Malware Analysis Report

2025-01-03 07:52

Sample ID 230501-knpx1aeh38
Target Quote 1345 rev.3.exe
SHA256 bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61

Threat Level: Known bad

The file Quote 1345 rev.3.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

outlook_win_path

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Script User-Agent

Suspicious behavior: LoadsDriver

outlook_office_path

Uses Volume Shadow Copy WMI provider

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 08:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 08:45

Reported

2023-05-01 08:47

Platform

win7-20230220-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4bca0a12decfa14c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{772B97C6-1A9E-4F8E-BA7C-57C0EA520338}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{772B97C6-1A9E-4F8E-BA7C-57C0EA520338}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{2177A833-9597-40FE-ACD8-DD0420188C62} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{2177A833-9597-40FE-ACD8-DD0420188C62} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2040 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 648 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1592 wrote to memory of 1280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1280 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2360 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 3040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2476 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1592 wrote to memory of 2508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 238 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 264 -NGENProcess 1d4 -Pipe 260 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 268 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 264 -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1ec -NGENProcess 238 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 270 -NGENProcess 254 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1d4 -NGENProcess 278 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 248 -NGENProcess 250 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 248 -NGENProcess 254 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 248 -NGENProcess 1d0 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1d0 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 268 -NGENProcess 270 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 288 -NGENProcess 238 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 280 -NGENProcess 1d0 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 270 -NGENProcess 298 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 29c -NGENProcess 1d0 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 278 -NGENProcess 288 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2a0 -NGENProcess 268 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 1d0 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 164 -NGENProcess 168 -Pipe 174 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 1dc -NGENProcess 1e4 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/2040-54-0x0000000001210000-0x000000000138C000-memory.dmp

memory/2040-55-0x00000000011A0000-0x00000000011E0000-memory.dmp

memory/2040-56-0x0000000000510000-0x0000000000522000-memory.dmp

memory/2040-57-0x00000000011A0000-0x00000000011E0000-memory.dmp

memory/2040-58-0x0000000000550000-0x000000000055C000-memory.dmp

memory/2040-59-0x0000000005D20000-0x0000000005E58000-memory.dmp

memory/2040-60-0x0000000007E60000-0x0000000008010000-memory.dmp

memory/648-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/648-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/648-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/648-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/648-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/648-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/648-69-0x00000000000F0000-0x0000000000156000-memory.dmp

memory/648-74-0x00000000000F0000-0x0000000000156000-memory.dmp

\Windows\System32\alg.exe

MD5 e17aae590555fc7d802a7b8b47c0994b
SHA1 6146fc3001361149225467edc6aeca028d508fb1
SHA256 24af1a66a9913d7af11f54b09e252b49d27da01cc2b6e52ef6cb7c845eda1305
SHA512 006e4d035e4134deb3b2918c342c9ac5c015e53421288e509ecbfe25916e9176cc2da7f67f177c7acaef1e0472bea7e2a2566ac1a7de017b5783beb966b05a6c

C:\Windows\System32\alg.exe

MD5 e17aae590555fc7d802a7b8b47c0994b
SHA1 6146fc3001361149225467edc6aeca028d508fb1
SHA256 24af1a66a9913d7af11f54b09e252b49d27da01cc2b6e52ef6cb7c845eda1305
SHA512 006e4d035e4134deb3b2918c342c9ac5c015e53421288e509ecbfe25916e9176cc2da7f67f177c7acaef1e0472bea7e2a2566ac1a7de017b5783beb966b05a6c

memory/1640-82-0x00000000001D0000-0x0000000000230000-memory.dmp

memory/1640-88-0x00000000001D0000-0x0000000000230000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 5a0da41c78c1a1d8e18a8d515b19616b
SHA1 ff18f804d645ec72658bc600895347696f4b18cf
SHA256 2ee46accd920a73f7ae8c5980c60ff04254846182c88abf4bb7cc2de1fe124e7
SHA512 44c1bf49156528e6889850920bcf902755fde506ef93c6f829a538d5a75d1658dfa6997a73b7b05267fccd8d9f5015f7bdc77f135ebaf8a4322c36d4602c1c76

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 5a0da41c78c1a1d8e18a8d515b19616b
SHA1 ff18f804d645ec72658bc600895347696f4b18cf
SHA256 2ee46accd920a73f7ae8c5980c60ff04254846182c88abf4bb7cc2de1fe124e7
SHA512 44c1bf49156528e6889850920bcf902755fde506ef93c6f829a538d5a75d1658dfa6997a73b7b05267fccd8d9f5015f7bdc77f135ebaf8a4322c36d4602c1c76

memory/648-94-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1640-95-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/932-96-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/556-97-0x00000000001D0000-0x0000000000236000-memory.dmp

memory/556-98-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/556-99-0x00000000001D0000-0x0000000000236000-memory.dmp

memory/556-101-0x00000000001D0000-0x0000000000236000-memory.dmp

memory/556-103-0x00000000001D0000-0x0000000000236000-memory.dmp

memory/556-104-0x0000000000900000-0x00000000009BC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 b6dfd63133ba3587925438b4375df3a7
SHA1 d04baf2192e363fb76923e0e3f9ea770523c9498
SHA256 66311bd0ce018e0c72c5212e8bb2c80e56299e0e99dd711d4dec83ee23d94bc5
SHA512 af8345e41a2be36ed79bae79612a95a160aee0df2bf440980a7a2e3addea9e3cd769a78ca066705f3999fc757f62e4ddf45584a6ae3bb73c1d38e34c8ef369da

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 b6dfd63133ba3587925438b4375df3a7
SHA1 d04baf2192e363fb76923e0e3f9ea770523c9498
SHA256 66311bd0ce018e0c72c5212e8bb2c80e56299e0e99dd711d4dec83ee23d94bc5
SHA512 af8345e41a2be36ed79bae79612a95a160aee0df2bf440980a7a2e3addea9e3cd769a78ca066705f3999fc757f62e4ddf45584a6ae3bb73c1d38e34c8ef369da

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 792bf5e4495768050cf6641d1ea3a532
SHA1 657035c2926f9ab02ae82a83b98520aab0fba0e2
SHA256 9013663d7bbd6f87507ecc2e010781c92efc951bc9601d21b257d69acfda3fa4
SHA512 5d0a5d04392eaaa68d8e1a31913e6b8fe9ef9e467acfd99e43f6d5ff80d7ac8371a6664ea3cc3ab5e9149dbad60494df80410697c1055e50d81335dc5a9f7095

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 792bf5e4495768050cf6641d1ea3a532
SHA1 657035c2926f9ab02ae82a83b98520aab0fba0e2
SHA256 9013663d7bbd6f87507ecc2e010781c92efc951bc9601d21b257d69acfda3fa4
SHA512 5d0a5d04392eaaa68d8e1a31913e6b8fe9ef9e467acfd99e43f6d5ff80d7ac8371a6664ea3cc3ab5e9149dbad60494df80410697c1055e50d81335dc5a9f7095

memory/1052-115-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/588-116-0x0000000010000000-0x00000000101F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 61662c82a0714b41b401653f01cb634d
SHA1 1bd4f535e038c7b6b24074b35ceca3e1177a2f10
SHA256 f80b5d15f2398dc90c637b0856b0558544c35fde8f83a056f9434f3099d2d5e3
SHA512 1b0e3c62838f8219b048b1d68ae6a9d62397ba2794091fbb1d787624cfe8b2814f72b509c0647716a9813705423cc9fe9ed6f44ef1a55097208d8f5fcdefa039

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/1592-123-0x0000000000600000-0x0000000000666000-memory.dmp

memory/1592-128-0x0000000000600000-0x0000000000666000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 792bf5e4495768050cf6641d1ea3a532
SHA1 657035c2926f9ab02ae82a83b98520aab0fba0e2
SHA256 9013663d7bbd6f87507ecc2e010781c92efc951bc9601d21b257d69acfda3fa4
SHA512 5d0a5d04392eaaa68d8e1a31913e6b8fe9ef9e467acfd99e43f6d5ff80d7ac8371a6664ea3cc3ab5e9149dbad60494df80410697c1055e50d81335dc5a9f7095

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 cc1f1e7c401b4dd7f51e2f78580d9cf2
SHA1 3e466575631c84c305f1afbf099c96176e41c74d
SHA256 fe641c1c39b335fd871a1bdc64e3065d4b47e2ee671fc828dd546b723716f06b
SHA512 eb304d030b1c57d6795d76ecded59c223517a055add7d34fad8f33eb6772a4208ff8cf9d97b12497040a679b1692207790e0a6a2ee06efe55e3087352da65480

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 9689219c6eebc358879aa2207913677f
SHA1 bfbde8a28083009539f10a7d0279bb7de20d53d7
SHA256 7cd27c931a3673160c4cd81a367141054aabb2a3142a7568ddac98c5466530f4
SHA512 c27f4cd05038b584a70be7d2beca0e5316e6aa2612eb8f018dceda870b45b74adaf7f74815ab457a1255680fd3c85856bc0fdd0970b4a8212368c453cbaaad46

memory/1052-139-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\System32\dllhost.exe

MD5 8db8a3ec7fe4d5c85be718242cf232da
SHA1 6e19a63c881d185a1fb8c576ddbc683229d3bbab
SHA256 5375c1464e3d54b36ae283c71be50ed2cd231fa03559d0abdcc179d51573ac3d
SHA512 ccb8cfc8f0819c7ad4ab0c36326552bd2107aee0393f3d89e844f291c0e0d98def4bd00de120a69def833091fbb7ee84343638d9a7af5b40f63e740cdefe6498

\Windows\System32\dllhost.exe

MD5 8db8a3ec7fe4d5c85be718242cf232da
SHA1 6e19a63c881d185a1fb8c576ddbc683229d3bbab
SHA256 5375c1464e3d54b36ae283c71be50ed2cd231fa03559d0abdcc179d51573ac3d
SHA512 ccb8cfc8f0819c7ad4ab0c36326552bd2107aee0393f3d89e844f291c0e0d98def4bd00de120a69def833091fbb7ee84343638d9a7af5b40f63e740cdefe6498

memory/1948-146-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1476-147-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 9689219c6eebc358879aa2207913677f
SHA1 bfbde8a28083009539f10a7d0279bb7de20d53d7
SHA256 7cd27c931a3673160c4cd81a367141054aabb2a3142a7568ddac98c5466530f4
SHA512 c27f4cd05038b584a70be7d2beca0e5316e6aa2612eb8f018dceda870b45b74adaf7f74815ab457a1255680fd3c85856bc0fdd0970b4a8212368c453cbaaad46

memory/1592-150-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 6d5cfc2632c12820415044978879a3c6
SHA1 1f011fb7f683d9d2c39b43ae022b9bbc8ca620ff
SHA256 9b7d1ab14652903a2da82ed3789b5b22b44e59b0bd1fd83cb4df79137ef518da
SHA512 254df88f68d7c9f7be0c45876262a1817c5b42093bedb08603406c9133bbf0e3049840501b98e0255b3844c4c96732b47b7e62a6eb39fd472960b035143dfd17

C:\Windows\ehome\ehrecvr.exe

MD5 6d5cfc2632c12820415044978879a3c6
SHA1 1f011fb7f683d9d2c39b43ae022b9bbc8ca620ff
SHA256 9b7d1ab14652903a2da82ed3789b5b22b44e59b0bd1fd83cb4df79137ef518da
SHA512 254df88f68d7c9f7be0c45876262a1817c5b42093bedb08603406c9133bbf0e3049840501b98e0255b3844c4c96732b47b7e62a6eb39fd472960b035143dfd17

memory/1644-153-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/1644-159-0x0000000000870000-0x00000000008D0000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 873d7a3f91df2722553422e86c4affc5
SHA1 bf9ee694dd4a9d2896eb66daa4ad5f7cdcb7a211
SHA256 cbc274a570d74d20a221b756a011f9348c01f90c40e83696323c01dda4cc6fbb
SHA512 2dd14e368bbf17b1274baeae27bec3207b6a4620675a94047d7389211cae512eb8a7a6b9f6a20fc60ccc94cfa4a0d4a5dadfa4c62190f4b88fb1192dcc59021d

C:\Windows\ehome\ehsched.exe

MD5 873d7a3f91df2722553422e86c4affc5
SHA1 bf9ee694dd4a9d2896eb66daa4ad5f7cdcb7a211
SHA256 cbc274a570d74d20a221b756a011f9348c01f90c40e83696323c01dda4cc6fbb
SHA512 2dd14e368bbf17b1274baeae27bec3207b6a4620675a94047d7389211cae512eb8a7a6b9f6a20fc60ccc94cfa4a0d4a5dadfa4c62190f4b88fb1192dcc59021d

memory/1644-164-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1644-165-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1724-168-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1644-169-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1724-176-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/1052-181-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 4f446b11a9f0113e674d3525818f7614
SHA1 3dc4748f56c12e653ee9b8ca173231384cf9fdf8
SHA256 974c1717a8b839817d97c63932edfcffb8386ea1eab91d6039584b5ad0e02ec4
SHA512 db084f43122b09a9926c459df9c2b43e093d09293b7583614be14db170048c867b59af81f4e7626b4f2ccd71dfb31a213822b98d9e668eee6665d3cf61f7e03f

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/1280-184-0x0000000000730000-0x0000000000796000-memory.dmp

memory/1644-198-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1052-199-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1280-200-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 8b19cfd9ccd56260623e4be3c74e2681
SHA1 7888e01382fc0b7bfa0c6804f77d1e4f3e13bfb3
SHA256 e86ffd0e03768060152bf591a3307741d75a4dedf8f048ab8dc4fca7cae3852b
SHA512 3031d9cb02b180dd07e92c346a0be70fa3200ef3c477200580fba850fc5ae7ea8e33791c5722dc76676f54ebf6aab85fda694a707966f636c6d466e2d410f6c0

C:\Windows\System32\ieetwcollector.exe

MD5 8b19cfd9ccd56260623e4be3c74e2681
SHA1 7888e01382fc0b7bfa0c6804f77d1e4f3e13bfb3
SHA256 e86ffd0e03768060152bf591a3307741d75a4dedf8f048ab8dc4fca7cae3852b
SHA512 3031d9cb02b180dd07e92c346a0be70fa3200ef3c477200580fba850fc5ae7ea8e33791c5722dc76676f54ebf6aab85fda694a707966f636c6d466e2d410f6c0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/1280-221-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/2072-225-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1300-233-0x0000000000CD0000-0x0000000000D50000-memory.dmp

memory/1596-232-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1356-236-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 e753cc2e2abf715aa07aed695ff8b228
SHA1 a962a396fe8861305324d7a534cac96784046525
SHA256 daf5b47ea823c6d9d020755e3bc1698c5c244b8f741ea98b78b5af251f6ba964
SHA512 bfcefc8bcb1182dd73ee1f7b78e575fd10385b2f20da5163343aee58ff774b696879ee64532207e72bd58dd9567354cd65423a1ed185d0bdf4a0a4f4bd852ad5

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/2072-255-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/648-258-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/932-262-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 bf537afcb4f62e58dc5d836183ee99ce
SHA1 6b1eec835a6165cc2484c0c45a6563e46bbdd69f
SHA256 e40ab8fbd2cd870a33c87e154475bf7f280af8f26f4da9afc21a4bb3f187ea14
SHA512 161a275f0047910ce5844e64676c75ea79f5b920faea8f49322ab24c7db2770b50772c1b9b237d6ce227a87df9e0fc78b4ff5490d127fc2c0369276fb39d0470

memory/2180-276-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2244-280-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2360-281-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2396-282-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msdtc.exe

MD5 3a8ae241da122fe897b876ce717e42b7
SHA1 4501e21d1e75138800ce3e5699092fa4b8171cf8
SHA256 4e452a8d728b60f24c09c7e1aee1bae873aaea630fadef8d5cb42347262c2081
SHA512 25df63469b0ec3c73d5d7950eb42a73ae8fd410c42d6363aaa15e970cc6e24e1e29eefd481aa9b010defa839865911c54eee82412fe9694724f897b2dc248d7f

memory/1948-283-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 3a8ae241da122fe897b876ce717e42b7
SHA1 4501e21d1e75138800ce3e5699092fa4b8171cf8
SHA256 4e452a8d728b60f24c09c7e1aee1bae873aaea630fadef8d5cb42347262c2081
SHA512 25df63469b0ec3c73d5d7950eb42a73ae8fd410c42d6363aaa15e970cc6e24e1e29eefd481aa9b010defa839865911c54eee82412fe9694724f897b2dc248d7f

memory/1644-287-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1724-289-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2560-291-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2396-301-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 c636bd48228f5c390e513806ca41c55e
SHA1 d5ac07ca75326e7c9c6df50f1f5f5f81ebbb4060
SHA256 07854364e4c0926b79e4f95ee8006b56326adeb2ae5fabebef94601eb2f83e77
SHA512 4ef405269d4c6b1fdcc5f072c4ba70d9049daac6e00e2d548b291f644d8fa16098249cceac856867ff0ad4fdc39d1f18b61b4d99c13d7113677707c3e2a88125

C:\Windows\System32\msiexec.exe

MD5 c636bd48228f5c390e513806ca41c55e
SHA1 d5ac07ca75326e7c9c6df50f1f5f5f81ebbb4060
SHA256 07854364e4c0926b79e4f95ee8006b56326adeb2ae5fabebef94601eb2f83e77
SHA512 4ef405269d4c6b1fdcc5f072c4ba70d9049daac6e00e2d548b291f644d8fa16098249cceac856867ff0ad4fdc39d1f18b61b4d99c13d7113677707c3e2a88125

C:\Windows\system32\msiexec.exe

MD5 c636bd48228f5c390e513806ca41c55e
SHA1 d5ac07ca75326e7c9c6df50f1f5f5f81ebbb4060
SHA256 07854364e4c0926b79e4f95ee8006b56326adeb2ae5fabebef94601eb2f83e77
SHA512 4ef405269d4c6b1fdcc5f072c4ba70d9049daac6e00e2d548b291f644d8fa16098249cceac856867ff0ad4fdc39d1f18b61b4d99c13d7113677707c3e2a88125

\Windows\System32\msiexec.exe

MD5 c636bd48228f5c390e513806ca41c55e
SHA1 d5ac07ca75326e7c9c6df50f1f5f5f81ebbb4060
SHA256 07854364e4c0926b79e4f95ee8006b56326adeb2ae5fabebef94601eb2f83e77
SHA512 4ef405269d4c6b1fdcc5f072c4ba70d9049daac6e00e2d548b291f644d8fa16098249cceac856867ff0ad4fdc39d1f18b61b4d99c13d7113677707c3e2a88125

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 b087ae5df884b666699dca0afacf3c42
SHA1 9594f28d8d81bb076989190cf5555d7736173189
SHA256 939e614fd1ab2d09d7c25955d13445c46d52b23628b9f76aece44b8e4752b845
SHA512 7b55a7dde55f14d5b3453afe5bc7e8ac6db4287ebfc843232d2c9c0a1180483c0e85beeed9f24fd08cde450e45aacc2a83bf47268a72a2f2d5b3f82136f3e48c

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 4a480bf74dd857a9f08b42f707aace63
SHA1 9f6b5dccd4061025ee48e2c84e0aff5b70f48c06
SHA256 82fb53d432aa4e55915016de1090a32a1ecae47422dbd7caa808495794d37389
SHA512 61ee2b016868026513adfcdf7d399fd2362b228f581b2b401d2f9b3544115fbd62bab725d792a85c733a173b31a12733b2e96301901048cea390c8b157d65d11

memory/2688-330-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2688-331-0x00000000005C0000-0x00000000007C9000-memory.dmp

memory/2832-333-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2876-334-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1300-335-0x0000000000CD0000-0x0000000000D50000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 23dcde48b0483e2ca6dcddae6548984d
SHA1 e97cdb657cf2c2bca6ec9736b7a5950e22f824a5
SHA256 3f7f9c5d4bf1e388063e25203d86d3b067405890bda74802ba436b2e240fbf23
SHA512 f543ce0f2a6cf084f555222bea9dfd44724280fc0908f47201a728780784394c38337769b982b43b38e10b92614021157e6f91cc2a0c139329a3f050cd5ce4c5

\Windows\System32\Locator.exe

MD5 d77f791c1c737bcc7e2ba54970ba0636
SHA1 870c411e6f8c064148b2211178d27a3b8d90f681
SHA256 64c15743d3957a7ce6f4e40621e8b0bdea0ea581d7646115c64b82d1a3748614
SHA512 2c33fa33ef025a4830f59ee5ab1551ae915d26936653b98f9b82a9a57f3d5ba014b96062ea5b7c407cd0d22171062559ec93a624fa4854fae5ef458134fd9a17

C:\Windows\System32\Locator.exe

MD5 d77f791c1c737bcc7e2ba54970ba0636
SHA1 870c411e6f8c064148b2211178d27a3b8d90f681
SHA256 64c15743d3957a7ce6f4e40621e8b0bdea0ea581d7646115c64b82d1a3748614
SHA512 2c33fa33ef025a4830f59ee5ab1551ae915d26936653b98f9b82a9a57f3d5ba014b96062ea5b7c407cd0d22171062559ec93a624fa4854fae5ef458134fd9a17

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/3000-354-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/3032-355-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 d3a26335467d47e8022f692dbbc8032b
SHA1 ba33f102c32a3f1b056281ec02e55dc3d2696442
SHA256 95f45c2d9bf45b483db53421d14691de0acc066af618df016744ca6ef785dc86
SHA512 b8b461e84e59bcbbee751844c2ff9711a328c871895236c05d684370bdaaf9f5ac275ff41c5b9ec44c59b708c90ae80243e0c99694031c1d0d6bc66bda83cd31

\Windows\System32\snmptrap.exe

MD5 d3a26335467d47e8022f692dbbc8032b
SHA1 ba33f102c32a3f1b056281ec02e55dc3d2696442
SHA256 95f45c2d9bf45b483db53421d14691de0acc066af618df016744ca6ef785dc86
SHA512 b8b461e84e59bcbbee751844c2ff9711a328c871895236c05d684370bdaaf9f5ac275ff41c5b9ec44c59b708c90ae80243e0c99694031c1d0d6bc66bda83cd31

\Windows\System32\vds.exe

MD5 c1cdfa190fd637d7c3898e02d2b5a38c
SHA1 1bf937491d7a9edb6e5f569e480e06e0e8c062aa
SHA256 3c359205e9b65446c32371d8179af9504bdbb24d06d161a50978fad2585f0d96
SHA512 30d0d73a05867a1dc8912bb7516da93688fbfa5bfe51acf8c39d651f9b91018f670516503798c18719870b2dcda246aefdf6412d23a316cb9e8e766955cf5783

C:\Windows\System32\vds.exe

MD5 c1cdfa190fd637d7c3898e02d2b5a38c
SHA1 1bf937491d7a9edb6e5f569e480e06e0e8c062aa
SHA256 3c359205e9b65446c32371d8179af9504bdbb24d06d161a50978fad2585f0d96
SHA512 30d0d73a05867a1dc8912bb7516da93688fbfa5bfe51acf8c39d651f9b91018f670516503798c18719870b2dcda246aefdf6412d23a316cb9e8e766955cf5783

memory/2360-385-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 473ace802f62141a2e0abcfdadf9a316
SHA1 6c1e8c80383fedfdf982fdeb556c8cb0cfac41d0
SHA256 3bfa36765e05b8ba1680b5547cad3e387465bed2a8374c0991f3972d04691a6c
SHA512 3c93050c3ff11e27cfd74b2846a6c803ea1079e1c1c554f79540d924b0033b296e14a1e962d42defdedc5cc5813f1971eecd1ac9a745c1403d8cbb0b942cf6e9

memory/2316-389-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2112-393-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/936-395-0x0000000100000000-0x000000010026B000-memory.dmp

\Windows\System32\wbengine.exe

MD5 30b3c41c8a31a9358be01586866b36be
SHA1 c311622830d6cccac7ee99fb9634bba1b9a6f04b
SHA256 bab43aef7fb3baf90b4c4fb27a976b70fede102a37217286535b8140098fcc77
SHA512 96c3d347e93d45ec4f8a67b0c0697e699147ad3154f22a48e7f7af6306a3ab5170ab000e8b0828d38e6827b1f872b43bf26625e0a1d12d52c533c06bd508be65

C:\Windows\System32\wbengine.exe

MD5 30b3c41c8a31a9358be01586866b36be
SHA1 c311622830d6cccac7ee99fb9634bba1b9a6f04b
SHA256 bab43aef7fb3baf90b4c4fb27a976b70fede102a37217286535b8140098fcc77
SHA512 96c3d347e93d45ec4f8a67b0c0697e699147ad3154f22a48e7f7af6306a3ab5170ab000e8b0828d38e6827b1f872b43bf26625e0a1d12d52c533c06bd508be65

\Windows\System32\wbem\WmiApSrv.exe

MD5 fd9062ee92c085e1acabb336aa96059c
SHA1 6731cb26cb8eaf228fe5156d053f418e83b58a47
SHA256 a977c282600baaac90b6d0edad65c7639b9a0ba2f89e751ed02fd23e857b34af
SHA512 af9c3d2f655b6822ec627691ffaea2ae146965ad53633873c6d66d0493056fb58ef703d9fe8e424aae22e029ae319d4f0d30e340640969374eea01e728c31010

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 fd9062ee92c085e1acabb336aa96059c
SHA1 6731cb26cb8eaf228fe5156d053f418e83b58a47
SHA256 a977c282600baaac90b6d0edad65c7639b9a0ba2f89e751ed02fd23e857b34af
SHA512 af9c3d2f655b6822ec627691ffaea2ae146965ad53633873c6d66d0493056fb58ef703d9fe8e424aae22e029ae319d4f0d30e340640969374eea01e728c31010

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/1052-418-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2072-420-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2664-422-0x0000000100000000-0x0000000100202000-memory.dmp

memory/1300-424-0x0000000000CD0000-0x0000000000D50000-memory.dmp

memory/2720-426-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2084-431-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/2720-449-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/1300-453-0x0000000000CD0000-0x0000000000D50000-memory.dmp

memory/2180-457-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/3040-459-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/2204-473-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2476-474-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/2476-485-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

memory/2508-496-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 14abc3b92a6d47af546fe5ba9a36f1d0
SHA1 6b9e312677b794332a0bee844553e98003f8f85a
SHA256 7808dafeb1134bb90a1f9c52d2dbbb0794fe49e856d1a492d21dcc186371cbed
SHA512 073c6963463940a7b73aa7b32d5f5056dd71070e57fc980faf89e1043725408eda01e97c14d71cd76b9af841f5dfc044c32ca0840d0fba866cd8a67a9ff80d3c

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 c194b25c6f7750aefec4cafb5bd17959
SHA1 b10f795fd39e871a7bdf2234c8906a7143483cb9
SHA256 8849e045cc953e359023f082406b1eb5e840111cd067910387e8d33fabecd723
SHA512 42c90c533641c6df67d7a8dbe60bd0612463f583708fdd0bed10fd482f5f91ee2b1417bd1f11d96f88128b547cd47c1ef3042ca957f36342c0662d7b427d8d0b

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 08:45

Reported

2023-05-01 08:47

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5bf14b09a2815e1.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d8b8c2a1a7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094abf02a1a7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d23a052c1a7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064a901301a7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 2700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1172 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1172 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1172 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1172 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1172 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4676 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3936 wrote to memory of 4676 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3936 wrote to memory of 4280 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3936 wrote to memory of 4280 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 52.152.110.14:443 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 93.184.221.240:80 tcp
US 52.152.110.14:443 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 przvgke.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
SG 72.5.161.12:80 knjghuig.biz tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.152.110.14:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 93.184.221.240:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.152.110.14:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp

Files

memory/2700-133-0x0000000000550000-0x00000000006CC000-memory.dmp

memory/2700-134-0x0000000005610000-0x0000000005BB4000-memory.dmp

memory/2700-135-0x0000000005100000-0x0000000005192000-memory.dmp

memory/2700-136-0x0000000005070000-0x000000000507A000-memory.dmp

memory/2700-137-0x00000000050B0000-0x00000000050C0000-memory.dmp

memory/2700-138-0x00000000050B0000-0x00000000050C0000-memory.dmp

memory/2700-139-0x0000000007280000-0x000000000731C000-memory.dmp

memory/1172-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1172-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1172-144-0x0000000001720000-0x0000000001786000-memory.dmp

memory/1172-149-0x0000000001720000-0x0000000001786000-memory.dmp

memory/1172-155-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 cd3a9ac856f5e907728ada8a20c5c10a
SHA1 ceee6aac7888779205b29adbe044c3aa8f5ad2db
SHA256 1e7e43ab1c1f4b73249a4a8cec9bcd07515ef9f067b625dee6852782d57e1f94
SHA512 7e05f024d720b3f1bd817ba5235407fdddf278a0c9bbe0773d7cfcab4e9a168f0de780f465fe4f9bdc1196ffa18a2dab0f410cacde993ea219b0905d102c868c

memory/2708-157-0x00000000005D0000-0x0000000000630000-memory.dmp

memory/2708-163-0x00000000005D0000-0x0000000000630000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 25af4e96fdd1dbb20e3531fbc23f75b5
SHA1 67ab72b23bbc9ffe5f4f4a6ff8f41468bd9bea31
SHA256 ee2b4e2d42ed7f5ef64c3b01a0920e7eb2047481c67ae5d0cbc5b62610b37ae0
SHA512 f099432d364acb85fa1e17ed13f3ed6d5bbae12c0597ac917f1889416b3129d801a67766f449f191974e89147eb9722c713153e6094bac0cc499d320ce091fba

memory/4512-170-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/2708-169-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4512-176-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/4588-178-0x0000000001130000-0x0000000001196000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 f369f9efc0accfda747503301d45a5ab
SHA1 93a5f116617e96edceb1731b744bd17275d59e04
SHA256 c214d1c92f5dd729506ace5ecf7e0a8bf72b5824de93ed80ef26fd92367e88b8
SHA512 49e4eb38971e9dac73a2453e1ee5f20cc2879bad67ff790e3b73b4d4ddc99dcb634e7bce30f0facf7369e22a28d56708f15a75c074af0fd392da5c04411ce69d

memory/3424-181-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/3424-187-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4512-189-0x0000000140000000-0x0000000140200000-memory.dmp

memory/3424-190-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4588-191-0x00000000057D0000-0x00000000057E0000-memory.dmp

memory/3424-194-0x00000000004F0000-0x0000000000550000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 eb80fc052f22b54a3368220d1569cbde
SHA1 0bce92895c9f1c3ffa9f44c4d2e3a984f3fb20b6
SHA256 6dcc3e7137b8a6ce65dcc6c67d4771c95494339fdb14a1754fcdaf8b10a19cc4
SHA512 d9686115ad91a02238b701e4cb5e2bc278afdffea0802b6ee29721d8ef9abc5bbdc0a3477153f6bcb95ab81ad6ea511ac73255adb223d36f706a927b42456132

memory/1148-198-0x0000000000720000-0x0000000000780000-memory.dmp

memory/3424-197-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1148-204-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 ab832d393bc9821982bc6c2e77683abf
SHA1 209f1a06d04d913aa409a4096a2fb192b8efc309
SHA256 151167ce2eae3274b5c6d02f042c8a5091ae70f17ba551a091179e681bddd80c
SHA512 4d314869a5974944283de4fae288f0a277a6cebdd3b2da65b53bf31a9d6f935c9b25174a73c7db686e1d91d2df840b7e4378533f83bddbe1604c584796fee31c

memory/5008-208-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/5008-214-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/5008-216-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1148-217-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 37eda787edc9616fbe257c2381c9347d
SHA1 144acd3caf742237569e6175f8328bac1b04f33f
SHA256 d54c09fc059e716e46c6f3f7f747b21bff892d83b196f35a2aff34970354837f
SHA512 58920413ab218d782876a454b73df153f0e312439374b19761e9a352206d78108630926dfa52387e16b88cc333be17bc70d7336cc7ce8082e72fdaf3a160220e

memory/4632-220-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4632-226-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4632-229-0x0000000001A50000-0x0000000001AB0000-memory.dmp

memory/4632-232-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 16e3b47a260f5eca5ec443e8e0897d72
SHA1 a28fa13edb333e168bac4ce6b50ae69d017a8fb5
SHA256 40badd8d2760b2c913e61691a73ee1ccaa90aee68ffcac0c4ef60cd51d8033af
SHA512 dcc6a0760a4f50ff62727bcbbf39bb580d75b898a445ac3038963400dcdcbc9bf1ab9811de3616561e95fdde9dc6fb77b3a226ae63b1b7324441cf9a7f107f80

memory/2116-234-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 092ae1f8427d43af629841c5fdece50d
SHA1 953a98b053e3beb2241e2e567dccdf2c9ed2b69c
SHA256 4fea75c0fe94d74b248f142778c258eba6569aa66c3e52f5d8e567011d08d772
SHA512 f1b935f3efc385b5a421b351f600908a23858e7acab1dbe38389321203d22fe5fc526848fbbd33cc7b559fc1af5947c8ddd8988817cc1daa57f3b29cb4fe4433

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 7d3560dbe7c208031f1f8aaf6c627212
SHA1 b55398729af226f932e99d243fff96fa2db3caa1
SHA256 728b65fd588bf689b5dd204c70913795fe5b6d025ebb06bca6e69681c346a9c4
SHA512 b787300169905314b4ca75df393fa27ddfe2b7679fc05770d24c440e96010d121f049d9839ecc1dbafcc7922c6dc1693d5ce079ddf2ced586e7caa5551282c87

memory/1172-258-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2116-261-0x0000000140000000-0x0000000140210000-memory.dmp

memory/2292-263-0x0000000140000000-0x0000000140226000-memory.dmp

memory/4148-266-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 5ef33defa9f6d59129ab8d105eb8cb93
SHA1 586532760be50d63fe5bcd54087efb5e77e739ec
SHA256 fa790a987e1dddd39b5f2a52a97fb9d54823e3a2a0a781f889f0659b25c718a1
SHA512 7c9b23360063f2d1a47d6e33a1d37c8ec3f221f826b9e4e3d8dcfec7983e874cef9c4a1e43ea4a7f60bc0e59a1e734400dc4c2a2836bfb2657906a47241c967c

memory/1396-289-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 4f7f9a74a710aa9d529674d7e3c1d881
SHA1 00fe8626c6c86b66fca28401251d23eaf365206a
SHA256 22e5c2e7ece21263c6bd63d02a183295f24dea096be79286aeb8cf50f5fd06f9
SHA512 96d4bb570dad836fb9033d7a30231e5b3e406517b45759e23c51466ff5e18be41ffe858a30f5db589c5fbf0338dc3d936c57307505fe4bf71052604c062fe99b

C:\Windows\System32\SensorDataService.exe

MD5 c026e810ae632799f2242ceaa71e639c
SHA1 15f1cd8114e5bfe8ebeca0153d18e484623c687e
SHA256 954449f30dabca93253a293d69e6cb07a6cc534548840013bfb89f4f42efb54a
SHA512 d1ccc10cb5f49d73fb3f64baa7cc8d58b4ae419c1a0e24b17b78bfd51f574ee4ee205536fb88dc82440622ffd6ebdaff6a67dbb5ff88663f43b480a70ec525d1

C:\Windows\System32\snmptrap.exe

MD5 909666700dd5d8f41c6afb33cec201ee
SHA1 e07bfa4f9f9ad93d92e721ec47804d67f08f758f
SHA256 2f226011753f849483591a4e5c6f3ffc40701330df70d609bbe60c073449a236
SHA512 501085701b9290d9fb34c8dc725ecd276692ff9c130c98699c1c413aab3d649c9fedff03701e59043d9dedda5c669099ecbf72c9d461b83932960657ad9bbeda

C:\Windows\System32\Spectrum.exe

MD5 1ecd77583d433df5e18a7680408e6cb0
SHA1 b81a8f98ba565e33e29d60840e115d140a1c34b6
SHA256 5a5dab110c32479961c0a80b252aa1cc45f43ed8fda02860bb36b490f7cc00ad
SHA512 35f496832ca7981347c4c3f88edb2fc4780a7677b44455af93f39f69465115662309d633e0f8a5b4607e62eef4a2f3d2a10b8ad611725e0be65fc1ac9d698c1f

memory/4032-322-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4704-323-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1040-324-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a42dcbae77fcd7ccf27dc16ff44146db
SHA1 ec45f1ea700c4a056b11c613923420d6648482ed
SHA256 a13793894a61f98be5110f34466b3ba1282649e15df8423744d6cce4c6ce866f
SHA512 381425f4b016a42edcd0424b31f4f95815fd1dba077fbb03285c40bdbc224333871909247c918efb367463a11936b5e55272458cf220fb0fbeadbf88f85a476f

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 a42dcbae77fcd7ccf27dc16ff44146db
SHA1 ec45f1ea700c4a056b11c613923420d6648482ed
SHA256 a13793894a61f98be5110f34466b3ba1282649e15df8423744d6cce4c6ce866f
SHA512 381425f4b016a42edcd0424b31f4f95815fd1dba077fbb03285c40bdbc224333871909247c918efb367463a11936b5e55272458cf220fb0fbeadbf88f85a476f

memory/920-343-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4144-345-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 173f3f2d9dec2f9110a3fd91af81bbdc
SHA1 f40d12765a3815a400a98a3a922944c8242c8642
SHA256 cd46ab2b235d962e7381dac647b4b352f524ada56a24f4b426e96b962cd1ab74
SHA512 0593b06b9e0c68b60f3fa221866a62cfa501fe76cc49a8059bfc2aac8315c02f0ba1964f0a10f5af8787f8424fc3c7bdc2e9d0cf7d6909b7c85c2080be40cc17

C:\Windows\System32\AgentService.exe

MD5 987d92230e1dbac29ba2c6c94996489c
SHA1 00cd21adbe58becc77be28935b08351165005a4d
SHA256 7e091f30ea2e73868bc1d133e015ccc336d247897699ce365600945fb3f51518
SHA512 110d41484c2334c32b87bf9c5745797b9f2c30004a49cc8d9e40a5dc5b5d86889cd5af41a23229c7b4aff1814598b4eecfb1b1d670e1cc20f0012214f8c52dec

memory/4644-369-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 b25dc443bbfbc038bae8d380fca0afff
SHA1 a7a8749437b39375bf6945fdbf91dc566b42a968
SHA256 5450d18363b1da2eeb130c4567a60537c54b6dc10c6fd4b66a7c6de3fad4707f
SHA512 822adf81d611cc55590bee47ccfdc93afbbe79bb6e3c4bfb900cd41ecf48cf373fdc0a62b1f344fe97278946832209aac77783270b40b896eb6056319ecd3048

memory/5008-372-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1148-374-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1980-376-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4236-378-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 03fb75b9d809087de0f90e76e9fc8078
SHA1 b59f1340ec1bb1b0c40572d0c0a4239bfb029be7
SHA256 de56873a95df7fafd41de003aa9562fa24079a38adb803ba13ca08a05c3f3b61
SHA512 709d2e75bae53a8c499d8f221bef31e248f08759b4009d5a7354225c84c27359c87adeb5feb6a3026e6cf5f5164f497450e29ddd02839d14a83a41302309b4f9

memory/3288-393-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 6de34b4a766d1992484ebe21adf89752
SHA1 7df2bf9815eb46bde3bc8a5cb83003e978304da1
SHA256 cb99e12a48289fe8de37a71330ef99aeee743384bf6a17d89019123b090d58f9
SHA512 2106aa68089bd0163132a3df5a5f9fa9cbb8a8033d534c58c82dcf8bf4981b9ba30f447ac83d8db3f6cd0c231f2210d3db9c260c66b09c8daa9fc0d5ab5961fa

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 19ad9e06d3f290667ac94992c2224f5f
SHA1 9072502810070e50d02b7c79ec18da89903ed152
SHA256 d122b16868cf74bf616cb93ee2ba2dade26e490f2a240e0ee0569f69e60a0680
SHA512 8721c6c3bc850d4254034d2cdfb6ff0e51b12613c80860481f40df4db5d42b1bdb0f39b56a326b2cb82c34c82fc6ea95eccdfbe23a1032c7d5ad054ba63614f4

C:\Windows\System32\SearchIndexer.exe

MD5 20633d2b543817ef7552723a0c0a1a9c
SHA1 a4e80fd128ca1f3de181a40bed74d0d8fd28d38b
SHA256 81b9a85d5522fda75c326b106c4334348626fc2a3aeebb9718f463eaf6f22373
SHA512 ba751c93792f106b6853956ae7d99a24332e6e776d0232962a471ed927af57efeec45b5551b5e53a339aadc84898d80e0831c256da09531205fde52883dcdd5a

memory/1228-417-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4672-419-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3936-420-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4148-553-0x0000000140000000-0x0000000140202000-memory.dmp

memory/4704-573-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4280-605-0x000001E8DC760000-0x000001E8DC770000-memory.dmp

memory/4280-606-0x000001E8DC770000-0x000001E8DC771000-memory.dmp

memory/4280-607-0x000001E8DF190000-0x000001E8DF1AA000-memory.dmp

memory/4280-608-0x000001E8DF190000-0x000001E8DF1AA000-memory.dmp

memory/920-633-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4144-634-0x0000000140000000-0x0000000140259000-memory.dmp

memory/4280-636-0x000001E8DF1E0000-0x000001E8DF1F0000-memory.dmp

memory/4280-637-0x000001E8DF1E0000-0x000001E8DF1F0000-memory.dmp

memory/4236-643-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3288-648-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4672-674-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3936-675-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4280-676-0x000001E8DF530000-0x000001E8DF540000-memory.dmp

memory/4280-677-0x000001E8DF530000-0x000001E8DF540000-memory.dmp

memory/4280-697-0x000001E8DF7B0000-0x000001E8DF7C0000-memory.dmp

memory/4280-698-0x000001E8DF7B0000-0x000001E8DF7C0000-memory.dmp

memory/4280-699-0x000001E8DF7B0000-0x000001E8DF7C0000-memory.dmp

memory/4280-707-0x000001E8DC770000-0x000001E8DC771000-memory.dmp

memory/4280-708-0x000001E8DF190000-0x000001E8DF1AA000-memory.dmp

memory/4280-709-0x000001E8DF190000-0x000001E8DF1AA000-memory.dmp

memory/4280-726-0x000001E8DF1E0000-0x000001E8DF1F0000-memory.dmp

memory/4280-727-0x000001E8DF1E0000-0x000001E8DF1F0000-memory.dmp

memory/4280-728-0x000001E8DF1E0000-0x000001E8DF1F0000-memory.dmp

memory/4280-729-0x000001E8DF7B0000-0x000001E8DF7C0000-memory.dmp

memory/4280-736-0x000001E8DF7B0000-0x000001E8DF7C0000-memory.dmp

memory/4280-748-0x000001E8DF530000-0x000001E8DF540000-memory.dmp

memory/4280-749-0x000001E8DF530000-0x000001E8DF540000-memory.dmp