
SHA1 4be1d46b18a9d444b0dee21972f4f96285866e5c
SHA256 dc61faf62b7ca831da12bfe708eba51d84928370918f1aaac73a1a4a3076e8e9
SHA512 3e582eff4c8d7343c5f6791c593d16a6a0e984a20d5ccb0f1d548c6114a3abfd0383d17cda0360d8ee3387515250681df07e3b95de132dd975b34ab244dfa7aa

memory/1288-284-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/2464-285-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2464-287-0x0000000000510000-0x0000000000719000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 158748d7415a09f7e09950c5578b7516
SHA1 b2018f1864f4a346750f4510f2de37eddd0241b6
SHA256 1936216129dd89b509befd9b6c6546e3303d03e5fdd1b5f7d5753be75424d25b
SHA512 8b608740b84256eeb8cdd8a5d2e589733c1be4391c0d1adb51f08c41b1f088fe2485d3c33debf23b65ffcd96f163cbce643518a499030d5132cb381d41ace00d

memory/2548-300-0x000000002E000000-0x000000002E20C000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

memory/2604-302-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 e8ffb2dd4363afb6656b64d5e3fc55f7
SHA1 e49e281ed9b4e2c7b8381d89dc4117562d0fe596
SHA256 898420b510639fe99ae7543bedd29a914112c53e40be3131aa1af51436e8f37e
SHA512 5fcbc3f5f158b5c88ab9317d177288a4298b9d70984a85c58e88e842d6eeba3b1ae17f672212069c6ab0e616d1b9bf1590e2aacf3f0890bc4d761070eaa3f186

\Windows\System32\Locator.exe

MD5 2dbe0e74855775cfa0306ce7c04779cd
SHA1 cd537014e5a9f9da2b2fc91ac42b6715a75ca367
SHA256 efb5296e7b40ea6bdeee4b17b29f7d9499f801a7571663bdf960b5a398a08baf
SHA512 84982b0a0b42958baeefd4ca57593f25ddb48eb220082257e19a45f9543eb58f389d9b289d0db7af5797c9de76e497c06246244a52bffef34e92cbfbf5e12783

C:\Windows\System32\Locator.exe

MD5 2dbe0e74855775cfa0306ce7c04779cd
SHA1 cd537014e5a9f9da2b2fc91ac42b6715a75ca367
SHA256 efb5296e7b40ea6bdeee4b17b29f7d9499f801a7571663bdf960b5a398a08baf
SHA512 84982b0a0b42958baeefd4ca57593f25ddb48eb220082257e19a45f9543eb58f389d9b289d0db7af5797c9de76e497c06246244a52bffef34e92cbfbf5e12783

\Windows\System32\snmptrap.exe

MD5 e4c18a5f829ce720e6d373be265edbea
SHA1 e412086611ffc75c49ec1c2e288e2741a55f4713
SHA256 e3be525748fc7d36e75e79dc9a40689cb6a5daf845ce14b209b89077896a0228
SHA512 348b216645ccff54e827995932314148b231e023301a8e84cba2e20dea61191ae4907503a3e863437fdddfe271e5030a05bcca084af87711703c749ae52e83f7

C:\Windows\System32\snmptrap.exe

MD5 e4c18a5f829ce720e6d373be265edbea
SHA1 e412086611ffc75c49ec1c2e288e2741a55f4713
SHA256 e3be525748fc7d36e75e79dc9a40689cb6a5daf845ce14b209b89077896a0228
SHA512 348b216645ccff54e827995932314148b231e023301a8e84cba2e20dea61191ae4907503a3e863437fdddfe271e5030a05bcca084af87711703c749ae52e83f7

memory/1700-335-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2732-337-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2752-338-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2856-339-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2940-341-0x0000000100000000-0x00000001001ED000-memory.dmp

\Windows\System32\vds.exe

MD5 000604228e46dcaf5bdda1bc5d21ad42
SHA1 d6e7d33e359d5c24bd8fda49ea9c71b970e67ac0
SHA256 7ab85f54a0decaf6f9352d0d2235026c80baafaa760bb8c27cdbf1809c7a0154
SHA512 111670da5d3f2b41a0d8198a9d6297a95c102a7df0fe840dc3010ecc706f19685ca87ea0cf37c67afb555b2fa2c23ca1f22ef9ef5d98e4f5f343e0405a277bfc

C:\Windows\System32\vds.exe

MD5 000604228e46dcaf5bdda1bc5d21ad42
SHA1 d6e7d33e359d5c24bd8fda49ea9c71b970e67ac0
SHA256 7ab85f54a0decaf6f9352d0d2235026c80baafaa760bb8c27cdbf1809c7a0154
SHA512 111670da5d3f2b41a0d8198a9d6297a95c102a7df0fe840dc3010ecc706f19685ca87ea0cf37c67afb555b2fa2c23ca1f22ef9ef5d98e4f5f343e0405a277bfc

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

memory/3048-359-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2732-362-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 c3a819312a27df6fff1af9b7d9e430fd
SHA1 a873ebdf972eea3c58e86139eb9e1cb3b3870d6e
SHA256 994986c45b581f48acb82ab2e564f38c6ea5a12a2dbac90a35c301cc70e8d5af
SHA512 755fe34d54c88dbfcde5e132f402be40444aad00f0652571f73daa6820fecc1e1472d675dff79364768bc5d8f9833cd64ee4e3ddd29ce7e41ecb8f8ffc8e4cfc

C:\Windows\System32\wbengine.exe

MD5 b12406bce72e84a12403ab621700c667
SHA1 af210e292636b717f6b92756f5a3bb75b1414088
SHA256 83a7d6a1bb6f7eb3568a9110360082feaa3dfa3da529ecf1f66b561db960a052
SHA512 ad0dde2d2eb1582f7fc914183a5129c66a5fd9552f234055c89f2b39bd15aa874b2f8c010c53310e109eb3765d60a8351c94c9c0de380d5be083fa543f8a1fa1

\Windows\System32\wbengine.exe

MD5 b12406bce72e84a12403ab621700c667
SHA1 af210e292636b717f6b92756f5a3bb75b1414088
SHA256 83a7d6a1bb6f7eb3568a9110360082feaa3dfa3da529ecf1f66b561db960a052
SHA512 ad0dde2d2eb1582f7fc914183a5129c66a5fd9552f234055c89f2b39bd15aa874b2f8c010c53310e109eb3765d60a8351c94c9c0de380d5be083fa543f8a1fa1

memory/1048-384-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1520-386-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2176-387-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2400-388-0x0000000100000000-0x0000000100202000-memory.dmp

memory/824-390-0x0000000000920000-0x00000000009A0000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 0a0b5e42234a6cbb2db07ce146880276
SHA1 01032e8980d2f4bd1ed610ff482b4290e22b2a7c
SHA256 b4fcbdcadad4e8cb243d9965a7119e99223a3ea85186bf5c2b4184c970f8a0dc
SHA512 a648387bc878eb5d51c5fa55815d0df2d585cd12e8260f8035f2cff4edccea79847b23f16cd9cc8e3afa1855c5b097412557937f1f38460d6868db7de923212e

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 0a0b5e42234a6cbb2db07ce146880276
SHA1 01032e8980d2f4bd1ed610ff482b4290e22b2a7c
SHA256 b4fcbdcadad4e8cb243d9965a7119e99223a3ea85186bf5c2b4184c970f8a0dc
SHA512 a648387bc878eb5d51c5fa55815d0df2d585cd12e8260f8035f2cff4edccea79847b23f16cd9cc8e3afa1855c5b097412557937f1f38460d6868db7de923212e

memory/824-402-0x0000000000920000-0x00000000009A0000-memory.dmp

memory/876-403-0x0000000140000000-0x0000000140205000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 858a194cbf60e1c3f13ad3a4081f5b69
SHA1 f7deaa91fa98033da3ce6d7dd3ad0355519b3d2f
SHA256 bd327e9eb6592ef08bdf6a869a5489b05c5fd8fc5156cd8ff88f553bc402d16d
SHA512 3191a705e2b06daa55d325e4b3d1a1aa3dd1fd811c10c1d90f9c1d0b2d30f97ca864755a180f172d7604f6c5698d1043306a8817528b5c8683814adad9634dbf

memory/2116-404-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 858a194cbf60e1c3f13ad3a4081f5b69
SHA1 f7deaa91fa98033da3ce6d7dd3ad0355519b3d2f
SHA256 bd327e9eb6592ef08bdf6a869a5489b05c5fd8fc5156cd8ff88f553bc402d16d
SHA512 3191a705e2b06daa55d325e4b3d1a1aa3dd1fd811c10c1d90f9c1d0b2d30f97ca864755a180f172d7604f6c5698d1043306a8817528b5c8683814adad9634dbf

memory/2540-406-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2484-408-0x0000000000D70000-0x0000000000DF0000-memory.dmp

\??\c:\programdata\microsoft\ehome\mcepg2-0.db

MD5 7dba7008f957ecf722efd29ba4feafe4
SHA1 5455dce1e61475d188092754e1a8fd148e57a057
SHA256 280f235484ecebb88c133b83ed0aba4747dfab8d9250f5a8b6a9003eaa010bbd
SHA512 cd79f03c382686357ccfdbe86c29e91c4d3eb7b4d4f9cff81a4a7800ac213b9c1e83a8683e50ad8232553d71a97dc621f181b4e5ebe7ff6576e0f510c0ad768b

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\8f96978fc46d9f00d8780351026924d7_a276eab5-dc44-4cc2-8d9b-a6b30cc2da67

MD5 db733e033c397fec5917611957620271
SHA1 6f94d1daa0fc4ec1b2d4cbcb93730d8edb77a2b7
SHA256 1f3ffadd3b80c7f95be06e245410768e8302a24e573868da3c6fd91230025bdc
SHA512 9a9bb4cf6380bb0a73ea414ca2226a344c7da003e49610dc38bd10892dc17244e4c88bf8a466131027e3c064c693ad99014e6853fff51edb21cb690b926b962f

memory/824-412-0x0000000000920000-0x00000000009A0000-memory.dmp

memory/2740-414-0x0000000100000000-0x000000010020A000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 858a194cbf60e1c3f13ad3a4081f5b69
SHA1 f7deaa91fa98033da3ce6d7dd3ad0355519b3d2f
SHA256 bd327e9eb6592ef08bdf6a869a5489b05c5fd8fc5156cd8ff88f553bc402d16d
SHA512 3191a705e2b06daa55d325e4b3d1a1aa3dd1fd811c10c1d90f9c1d0b2d30f97ca864755a180f172d7604f6c5698d1043306a8817528b5c8683814adad9634dbf

C:\Windows\System32\SearchIndexer.exe

MD5 e502dbf9cda2b53f9c88954784c4c642
SHA1 6371cfed83671c60d5e14f44ba912a4dab926ee4
SHA256 2e64206e5e618b006826389989c5404864ff275c9717e42b0b58e5ebb5aa062b
SHA512 407c30a63f58339c8fbcc19bb70dc6a31f0aa235a631e4f22ad513d1efc6fa5f9567bdf5198bf2dc57f1104896e9990fb5c23ec0d6d02e02b57cf62e636829fe

memory/2240-444-0x0000000100000000-0x0000000100123000-memory.dmp

memory/2484-446-0x0000000000D70000-0x0000000000DF0000-memory.dmp

memory/2968-447-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2092-465-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2332-469-0x0000000140000000-0x000000014020D000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 603b03cd3fb07d905d5bd2baf23e77c6
SHA1 1dfd2c27609d2a35612a38632b2cdb8d9659d40a
SHA256 8b6f97b1a606204d4b4ed9f377d34afbfd67c6fdf2fa09bdf806668c763b8782
SHA512 4e70e5bf808bb642b039711cf31c8843e481cb861fd27872ac489a1fe8b49d991cd2b101052225c168359a631934338d6e1fb579b560e1f3313129fcd070d19d

memory/2464-588-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2464-589-0x0000000000510000-0x0000000000719000-memory.dmp

memory/2604-591-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1316-618-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

memory/2132-674-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 e9079a95f95117f010072fe151f7e241
SHA1 c5454987415827e2edb79e512128862572e0379b
SHA256 eb88eda83736510b28e1d7f7cb6b34e19447f9c4651b8798c37b860cb1749e21
SHA512 aabaa892da115a7bc1d11d3ee57cde96c9fe18a0019f3402318c3212d0413a633903dd04b95a5eeacc0645a17c09a685ea4766c4ad1802e52b6070cd71537579

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-28 20:21

Reported

2023-04-28 20:23

Platform

win10v2004-20230220-en

Max time kernel

80s

Max time network

84s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7c06967c94b1c77.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 456 set thread context of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 3920 set thread context of 1812 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{FFC11392-3607-4D9F-985B-7818929ABFBA}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cef7b8e51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000880b31e51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002016dfe51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b8cf4e51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f47cc2e51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097ceb1ed1f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002016dfe51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020729be61f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c963ae51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c22db4e51f7ad901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 456 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 3920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3920 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4448 wrote to memory of 2636 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4448 wrote to memory of 2636 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4448 wrote to memory of 3956 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4448 wrote to memory of 3956 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 40.125.122.176:443 tcp
JP 40.79.189.59:443 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 zlenh.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp
US 93.184.221.240:80 tcp
NL 173.223.113.131:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 40.125.122.176:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp

Files

memory/456-133-0x0000000000580000-0x0000000000708000-memory.dmp

memory/456-134-0x00000000055E0000-0x0000000005B84000-memory.dmp

memory/456-135-0x0000000005030000-0x00000000050C2000-memory.dmp

memory/456-136-0x0000000004F80000-0x0000000004F8A000-memory.dmp

memory/456-137-0x0000000005260000-0x0000000005270000-memory.dmp

memory/456-138-0x0000000005260000-0x0000000005270000-memory.dmp

memory/456-139-0x0000000007330000-0x00000000073CC000-memory.dmp

memory/3920-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3920-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3920-144-0x0000000002A80000-0x0000000002AE6000-memory.dmp

memory/3920-149-0x0000000002A80000-0x0000000002AE6000-memory.dmp

memory/3920-155-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 f3b2c7acd208985a26fa25e2d8b4ce0f
SHA1 a51adf365a2609c94df0d3675ad05a6bf9f7f2a0
SHA256 27f4f5f8edd898f6260dd1a5291dc1e2a78c94eeb7991d80258fe9849f441c66
SHA512 e0688d59083e8b7f268c38d0189dcb3c4bc80873acda17ffd907eb01861d624d9027e108eea0df040df8a05900e6ca986cde560f2bb494f608d33ab91233e457

memory/3732-157-0x00000000004A0000-0x0000000000500000-memory.dmp

memory/3732-163-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 bc9301af42c9595da1df504588cbb91b
SHA1 1bf0284850df08cc74a98cc72580530742fbd335
SHA256 258a07b9f93904d6974d348a0ef387ec69918c0d8078d176cd324b5197d9f45d
SHA512 2415a8e2dc5586d68ff734bbcebd231708611515399f66a0dead067c60c07957c875e96b13d4a1b601575669d9b0b94e7fb4b08d0807d45c10699132338da0da

memory/4028-169-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/3732-174-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4028-177-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/4028-176-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 2ca226afb9ab4b810148de5db71bcdad
SHA1 2f17c1faef939602d3477b9b3334d6f1757c520b
SHA256 64e0989ea13e68c2db2c2b97e715180082f9afd82d3869feff8fdccace98dd53
SHA512 a8b6fd836623e95d6ba32c99dd1d917c5da10f3fc7e755e8ed2f2281aff1043ed250b579d9622fecb386fbcd5488259cfa9fbac37b9cc6517dec58e70c3eb396

memory/3312-181-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/3312-187-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/1812-189-0x0000000000700000-0x0000000000766000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 eab7002b70b3a6439f4643406c2ca2f2
SHA1 55442f8361baad13b17ec9dcdabc115b85da1713
SHA256 7e843a4b2380388d267987bd993ab24c5803bf298f49384b4759afd684e20b30
SHA512 0a04d39579d49f5b6c66c9352beb8d878b25f3101ca603d72f6d98f4a3e289e063b121901cb05419227b36bca4a9f1049a9f63c0c6058841411990ae063dd056

memory/948-192-0x0000000000400000-0x0000000000460000-memory.dmp

memory/948-198-0x0000000000400000-0x0000000000460000-memory.dmp

memory/3312-201-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3312-200-0x0000000000E70000-0x0000000000ED0000-memory.dmp

memory/948-203-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1812-205-0x0000000004F30000-0x0000000004F40000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 b4feca34b0337512e48331c134bf75d6
SHA1 4070664800db90a7cf2f6d6e8c8b349c068f8ede
SHA256 9492c0a73cfdd4eb24123c4b020bb0d214d8585c61519f9742a8b445b215464e
SHA512 be5419156fd6e89d81a9acde8b33db6423cfa82c7a4f379b5904e8cd5f05f7380d7062e2326b1f3a51901afefeb3e4c14c3ddb3dea3c0f461126fcae8eed0fc5

memory/1816-208-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1816-214-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 414069871c7251a2821ee5937e168af9
SHA1 48311db920a49a76cf9ba660236f49695eeb71d2
SHA256 e0eec32fb2f1167fe4f76dfe63c305b4be687eead68a2e8ba450f3c06e925c24
SHA512 cdfc121a1f110fe041eab664169958435e4f2def1ea5c728e8fd101becc6d18c401fcf3ebe8f446598b5a08ed6856e9fc90d9fde56d1017ce7f110a8154c5c06

memory/1248-218-0x0000000002230000-0x0000000002290000-memory.dmp

memory/1248-224-0x0000000002230000-0x0000000002290000-memory.dmp

memory/1816-226-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1248-228-0x0000000002230000-0x0000000002290000-memory.dmp

memory/1248-231-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 84cee5e5bfc23fc0e6963c4619b72cb8
SHA1 1fd5f3191f5d1fce51d58757ba6a140b3d980218
SHA256 97935843e4aecdc246de09b0c086602c991aa8a7ab4fc03b371fd8d7e2f018e8
SHA512 8aa07c963a2e390cc9419b2ac799fec59271e182ebe95a1539428d85977a638e57b29812a50f472613c1cf89051d3497fbc52e3d45407749feb9ce44d0996c0b

memory/3960-233-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 4af4f7d6522ae5f8d6a7deb313d0b870
SHA1 bb2226fa16ba9be9a5df7cd6c66af92d1cc13faf
SHA256 89b276d940ca920f53cd33defb2fbde89051922d86d1da42916306876715ccee
SHA512 6c5cb1dc4a46d5f7a0cebfbe573dfad9b412113042954996150e844769c39760a559b56abe420fb7fa5cad0281d451fed4e70d6a301421b6369a7421449557c3

memory/3960-256-0x0000000140000000-0x0000000140210000-memory.dmp

memory/3424-257-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 ec32d5b2545e7bbfbc1fe4c2f7b3ac7b
SHA1 22da520571cbc83d7ffcaeb763a3d5f4ccae22ea
SHA256 fa40c281c2df676dd272312b791e9fb8453a10bb88f8467c912386e9c7d1f59f
SHA512 945f318acbaf57f8bd32fcb2339b5665796d4baec71cf74323fd2a219d3fe02d6d4e2ea16794dee948ffd769fd523913b1064c5a9609f54f49bc2e6b5fbbc102

C:\Windows\SysWOW64\perfhost.exe

MD5 2e91f8c546ce07ea92f17e52c0dfc3bc
SHA1 0b23111f3a8d9830297a6d36bc265e46c1c294f2
SHA256 689dbb52cacbc2447a6e65f203a57ced98409352fc3a4bc2a4c6cc452b256b7e
SHA512 887faabb5e7be7ea7228333ceff6c1f2283a548e3bfc1841dfbcf495b684d0a4f0ca057be0ff31d968e008b5bc8743ad9093b95253dc932c64882e6935b18674

C:\Windows\System32\Locator.exe

MD5 2860649d54a709666fe744de52a221e4
SHA1 0e0df41aa8876cfc25e36c9c172e45b7693dd495
SHA256 150e732a0185dbbbb17dbaf5012ea40f7ccbf92ea27c0d72ed9ad08e4531effd
SHA512 f6828cc70cae5f5b79adc57d67e535b1a30f9cd333975872058b25bceace232c76616642beac11c5fe327173a1fb45db074da30199349800ce95167c807a1036

memory/4572-279-0x0000000140000000-0x0000000140202000-memory.dmp

memory/4852-281-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/4352-284-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 047738c66844fc57bcbb3b0bd79a737c
SHA1 54e8c5efc3a226884fc41b4483a1dcd1e2b7c31b
SHA256 e9af061e55f6c92d4df65cff0ae279102f3b44dd24f35d1c95a555acc1d7a0d1
SHA512 0f4f0931817212d0690833276d9da97f0a3c5bedab27efceafb833b8b2bfdbef4a23f5948e23adcf012678cdce60c8ea0bd11db4a7ef9ad9d35bad6d8c12c65a

C:\Windows\System32\snmptrap.exe

MD5 0a744d808f5b048027d0182dc24f8cc7
SHA1 5ec0b0fffc3880ce8ded008b9ddeaa68baa9b391
SHA256 da7134f4305d2a02cda07ce7beba51e89742e2c9a299c5bc5317bb0b3719df5c
SHA512 f4cc7961f43ef89755ec6bd5c3cb84c04cca347e07410cc32a58bbf2c4f5bb9cf246463755d4edd04ea7017c26e1b7c35c83b3dc04198c1cfbbdf684a681e73a

memory/660-305-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3360-308-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 9197425623ca4e6656b736ef80a52577
SHA1 591bfeadc310819adfca7b54db6e4630dffbf6a8
SHA256 58adb8f7ed97f1e3f97dc279cbc69305363af2ae616e4e22b97c42467fc60483
SHA512 c15e0df35bb7b43ac10fea903efc7df7dae954fddf4e02fae9ce7715c661f6d9639a996091c1d48cb0eaf7681d8b937370ed28dc5dfd07f181a88755f89cc1d6

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a786c54e2afc17bbaaad58ddf244a24b
SHA1 2110e05dbb4a55dbda0c26625f7b82712da33042
SHA256 5ffe073af0f95d492a2fb32a667d7a85ca190bec278c345070f850a1e28ef8fb
SHA512 0420d780015041d69b35310196df8f81e329f57e4907284d6ddcd67d1773b1b6dab8d83bf3fbbd7fc3df3c7d1b28f93763d80f1c8b236ecd784a54ecccd265c5

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a786c54e2afc17bbaaad58ddf244a24b
SHA1 2110e05dbb4a55dbda0c26625f7b82712da33042
SHA256 5ffe073af0f95d492a2fb32a667d7a85ca190bec278c345070f850a1e28ef8fb
SHA512 0420d780015041d69b35310196df8f81e329f57e4907284d6ddcd67d1773b1b6dab8d83bf3fbbd7fc3df3c7d1b28f93763d80f1c8b236ecd784a54ecccd265c5

memory/3012-326-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3476-329-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 2931c40be54a0c16c5c7d1aa6a70d8eb
SHA1 c28f060c45bcf5919829bb02b563c3dedb878143
SHA256 430b540108422c6d9042151a4d050b1acc85d17eabbddb68199a25f93972b3e3
SHA512 13ba5c4866df94243c9de3b8309d0350c72a01cf5440ef3d4040561fba08b5687b03e2283f81da2dc9f53ce2893c519367ea2d67403130e934e96d896bb4277d

C:\Windows\System32\AgentService.exe

MD5 3f17262fe597ff7ef086a0f0a2d0be7a
SHA1 1e3a6b1f60bd1e6e77686451a18e98ba819a29a0
SHA256 a63aefd8cf33e7df3b8d1790c2cf300def99fa55d4365cf93f0b2e9ca53bc25d
SHA512 8a3217e81a0deba1ddca27bc1f8a75af0d19590d97dcd9072ad07c070cec94cfb91462392edb1d15ebf512574ba39950224e557da698a1b531259ef1d9cf080d

memory/3100-355-0x0000000140000000-0x0000000140239000-memory.dmp

memory/3204-356-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3204-360-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 8e76d021d9ce42daaec1c5cc8ec5a0df
SHA1 dd42d1e2cb7c4a0ca1d322fa28fa3b2d9eb804ef
SHA256 d8260ff65718f42d86009073efdf3397a998c48ed054fc052dcfbc3b5b3b14ae
SHA512 dacc6bf970f3b788b8913b9ab9c2505a421b567afdabe5bce9ce219bd1bf71b6570fed60c758d6a0a2ea4f9b3879fcf0470f4c2013c3c386ef6097d263e4c161

C:\Windows\System32\VSSVC.exe

MD5 674e59c1d18eb4dcd217d330153c1362
SHA1 c78a431ab289119e12b27a2ee18c41e0bc88a5ae
SHA256 40fad440ca780641d66f487c645585bce1b4ae5eed0804081e5bdbd73e35874b
SHA512 7e8bbaf643f2464cf1f7a57a6febf1715e11f8e3a298c9219686dbac590d83a1ae0aa1a17a5875bb258560e5536bdcd257ebc7c95082ccffe3ffbe191e1c8223

memory/860-375-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4920-372-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 29937e9e708f325bf71f6d263817bb1f
SHA1 9a8271839be06269a090aeca9afd62377d10062d
SHA256 47d2083c8f93e5684e22f539065611d2fd4f9cb9f05605e3b9d06f986668adb4
SHA512 4777b109747e11e01f78ce6e56f2d2898d35cd7a8f1609d53d921dfc00e69363fea51cb3ee958ff75f475d2ac55e9def40fd2ec1163f1a4ac735837f18095939

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 156db9e1021d3b5e0843c8001e7b024c
SHA1 ea227f5cecfffc920aa376e2a2c66c7c479bb1a2
SHA256 7c6706acf0b7e205e38a028ed0c029e11c8458e1acd9eef323b57383f1b54a3e
SHA512 3dbde60c6b8eda725e21758274ab6e286b73c230aefb461030a121cef6cfb278a5240365930c94c38a0171e64e72bc979ee0b73094c4bf987dd27c2ee38e1642

memory/3920-404-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 7d9a78a8164e850c11d64b9a403d17b8
SHA1 44bbd2aae835968f425809b24348764aed076ec2
SHA256 1fb4bbfb290d9a4dbc8303311697926e8d7c87c5c9f4c2b89fabe955565cb62a
SHA512 90b6208c1c7e1937784c203d703439b754cdc3c8c06d8aaed1d7dc79c2af793f08b10827d8d0b24c2893fd29c624c1f22235307417a70c939c7e28ef95cf3eb2

memory/3520-405-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4844-407-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4028-459-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4448-460-0x0000000140000000-0x0000000140179000-memory.dmp

memory/948-494-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1812-497-0x0000000004F30000-0x0000000004F40000-memory.dmp

memory/1816-523-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1248-525-0x0000000140000000-0x0000000140221000-memory.dmp

memory/660-557-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4352-564-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/3360-590-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3012-593-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3476-596-0x0000000140000000-0x0000000140259000-memory.dmp

memory/860-609-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4844-610-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4448-626-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3956-640-0x0000000004F30000-0x0000000004F40000-memory.dmp