Malware Analysis Report

2025-01-03 07:43

Sample ID 230501-kwyvwaeh52
Target Purchase Order 202319876.gz
SHA256 a0b3efe8781aed703dc0309955d29b7d4554e722733a556187e9cb16f25dd6c5
Tags
blustealer collection stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a0b3efe8781aed703dc0309955d29b7d4554e722733a556187e9cb16f25dd6c5

Threat Level: Known bad

The file Purchase Order 202319876.gz was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer spyware

BluStealer

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Script User-Agent

Modifies data under HKEY_USERS

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Checks processor information in registry

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 08:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 08:57

Reported

2023-05-01 09:00

Platform

win7-20230220-en

Max time kernel

71s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

Signatures

BluStealer

stealer blustealer

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9efb406547bf3ad0.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A2F45EF3-E79A-41C9-80BF-02A1A643D485}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A2F45EF3-E79A-41C9-80BF-02A1A643D485}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1980 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1792 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1616 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 1580 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1616 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1563773381-2037468142-1146002597-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1563773381-2037468142-1146002597-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 250 -NGENProcess 1dc -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 260 -NGENProcess 23c -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 1d0 -Pipe 1e4 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1980-54-0x00000000009C0000-0x0000000000B3E000-memory.dmp

memory/1980-55-0x0000000004900000-0x0000000004940000-memory.dmp

memory/1980-56-0x00000000009A0000-0x00000000009B0000-memory.dmp

memory/1980-57-0x0000000004900000-0x0000000004940000-memory.dmp

memory/1980-58-0x00000000009B0000-0x00000000009BC000-memory.dmp

memory/1980-59-0x0000000005BE0000-0x0000000005D18000-memory.dmp

memory/1980-60-0x0000000004900000-0x0000000004940000-memory.dmp

memory/1980-61-0x000000000A0E0000-0x000000000A290000-memory.dmp

memory/1792-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1792-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1792-64-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1792-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1792-67-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1792-69-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1792-70-0x0000000000380000-0x00000000003E6000-memory.dmp

memory/1792-75-0x0000000000380000-0x00000000003E6000-memory.dmp

memory/1792-76-0x0000000000400000-0x0000000000654000-memory.dmp

\Windows\System32\alg.exe

MD5 02e929103ec3c72808055ed4d5405019
SHA1 a58c987515840cc8c27c6ebb7e24fd9e557ed308
SHA256 0061b360d8d2839c2b8bc57cf78fb4fca279e917fedd10d9ccf451ec20b03a52
SHA512 43d0a2db329efa865d112ad706609192fcbe42df2d02832f4aae3c909f860fe33cc32c2c7b49c8fef75b10122b9d15621333c9c1a2431b132c566488ef7382c1

C:\Windows\System32\alg.exe

MD5 02e929103ec3c72808055ed4d5405019
SHA1 a58c987515840cc8c27c6ebb7e24fd9e557ed308
SHA256 0061b360d8d2839c2b8bc57cf78fb4fca279e917fedd10d9ccf451ec20b03a52
SHA512 43d0a2db329efa865d112ad706609192fcbe42df2d02832f4aae3c909f860fe33cc32c2c7b49c8fef75b10122b9d15621333c9c1a2431b132c566488ef7382c1

memory/940-84-0x0000000000960000-0x00000000009C0000-memory.dmp

memory/940-90-0x0000000000960000-0x00000000009C0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 644f499d2e2fa61c10d36b179f4bb697
SHA1 0755c8d7191976f773a54c960bcec7ff5e61d026
SHA256 38a5b0fc44189a85fd305ff7181ab40464d2c141fe4720b700039ea78b556735
SHA512 e11ea85526aadd509525bd2195541f76db7eb623dcee06255f229970647f223ea772b7639cd9ade4a5bd39dd5f6b22e861e33a7d239847979fdc936da0f37a8e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 644f499d2e2fa61c10d36b179f4bb697
SHA1 0755c8d7191976f773a54c960bcec7ff5e61d026
SHA256 38a5b0fc44189a85fd305ff7181ab40464d2c141fe4720b700039ea78b556735
SHA512 e11ea85526aadd509525bd2195541f76db7eb623dcee06255f229970647f223ea772b7639cd9ade4a5bd39dd5f6b22e861e33a7d239847979fdc936da0f37a8e

memory/940-96-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/1952-97-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 320e0923682aa8bef1efa7ce79fc1366
SHA1 f2f07933af38c226d68bca3411eacf1f5203d98c
SHA256 14548b3018654df422de033fe71177a353f424d72677b8140ff602172c964a51
SHA512 9d028761be3b0eece23b232bc1bf05ac5c8bc24ea3bf35178bf63094477300e631737f8ac5895553d2967c8571662e38788d9051766950ed0d264f6536522d9c

memory/1216-101-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1216-105-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1216-106-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1216-108-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1216-110-0x0000000000090000-0x00000000000F6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 973f2e69a162cb6c39742103b7bbe994
SHA1 c956c33db9337756afd0c442eb5ca9d70d0c3557
SHA256 17b2d21fe94efc62cbc9e8def6f5ee85e32b6fc96c6cb81fb6ea7a989bc1263e
SHA512 95dab28f7bc47b3369db086c8a7dc60e8217300a1d2edbfaa4f1bb846b1e743915363f7aed19937ecdfc61de5be82e7e2485df226de6183752b006274d2b8d02

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 973f2e69a162cb6c39742103b7bbe994
SHA1 c956c33db9337756afd0c442eb5ca9d70d0c3557
SHA256 17b2d21fe94efc62cbc9e8def6f5ee85e32b6fc96c6cb81fb6ea7a989bc1263e
SHA512 95dab28f7bc47b3369db086c8a7dc60e8217300a1d2edbfaa4f1bb846b1e743915363f7aed19937ecdfc61de5be82e7e2485df226de6183752b006274d2b8d02

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 320e0923682aa8bef1efa7ce79fc1366
SHA1 f2f07933af38c226d68bca3411eacf1f5203d98c
SHA256 14548b3018654df422de033fe71177a353f424d72677b8140ff602172c964a51
SHA512 9d028761be3b0eece23b232bc1bf05ac5c8bc24ea3bf35178bf63094477300e631737f8ac5895553d2967c8571662e38788d9051766950ed0d264f6536522d9c

memory/1216-119-0x0000000000BF0000-0x0000000000CAC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

memory/1616-121-0x0000000000670000-0x00000000006D6000-memory.dmp

memory/1616-126-0x0000000000670000-0x00000000006D6000-memory.dmp

memory/1412-128-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1580-129-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1216-130-0x0000000004DD0000-0x0000000004E10000-memory.dmp

memory/1616-132-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 c491093e856e51c08fc7e0c9a51f3022
SHA1 0939dc30eee7b0c1369fd480681afdc8f09b1e40
SHA256 a40445eee3649b8be6efe338f68b98cb1d531a554af847ce99eeefe5e1e33eca
SHA512 8a0ed3fd831e59e77c5b9a79ae561f22c00627bc56c50c240ee83005feda3a2633b285f1f07dfbd2cb317530972ea5fd9a2918f3d15b9731e3017409731420b5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 ab20f1d3ce6dd3f240ef4f2697e18598
SHA1 beeaa2131f3a1f07ab1b3b30f15be6f524f6a4b4
SHA256 0ba2db85f8e4ab088125e1a509708c5eb016e53fe32ae370573a04a8437009dc
SHA512 81565b8fd011dc51f69627971c88172f84bfb954d48bc4ca1e3e3177ff5a868bafc5416a1b8c32c9f36d49a7cf506e39c376641cf06b298587d43634d0395b49

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 973f2e69a162cb6c39742103b7bbe994
SHA1 c956c33db9337756afd0c442eb5ca9d70d0c3557
SHA256 17b2d21fe94efc62cbc9e8def6f5ee85e32b6fc96c6cb81fb6ea7a989bc1263e
SHA512 95dab28f7bc47b3369db086c8a7dc60e8217300a1d2edbfaa4f1bb846b1e743915363f7aed19937ecdfc61de5be82e7e2485df226de6183752b006274d2b8d02

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 c21cdadde518bbeedff17b207ee5b71d
SHA1 ade09431a4a3c4b54b646fe2fa63bf9ed3fe6095
SHA256 7154366fa89c62bcb02a5caeea08a4a46e7246975b6c54c42d8a62639bf69651
SHA512 fe9df59700a2867e34340d97c1da2951cbfeeeb66290196676c924db1d604b46a78f7be78485d6fe78f288c55152042d68ca33627d31ac2f45b51f4c929a741d

C:\Windows\System32\dllhost.exe

MD5 e0de5392e9f3113f22b099d04291fbd6
SHA1 8aa36ddf93a89d4999317277e537cf256d9c39c9
SHA256 35fcef6ebd37c71d8613e558b17a7ff4573d30939ab4d0fcf1a7775e4222406b
SHA512 ab23a7c2f762149744b78fc56aedba5c157e4f421e659d71854e35fbc4e61b239801ed26582cad3368642b578e78406503d863587c569d6dfd640a34eaf45fa3

\Windows\System32\dllhost.exe

MD5 e0de5392e9f3113f22b099d04291fbd6
SHA1 8aa36ddf93a89d4999317277e537cf256d9c39c9
SHA256 35fcef6ebd37c71d8613e558b17a7ff4573d30939ab4d0fcf1a7775e4222406b
SHA512 ab23a7c2f762149744b78fc56aedba5c157e4f421e659d71854e35fbc4e61b239801ed26582cad3368642b578e78406503d863587c569d6dfd640a34eaf45fa3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 ab20f1d3ce6dd3f240ef4f2697e18598
SHA1 beeaa2131f3a1f07ab1b3b30f15be6f524f6a4b4
SHA256 0ba2db85f8e4ab088125e1a509708c5eb016e53fe32ae370573a04a8437009dc
SHA512 81565b8fd011dc51f69627971c88172f84bfb954d48bc4ca1e3e3177ff5a868bafc5416a1b8c32c9f36d49a7cf506e39c376641cf06b298587d43634d0395b49

\Windows\ehome\ehrecvr.exe

MD5 41760ac08754988372b49424b31e4c98
SHA1 3d308c047808ea6a8db24fbf21b06265809cb4c3
SHA256 2c5e67167761d897e9dc57a4cf290d4b038f6dfca2e04e84eb47b1b5f626eebd
SHA512 bee34fc49b955f26072ffef1e2821c2450d7fa6d48dc97595fd7ba6318774f8152bee2bfe03324591dc735fec1210ea5587a28ea2befedd97d37c383920f9f82

C:\Windows\ehome\ehrecvr.exe

MD5 41760ac08754988372b49424b31e4c98
SHA1 3d308c047808ea6a8db24fbf21b06265809cb4c3
SHA256 2c5e67167761d897e9dc57a4cf290d4b038f6dfca2e04e84eb47b1b5f626eebd
SHA512 bee34fc49b955f26072ffef1e2821c2450d7fa6d48dc97595fd7ba6318774f8152bee2bfe03324591dc735fec1210ea5587a28ea2befedd97d37c383920f9f82

memory/2004-152-0x00000000008B0000-0x0000000000910000-memory.dmp

memory/2004-158-0x00000000008B0000-0x0000000000910000-memory.dmp

memory/2004-161-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1632-160-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1932-162-0x0000000140000000-0x0000000140205000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 8e2cecc00ba49391f7723e666e12fe0f
SHA1 697dd74568531c96e5d4159b3fa6f0e5745b3d7e
SHA256 7d960577843de0209ce1c47b46640b8d665b515521fa5a8547e996b43a209aec
SHA512 333917a83f74e96c53e086e6206df48eee743b933e997a3f121fb1a033cefb3ac22cf028a8d998bc3eaffffe4889b426c75e9ec2049c7cc751c8336b10efd9ee

C:\Windows\ehome\ehsched.exe

MD5 8e2cecc00ba49391f7723e666e12fe0f
SHA1 697dd74568531c96e5d4159b3fa6f0e5745b3d7e
SHA256 7d960577843de0209ce1c47b46640b8d665b515521fa5a8547e996b43a209aec
SHA512 333917a83f74e96c53e086e6206df48eee743b933e997a3f121fb1a033cefb3ac22cf028a8d998bc3eaffffe4889b426c75e9ec2049c7cc751c8336b10efd9ee

memory/1860-166-0x0000000000820000-0x0000000000880000-memory.dmp

memory/2004-168-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1936-179-0x0000000000230000-0x0000000000296000-memory.dmp

memory/1936-174-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

memory/2004-172-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1936-185-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1860-183-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1860-186-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1580-190-0x0000000000B60000-0x0000000000BC6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

memory/1936-199-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 c7bdd8e8f7e7c6c2fea0c0df78f28a10
SHA1 4f59d2e55a945f591a43b26012bbcd8cc5c62211
SHA256 c7699d20883abcd8f79b321363c2879b1dbb900e3ade1c56f94bf6789c6a633e
SHA512 f903d86816107eba0e1d2bb0794e3f901b49472fa60e22a6a06d6b1107421303417d2e12f4edbf930f9afd3872d5afb6512f60a90dbfd52610be81fa76902543

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

memory/1580-222-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2004-221-0x0000000001430000-0x0000000001431000-memory.dmp

memory/928-219-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 b6932b394bbdbc22b2d4f6f7ff11375c
SHA1 0b7e1db3de7036f16eb2bcbe843f3a2e6f58c429
SHA256 ca348a90629473ebd9eefc36718f97c342f38353c18bec5fcbbb319dee10e901
SHA512 a808d0b4570dff4e7535e6e90406be874fc8092427cf6176e6da59761d39aa1419ff1cad9f7ffab6594ec6f60059aea5ea733dcb1fb94974b4686d12632021e8

C:\Windows\System32\ieetwcollector.exe

MD5 b6932b394bbdbc22b2d4f6f7ff11375c
SHA1 0b7e1db3de7036f16eb2bcbe843f3a2e6f58c429
SHA256 ca348a90629473ebd9eefc36718f97c342f38353c18bec5fcbbb319dee10e901
SHA512 a808d0b4570dff4e7535e6e90406be874fc8092427cf6176e6da59761d39aa1419ff1cad9f7ffab6594ec6f60059aea5ea733dcb1fb94974b4686d12632021e8

memory/316-224-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 4be7e19e368fb98aeb35b797e58db257
SHA1 0e0a0793d789d0e5185a04beaa8bcbceba495137
SHA256 d66146d2008f45f599bb74fa6bb6c9809e62f979ef933022807d30eb37e6cb89
SHA512 15bdbad1005f5e72989e2b52e47fc6046ba8a10839cec369ae495fea8295173376047e058fcfcbe790cf9511e73d42a82120465333e5b50c074836e5d88ce158

memory/1696-243-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 fdb99419d5c4bd744c8b2d45d0a4d169
SHA1 f7d0b4e7300775ee713103fb42503a19ff6122e9
SHA256 63b220560e06025edcc26dd5ca299a9d9def39180643d88d23a5e0901bc14c22
SHA512 1cfc62eff96281056d1b59348d29b0f5066a87207dc687d13e12b5e958c1fd0320d984024cb36672955f9ca919b8914f59b98636d505c8012fd71bd963a9063d

memory/1516-251-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 86c172e44ea4bcb524aa9d20f91098bb
SHA1 bc23d6681c842feb80f1af13c4fcbce44d0a331f
SHA256 b1550c1c66151d106a6cf989b6f35e5748dbc78b9fd62231456084ce5b6a229b
SHA512 2cd0d333d54d7778171279cc9bac6604ce03092f12ad03f438666ff406051ea35ab81027fe82e455c5d77e8ae3a418dc7e3b79c5d7d3978efe205d0dea162495

\Windows\System32\msdtc.exe

MD5 86c172e44ea4bcb524aa9d20f91098bb
SHA1 bc23d6681c842feb80f1af13c4fcbce44d0a331f
SHA256 b1550c1c66151d106a6cf989b6f35e5748dbc78b9fd62231456084ce5b6a229b
SHA512 2cd0d333d54d7778171279cc9bac6604ce03092f12ad03f438666ff406051ea35ab81027fe82e455c5d77e8ae3a418dc7e3b79c5d7d3978efe205d0dea162495

\Windows\System32\msiexec.exe

MD5 63de0ce43379c445032a57a088276373
SHA1 890df427b331f9a0272c7b5b00a880cd384b214c
SHA256 86a58bbd3d73f3d79cbc80d0706b1cf2a97f58560a11fea22272660218c7cd90
SHA512 b49d532687dfca98da140156ea57954e8607dee904cdbb0c20c0b2afbe73efbe77f7776cbf11731f66a378bc72e62569a09884475f8f1f79271aaa3aedd70e2b

C:\Windows\system32\msiexec.exe

MD5 63de0ce43379c445032a57a088276373
SHA1 890df427b331f9a0272c7b5b00a880cd384b214c
SHA256 86a58bbd3d73f3d79cbc80d0706b1cf2a97f58560a11fea22272660218c7cd90
SHA512 b49d532687dfca98da140156ea57954e8607dee904cdbb0c20c0b2afbe73efbe77f7776cbf11731f66a378bc72e62569a09884475f8f1f79271aaa3aedd70e2b

C:\Windows\System32\msiexec.exe

MD5 63de0ce43379c445032a57a088276373
SHA1 890df427b331f9a0272c7b5b00a880cd384b214c
SHA256 86a58bbd3d73f3d79cbc80d0706b1cf2a97f58560a11fea22272660218c7cd90
SHA512 b49d532687dfca98da140156ea57954e8607dee904cdbb0c20c0b2afbe73efbe77f7776cbf11731f66a378bc72e62569a09884475f8f1f79271aaa3aedd70e2b

memory/2068-271-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2244-274-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2152-275-0x0000000140000000-0x000000014020D000-memory.dmp

\Windows\System32\msiexec.exe

MD5 63de0ce43379c445032a57a088276373
SHA1 890df427b331f9a0272c7b5b00a880cd384b214c
SHA256 86a58bbd3d73f3d79cbc80d0706b1cf2a97f58560a11fea22272660218c7cd90
SHA512 b49d532687dfca98da140156ea57954e8607dee904cdbb0c20c0b2afbe73efbe77f7776cbf11731f66a378bc72e62569a09884475f8f1f79271aaa3aedd70e2b

memory/2244-296-0x00000000005F0000-0x00000000007F9000-memory.dmp

memory/2276-290-0x0000000000B80000-0x0000000000C00000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 6fba8bb60738086a5d434f975110c17d
SHA1 30c3e8b5c7866237f6b8a01e920d85f6fde98b57
SHA256 4faf3d5c690a23b2d77fe63545eb69f01c47d8c655d2796b070d6f125d864310
SHA512 7ecce394c1f4896708a31a061e7c9cf7645bcc4d01902f91c97eec670d8f53aad0fa92d2c1d63156fc63d7c04076ea459075af8eac6a5e0bd1bb9106aa2a7fef

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 234dd582791d49d25db76e09b717e671
SHA1 dcbf1e5ad0244bd0430756060bdcbde5855d1048
SHA256 02bc68aa7f1798c0338e34dfac81d05ab4380e94a5c08608ed3266cf3b36ea1f
SHA512 b724f9883d3bcbddedf442f789bf5569f185de461aa270234e679435203ab38149901bf6c4dbbd4b1a4234b1577261813083e581fcd3c6052c6282c8c545294e

C:\Windows\System32\Locator.exe

MD5 fbe3edc48f0017dfb3156995517e656a
SHA1 80a36b4261137c3425bd435a20fa103c7c289e5e
SHA256 ed98530aba6283dacd8a8fb52094bbbdcc99b73bbe25bb88e10a92fc3ef22cc1
SHA512 fa46d22d8db555180e6eecf7f83aaf0b34da8bf8e80cfac2ef00af5873c377389ba463c8f287839a5e72e0be08f3f9583d01479241cd281ad94738d7e74b654a

\Windows\System32\Locator.exe

MD5 fbe3edc48f0017dfb3156995517e656a
SHA1 80a36b4261137c3425bd435a20fa103c7c289e5e
SHA256 ed98530aba6283dacd8a8fb52094bbbdcc99b73bbe25bb88e10a92fc3ef22cc1
SHA512 fa46d22d8db555180e6eecf7f83aaf0b34da8bf8e80cfac2ef00af5873c377389ba463c8f287839a5e72e0be08f3f9583d01479241cd281ad94738d7e74b654a

C:\Windows\SysWOW64\perfhost.exe

MD5 bc92a44737a0eed05c7e737bcfa05b4d
SHA1 4d823ea89cdd392b1ce414404bd366f14224305e
SHA256 81f036d53ae6c6fedbe12e84d28bf4e140fa7c9be1a658af543e0546f55ed978
SHA512 1598c4e17e733519c3b31b2fe58d305cd0a17ee867992b8e32a8c40fb53dd651b6b1a93fe21c8f9d1946ba7ea42a16992b6c5e6a5be58f062a4058804741475b

memory/2456-315-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2496-317-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2580-321-0x0000000001000000-0x00000000011ED000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 52a356b7b435387d9f118a61d16abbf0
SHA1 8776413e5a66a18809b756eef4b9cb4db4c65e8f
SHA256 a127ed51d9ae7215cc7305cddb3e0e09769f9783c61587ed0f9352074693ea61
SHA512 0eaf0de74ff344e8b8e64cd7af420ebd29c607936d16220c829ec81391dd90ca0d3e675a86925e177097df56757342615b3fa2a910e00fd1202b98e77aad259d

C:\Windows\System32\snmptrap.exe

MD5 52a356b7b435387d9f118a61d16abbf0
SHA1 8776413e5a66a18809b756eef4b9cb4db4c65e8f
SHA256 a127ed51d9ae7215cc7305cddb3e0e09769f9783c61587ed0f9352074693ea61
SHA512 0eaf0de74ff344e8b8e64cd7af420ebd29c607936d16220c829ec81391dd90ca0d3e675a86925e177097df56757342615b3fa2a910e00fd1202b98e77aad259d

memory/2608-324-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\System32\vds.exe

MD5 0d5e045fca8d0bc8eaa257e719e96b6c
SHA1 051b035b131e5e03335fb1a4fba621673834083b
SHA256 f96081d9cb636caeafe30760a8f3d3d7429f5c30d8e4b20149f5ae30ac4243aa
SHA512 4c7433c827d3f442df151aa4fcda21e715ea7e48706d479859ccfdbf417cc6be1e2bd54ec6302db6cb6d67afb05408916ded63cf4d86a337ff84d7bc826666c2

\Windows\System32\vds.exe

MD5 0d5e045fca8d0bc8eaa257e719e96b6c
SHA1 051b035b131e5e03335fb1a4fba621673834083b
SHA256 f96081d9cb636caeafe30760a8f3d3d7429f5c30d8e4b20149f5ae30ac4243aa
SHA512 4c7433c827d3f442df151aa4fcda21e715ea7e48706d479859ccfdbf417cc6be1e2bd54ec6302db6cb6d67afb05408916ded63cf4d86a337ff84d7bc826666c2

memory/1792-342-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 199fd965e80340903bd17bba8de03829
SHA1 4bddc7a4fb924361d992409bb00c66d4d7923e56
SHA256 87a8d06a07f5be651e8260700570e489c25cbf36efdf82dfc36514359c0511a4
SHA512 1d02e9ac2c0eed3028262239cc858871fa72b74c0afa0f5a071635c6e43e4ab9812c1adb4147070837022968f95ac50c645f506ca4f2ccdcc37933f9b1aefbf5

memory/2696-347-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2800-349-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 bb15756003c7b0ef0da0cd1943079344
SHA1 6ac7a88d1b3dbfe4add98af5aa238c167a7547b3
SHA256 20acbaed430078496475a12763f8962a94edb1d024cdd998df245a8920d92426
SHA512 8d252946cb9180bac4514764435bf4dbc0017e8038c496626051db3b8de72de674c5f205ef2aae87313ac90849b6c4f1e1e8cdfd2116d0d8887ecd2d58f6e711

\Windows\System32\wbengine.exe

MD5 bb15756003c7b0ef0da0cd1943079344
SHA1 6ac7a88d1b3dbfe4add98af5aa238c167a7547b3
SHA256 20acbaed430078496475a12763f8962a94edb1d024cdd998df245a8920d92426
SHA512 8d252946cb9180bac4514764435bf4dbc0017e8038c496626051db3b8de72de674c5f205ef2aae87313ac90849b6c4f1e1e8cdfd2116d0d8887ecd2d58f6e711

memory/1952-370-0x0000000140000000-0x00000001401F4000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 0b655555aecf464c49452fdad2baab1a
SHA1 62312b2cbf171025e0af0aa8013f80c369056ee8
SHA256 52eec11862fd9d1c96a7b3d32553ff9ebc9357c009d8c716929510a66217e7ea
SHA512 da795b335f788586c8f1e2aa73831e3071203a39552afc71088f259b86fb5f3aaccf007c89d3a93338eb114647c4db0cbc6cba95903a1809a91aa0f104894c71

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 0b655555aecf464c49452fdad2baab1a
SHA1 62312b2cbf171025e0af0aa8013f80c369056ee8
SHA256 52eec11862fd9d1c96a7b3d32553ff9ebc9357c009d8c716929510a66217e7ea
SHA512 da795b335f788586c8f1e2aa73831e3071203a39552afc71088f259b86fb5f3aaccf007c89d3a93338eb114647c4db0cbc6cba95903a1809a91aa0f104894c71

memory/2880-373-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2276-375-0x0000000000B80000-0x0000000000C00000-memory.dmp

memory/3008-378-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2084-381-0x0000000100000000-0x000000010021B000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 688d8f4678644fdbdbd032c37e29a345
SHA1 edcbe3ed9d1b49ade0e4b4312ff5b87a5cbe4f06
SHA256 d990789f56d6754dd7bc16d759ca94cdc468d3bd3c88d0a9a7da83df514b8752
SHA512 8818350dabead5d43aa9dbfa6bda46df3dff4f811dcb7aedb71381a751658d2acc772699a04fc2dc53d73c20b7cf41a6b6cd7a20862aeb4ac7eb26b6b348c171

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 688d8f4678644fdbdbd032c37e29a345
SHA1 edcbe3ed9d1b49ade0e4b4312ff5b87a5cbe4f06
SHA256 d990789f56d6754dd7bc16d759ca94cdc468d3bd3c88d0a9a7da83df514b8752
SHA512 8818350dabead5d43aa9dbfa6bda46df3dff4f811dcb7aedb71381a751658d2acc772699a04fc2dc53d73c20b7cf41a6b6cd7a20862aeb4ac7eb26b6b348c171

C:\Windows\System32\SearchIndexer.exe

MD5 60722ce8852f39e54caa843667f6ac71
SHA1 994ca226ca8927bb0209c2c13cec069f0ef54bb9
SHA256 234c7a5d8d7c7207d90104e4d37c51d24986fe0f805742e29f3409d1e80be04b
SHA512 6fef8d7626b32910c62b821073b1eb160db87386f1dda0e3b42a5b42d78323a7972b53b4606b9c19624e6c373d57c95b12f01e1a40eea4d166c3f54aa73f8812

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 688d8f4678644fdbdbd032c37e29a345
SHA1 edcbe3ed9d1b49ade0e4b4312ff5b87a5cbe4f06
SHA256 d990789f56d6754dd7bc16d759ca94cdc468d3bd3c88d0a9a7da83df514b8752
SHA512 8818350dabead5d43aa9dbfa6bda46df3dff4f811dcb7aedb71381a751658d2acc772699a04fc2dc53d73c20b7cf41a6b6cd7a20862aeb4ac7eb26b6b348c171

memory/608-410-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2256-411-0x0000000100000000-0x0000000100123000-memory.dmp

memory/2004-501-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1516-541-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1860-597-0x0000000140000000-0x0000000140209000-memory.dmp

memory/316-599-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2276-604-0x0000000000B80000-0x0000000000C00000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 db00eba02cdd2eadb056f64e63d3f6e4
SHA1 793ff1fb71239093af61d34f5e69ac1550842482
SHA256 1def3fabc184cc09761c5987a01358840cf126b30a17d3bacbd5906275c94f44
SHA512 b2504024342805748bcbe54b21d664560df24470b121115b6af0770ef44fc14193e4d19f0fe01f23be7451fdca85e61397c9746edcbddf2e7650e62c8f9065a4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

memory/2756-655-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1696-658-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2244-659-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2276-661-0x0000000000B80000-0x0000000000C00000-memory.dmp

memory/2244-663-0x00000000005F0000-0x00000000007F9000-memory.dmp

memory/2580-664-0x0000000001000000-0x00000000011ED000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

memory/2756-675-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2496-676-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1936-677-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2800-679-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2880-680-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2084-681-0x0000000100000000-0x000000010021B000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 96b6d586fafeba36adadc08a10ab10a8
SHA1 59c82a47eaf4e190bfb99db435b57435c14fddb2
SHA256 20838927e9d68b84633d5d287555dc0d034b837d662f635a71c1af28bd7fd8c4
SHA512 e3adbc69b2e2d1c4f2c4628b0e7037a93a8238e480622074e0b4f42a16f5a6c2a409b0f944f30e4ecc81a4d8cab4dea9e335ea00bfd8f5beeb57c931de87737d

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 08:57

Reported

2023-05-01 09:00

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\68c49c3a9a2815e1.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c6c63ee1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000538319ee1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d310e5ed1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ecbc2ee1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000978b7eed1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076f6b8f11b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048fdb2ed1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006909daec1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7f58bee1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000312dc5ee1b7cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4648 wrote to memory of 4416 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4416 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4416 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4416 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4416 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4416 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4324 wrote to memory of 2904 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4324 wrote to memory of 2904 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4324 wrote to memory of 4256 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4324 wrote to memory of 4256 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 20.42.73.27:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 52.152.110.14:443 tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.248.3.254:80 tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 36.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.248.3.254:80 tcp
US 52.152.110.14:443 tcp
NL 173.223.113.164:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.152.110.14:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp

Files

memory/4648-133-0x0000000000900000-0x0000000000A7E000-memory.dmp

memory/4648-134-0x0000000005630000-0x0000000005640000-memory.dmp

memory/4648-135-0x0000000005BF0000-0x0000000006194000-memory.dmp

memory/4648-136-0x0000000005640000-0x00000000056D2000-memory.dmp

memory/4648-137-0x0000000005630000-0x0000000005640000-memory.dmp

memory/4648-138-0x0000000005630000-0x0000000005640000-memory.dmp

memory/4648-139-0x00000000074D0000-0x000000000756C000-memory.dmp

memory/4416-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/4416-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/4416-144-0x0000000000400000-0x0000000000654000-memory.dmp

memory/4416-145-0x0000000001460000-0x00000000014C6000-memory.dmp

memory/4416-150-0x0000000001460000-0x00000000014C6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 53cd8e0838976d0f3dee9c411b6730b5
SHA1 ffea31beb4b556407e2d78aa4b0b9404133fffdf
SHA256 15685cc13ec9fc774c8a9189638cd1d524b70a35fbf1d6af1afe04f055bb94b3
SHA512 48bbcd6ca8fc2cee60b43a232293e2efa329949812f634d71fd7606bd6c9b0c21b10b71aa722ec2194da58eebb23e0d19a5c524002fb4a87cf2d18178d612b7b

memory/4628-157-0x0000000000560000-0x00000000005C0000-memory.dmp

memory/4628-163-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 1bacdd7fd63185919fa704eb3c23316d
SHA1 5ad456641b02c81525540db3ec4ffb574dd02222
SHA256 2a249a6481d578bf5d09e34428ef4a34eaba75b4bc1307ef11fef6fdba8b330d
SHA512 1046abc4d821bf3d3840f9852766a250085df53723d3f69d94999395cb9bf9b8eb3614c0f86f16de868ff009dd97a976489d2bfc55c8e501c345c2a8250a05e4

memory/340-169-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/4628-172-0x0000000140000000-0x0000000140201000-memory.dmp

memory/340-175-0x0000000140000000-0x0000000140200000-memory.dmp

memory/340-177-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 e6e797d1c3c1bb32e075a4e247de8da9
SHA1 4c8817700d10250f6cae6488031360aa5c3a8638
SHA256 0dda03d592873240ccdf2e2641cf9553943e2df519494ea6f9469e03452f3650
SHA512 75ea80d2fd460832cea853c970a54d6776532615110424352b55983e431039116838592cef26cd8013547f3b8783df45001e381b89872fb2aa8886a998f81bcc

memory/920-181-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/920-187-0x0000000000D60000-0x0000000000DC0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 c76f141345b0934a4971d64d0840e834
SHA1 9578aada0e2aa318ce8184fe29052e308b35abbf
SHA256 55ae2a9625cae3f1071e1a945262f3767c9691d1a69ec696aa103151dd9ec791
SHA512 1fd791730eb8c0a49b287bc354f0f13ea03c04dfb546020e1cf06819ea42764801c6bc6cb8f8ace62b4c0a57de17757ef216840daf26b2cf56313b0896efe813

memory/4368-191-0x0000000000BF0000-0x0000000000C50000-memory.dmp

memory/920-195-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4368-197-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4368-199-0x0000000000BF0000-0x0000000000C50000-memory.dmp

memory/920-201-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/1400-203-0x0000000000720000-0x0000000000786000-memory.dmp

memory/920-205-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 e40b088615a0df0b4c00e247a0de3467
SHA1 aa8500cba50d2ec9f8d36ffb895068d1c71a542b
SHA256 1626c2db98ac4e01c69333bee425d7bd010e4b44f5ef2f4fa448361670c22c65
SHA512 073470e4181b105cc8b018c450f119238062b179dbab2a7cdc59926563601e98b28e646f84de4573a0219df71cf2b210e387593911775cc624992f9942e1a1a0

memory/1260-207-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1260-213-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c38d3c2d2c7835ff0ec057fbf8db29c4
SHA1 eb57754c33c6ec5accda82e3127278164dcaf5b1
SHA256 93e0a1cedddd011495eb87e72762aeb625ac30521e2ccbea4eba1e54adec6258
SHA512 b25ebce47894611ae42761a332e3d107cc57364b06edd26749f7fc32718ea1b4d2e20f60f7703ecb639fa065a90ba1160965780c925f00ab7949fd2a547ae583

memory/1816-218-0x00000000015A0000-0x0000000001600000-memory.dmp

memory/1260-220-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1816-222-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1816-226-0x00000000015A0000-0x0000000001600000-memory.dmp

memory/1816-229-0x00000000015A0000-0x0000000001600000-memory.dmp

memory/1816-231-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 4ef1da1c39915f93f50e174ecb8c3b89
SHA1 c1181844e366a0018b1f2114f8aba80e85a42540
SHA256 6f7ef4abb5bd8b4adde34f7b5bf89c640cfe7c3e739b568ad16457621bb39bdd
SHA512 8b531b5f00af73e1f5e109b53b2301d6ff3770caf52f0b74404e18b2213a6cfa421a2479681205d6e93fbee55f704263a8fff3e74ade872201136d44da910863

memory/952-234-0x0000000000CF0000-0x0000000000D50000-memory.dmp

memory/952-238-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 31f8815d08c9db0d755a88548f7fd11b
SHA1 eadf6ee5b3e350f9fa57465fe93e727c10037178
SHA256 904bcf64ba25a00dd24fd8885da91e8c6ba8ab89a53788f54b101f8feec12abf
SHA512 b95f87ee12085ce9ecb1d43ede12192f39b91a3a3cf2a43f252793078685cbbac9dcdab32f1af635a22e3db1f1cda98f90f4f525d12b01c0f2d3d06a665c3ae8

C:\Windows\SysWOW64\perfhost.exe

MD5 66d7613351bb4bf3366153e2832cb5dc
SHA1 2f9810d86e4968177ee1d1988e1bfa8b888a1b88
SHA256 0f81a5f233ad0f3723e8fc3519548093d42133b39a7da068ea79cb65b87b92c4
SHA512 9a37cc98b03f6779d31ebcf615817503ce3088838aa30bac64add6bdc94711275269d6f9f1c79bc506aedb80ab609916952aa2cfb46ec9a30490771f1c9b2a76

C:\Windows\System32\Locator.exe

MD5 bed3b3214f5ac0f1f08fb60d8e0bc903
SHA1 c3dff68a78b4be898f0ff0921ab350d6bd052294
SHA256 d358f37af938504f5d65269a05fd9e3498d37314f90b4271dc451966c3a1ce9e
SHA512 650b9df2ea188d9246f2f4c3173e607d1c6d89c77e582c67b8e472858cfa3c4da0a3936ddea89ebeb899222e1ca1f61a33c3473b8d81c843d2de3ff1f1abbd26

memory/2532-276-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3652-277-0x0000000140000000-0x0000000140202000-memory.dmp

memory/644-278-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 27293a2cb1e8afd6fd09af639227ab7a
SHA1 3b510077333b36015d19f685bf7a3bd72156322a
SHA256 0e818c22506fc296c6e3519408dc10e018a1031a601c9fbfd4fe2493240c165c
SHA512 80f270f3539efdaeab9c65724242e9ae24f055f3758ed749281a7b2c9b7c2428659db1f8e7547027cfe43946ecf5ac59293b70af62827dd86245398a30915d2d

memory/3020-281-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 01bdae02971f6f6380b6033cb36b0400
SHA1 1a45243c4cf3b11843ff18a06e4795299df4fb87
SHA256 e7e71e0cbf90ccf0b465cfcd6bbf1164bb8cc13ec29ba59b4c731ab86eefe7d0
SHA512 bb30540ce6f4c0f49cc0401f9af428e8ac2ad93d5483f8d5bcfa5f40f1696230990120d9beb9fb3642b0ba65b4dbd58c6ea58c12984253982072514c32d0ab75

memory/4596-301-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2312-302-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 1b5b7a6111bd18f81f8304985d67c654
SHA1 67041171d32bf14016c4f3bb638f3f3ea5fc6016
SHA256 e0ce79576048c7cc236e16efb041291c9768a5f02a25a76f9190523ee6478f34
SHA512 bdc950b06675b71361c1d1dd1b1bcc2954f4552856a20acc7264b7a27c69b5d7206c3e9e88608c66c910c6f21bb262ab799b17ba12cd126e031c60e32c4028a0

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 43a50ce7408a3386724521f73fc1a984
SHA1 797387e4e224a6970953cce0de97a14327ca8d0d
SHA256 0d1ad5b971ed0ad1d6cbc094d28e3c55a285eb85fcf8682cab8a4ef67a383e6f
SHA512 955284d1d3dff2a36431e394ee989939a9eaf8d78e2797988ce4275c3886af2fdaee2f5de231e0c5081a35c2a7ad9950f5ab8fb208675d39c5351a7761dee9af

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 43a50ce7408a3386724521f73fc1a984
SHA1 797387e4e224a6970953cce0de97a14327ca8d0d
SHA256 0d1ad5b971ed0ad1d6cbc094d28e3c55a285eb85fcf8682cab8a4ef67a383e6f
SHA512 955284d1d3dff2a36431e394ee989939a9eaf8d78e2797988ce4275c3886af2fdaee2f5de231e0c5081a35c2a7ad9950f5ab8fb208675d39c5351a7761dee9af

memory/2836-319-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5076-321-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 ab85fbe538007161a9b73d1c5aef3cce
SHA1 6fa5244433d143a1d1fffeb330b7a604e05ce150
SHA256 e6609ce6662167c64902c2e370b290bb46386da4f7a033a12928427314089e41
SHA512 9df3e6a3cd3dbcd4688bbaae801025c9f5eabcde5ec140e1fac221da2994f1c5924b99125a4ecf63669e484d96c4f91ee91a6e097fc1320389ac9732e7b5660c

C:\Windows\System32\AgentService.exe

MD5 b4f6c67ef03fceb9291e593070b27391
SHA1 b9210f59af21e46d1193728e03d1c8bf310158a2
SHA256 5c3697817df8e2da3cb52bcc59745061e07aa6164ea347f81461a9eb661eed69
SHA512 e5135cb5b0b9e63c900fac9d9d032c845dca2f1e85daa4513c9937fbcf321114a26716c072ab279b4f7a1a647981cd59c6117e78e08b39e8070e907465afb50e

memory/1780-346-0x0000000140000000-0x0000000140239000-memory.dmp

memory/3708-349-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 64a18d21b0d75ab31d5584755c79640c
SHA1 db81af77c51d6651c46714c6e6f9dbe6366e2f15
SHA256 6adc6bd9898641c8a0592241e466f2cd7aa5df134fa244b3ec94a3e813963c19
SHA512 47a8c7a7d0c9ccf77a338a966bcdc536fb113e59e51418b09fbc873cdedc9433edadf03a40e2881929917c77ae8e1c38b72df4eefcdfb1e54ca2a93a8c108492

C:\Windows\System32\VSSVC.exe

MD5 e8aceec3888445244f567a11f6007892
SHA1 c170a91bc78c915d8933951027c90169fa1e3431
SHA256 bef31180e22612ee5333707fd3a452942bb3c8e9d9f3b001de9fa9df59aea3a7
SHA512 86b315378803c32847238afe2d76cb2dafe442144d0b90a732fcc3f1635280d18ad1c3aad0e72ea29aee5dc12b61fe7fc93e0b941c85e96916481cc4614ce337

C:\Windows\System32\wbengine.exe

MD5 6d87bfa816b7a83790326f1f0bda2f2d
SHA1 c82559f9f0beefb17e1e721fd016b97ad915c10d
SHA256 434218e2a015a0f290754a3edd4b993825a81fc7168ca47b274713d414329519
SHA512 f5174dd7a9951981447a183cfd034d0d356c0f937d8f84c2cfba9171354686914eb30a34f66765b09dd6578665684a5b8710f1efef8142d851f38bd5f48137ed

memory/3372-379-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3436-380-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4956-381-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 b2e5c654dc98ce6119a021efc9fb1820
SHA1 be811bcc07d1a036dfe1fa9b4e51b8be65c13e31
SHA256 df076b52f1ef1c01ef4fdf7cc43affc361c5e7252c95320626e3ecfb5e594d53
SHA512 1f824b7b23569f177d51ca84f4dd1b0c87b645334294bcb314226ee55741a442dee22fccb61b4302646acc5c45f73a64562def93bb7257a392139782c141a3f1

C:\Windows\System32\SearchIndexer.exe

MD5 e1623412b9ac4282fa02955affee3295
SHA1 60cde4ee51ba82a23d7314489882b794ca50e5ad
SHA256 dc9239919807ea6ea99285d93b0480d08f915b03908348e290f0150f64e0c690
SHA512 78f0b5d44629906b1f305823e299f9c872fb284edb324b9ed9b5e98d632f6cd6fb27ded90d08dfd2b33466a7dc89909ee19ffbe93e4ce3f28ca7c41e04478c82

memory/4416-408-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3912-412-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4324-414-0x0000000140000000-0x0000000140179000-memory.dmp

memory/340-440-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4368-458-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1260-462-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4596-467-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2836-470-0x0000000140000000-0x0000000140169000-memory.dmp

memory/5076-471-0x0000000140000000-0x0000000140259000-memory.dmp

memory/4256-520-0x000001FE76140000-0x000001FE76150000-memory.dmp

memory/4256-521-0x000001FE76160000-0x000001FE76161000-memory.dmp

memory/3436-522-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4956-523-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3912-524-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4324-525-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4256-576-0x000001FE76160000-0x000001FE76161000-memory.dmp

memory/4256-687-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-691-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-692-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-711-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-712-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-713-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-719-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-720-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-721-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-722-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-725-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-726-0x000001FE76380000-0x000001FE76390000-memory.dmp

memory/4256-727-0x000001FE76380000-0x000001FE76390000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 6f8853f976ea4181a0fa4adc37024241
SHA1 e63e956c1cb0af67ef4742b0ac673727f74bbf25
SHA256 7633e074efab9599540f060d76f6b4b52d3a1734ed9db350e60af4318fed9e50
SHA512 14b6865265a6d29518ec8dd7292e7dedd8e7b5a95d90c8355e8eab912ec2ed521c7e9f72e9c279142f1f057fbff3fa4aa28e9327b9a42166254903ec8962dc46

C:\Windows\system32\fxssvc.exe

MD5 e6e797d1c3c1bb32e075a4e247de8da9
SHA1 4c8817700d10250f6cae6488031360aa5c3a8638
SHA256 0dda03d592873240ccdf2e2641cf9553943e2df519494ea6f9469e03452f3650
SHA512 75ea80d2fd460832cea853c970a54d6776532615110424352b55983e431039116838592cef26cd8013547f3b8783df45001e381b89872fb2aa8886a998f81bcc

C:\Windows\system32\SgrmBroker.exe

MD5 852c3bcaed1f2fbf7e70f7c24b6b28fb
SHA1 866e6bbf2be4bb8c1389c4c1d6e75d6b01c88995
SHA256 d1b51990df0ddd0436793e783290a9a025130560a3c20ecf40ebb92bd06e4c71
SHA512 3d3dbf07871039eeaa70b6e6b93c7f6bc48e9d474dd44bce4d42fceaf96154bb69d2524f1888b3eb35bb74b66b3990165476f10c1eb6b07adb1a828967fa5a8e

C:\Windows\system32\AgentService.exe

MD5 b4f6c67ef03fceb9291e593070b27391
SHA1 b9210f59af21e46d1193728e03d1c8bf310158a2
SHA256 5c3697817df8e2da3cb52bcc59745061e07aa6164ea347f81461a9eb661eed69
SHA512 e5135cb5b0b9e63c900fac9d9d032c845dca2f1e85daa4513c9937fbcf321114a26716c072ab279b4f7a1a647981cd59c6117e78e08b39e8070e907465afb50e

C:\Windows\System32\SensorDataService.exe

MD5 27293a2cb1e8afd6fd09af639227ab7a
SHA1 3b510077333b36015d19f685bf7a3bd72156322a
SHA256 0e818c22506fc296c6e3519408dc10e018a1031a601c9fbfd4fe2493240c165c
SHA512 80f270f3539efdaeab9c65724242e9ae24f055f3758ed749281a7b2c9b7c2428659db1f8e7547027cfe43946ecf5ac59293b70af62827dd86245398a30915d2d

C:\Windows\system32\msiexec.exe

MD5 ee0b3815d43b88bb032b17d75818e831
SHA1 6981b54cdfe8da2c33d5b37e884352845a189a0f
SHA256 01a5672c4632dd52b3f371eca24ba4960ee0eba486d9a712c0ca8202e1585ee5
SHA512 5c43efb9c8b54458e62af0f0773df3a3405171ebc8494644b614ea001502bdf7a9b61a1fdeeed1a6b74ce077b0a0895511d96dd609d8e5554bd3f01d89574899

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c38d3c2d2c7835ff0ec057fbf8db29c4
SHA1 eb57754c33c6ec5accda82e3127278164dcaf5b1
SHA256 93e0a1cedddd011495eb87e72762aeb625ac30521e2ccbea4eba1e54adec6258
SHA512 b25ebce47894611ae42761a332e3d107cc57364b06edd26749f7fc32718ea1b4d2e20f60f7703ecb639fa065a90ba1160965780c925f00ab7949fd2a547ae583

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 ec1e8130cca290e8b9f2b6d25778728c
SHA1 2af384cb7dc5d14ced629b2a723cd955f0909ae5
SHA256 b74d46b9ba094c7084a79e6d691dc365fd3e825948e4962c430583f87692f743
SHA512 349ead487d7ba80221e34009d1f1278815e9ec773ec3098b529cd33fe27bb5f7bc8677c1f15f029eb9aeac052d6d68e3c93b1ac3d096661c8927f21b52ce5847

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

MD5 f6950bbf9aefff5ca61ad9cb221e0110
SHA1 fc42694b73143869ea9b93ef88fb69a071d90150
SHA256 11edea6c2da4b68989355fbf43da103e287feb4ac5a946ed7b59d192e55346c7
SHA512 6aad79270a69f71b646aea2841a213d2654ba27e7d9093030ebcf747c68d8451eb1494423455fbec47d2967b4415efd874aaecf2d2707b800d862083c87dcbf4

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

MD5 86a944bcbf7185aa5aae32d4c53b9244
SHA1 9b6ae45765d1014e099b16ed6d731d6d43f37d54
SHA256 deb84ef4d75182e1cd6631dd44bc5f16807e04847e9e54f81d99e32c2703fc61
SHA512 bb5b0cba4a802999dc2bafb5f242309a2504df54202391b9b5a4a49ec3605356c638992825aaf089ff6a544bcc175b68d847fda0dc1886e9a5ff53e5661efe5d

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

MD5 c78f4d7da75514bc2b8b6898992d48a6
SHA1 df259c360e144ffd4f98d42c7c95ae3b8738b25c
SHA256 9e9bc6d2b36ed9604270154c702c0f17e790575430ba6105fc5bb46e29652164
SHA512 42f8439bae6bce249a0df1bfe63e1f2ac86999999914ea7d6cc5095e844ee1e7eb6504dfea3df9bdf7dc2397a2a400cf2d8187ef907f0c2280178ba5bc37e8bf

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 41652e1a4346f832e3807f7975a2f781
SHA1 1095141140aaac823fd78a7fedd3b172cd88372f
SHA256 bed502d3e46e489f9a7893cef84d6918b220db23e164509b24dbdd526bee1125
SHA512 816e1607cd55966d0e9ea0d808133898559057f4519f20e0e4f848ac1d88dc960a2fadb65a8328e31e86d8f2a02f748a25ecadfdf602db2121ed84e7310fb431

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe

MD5 d7665bcf44a6fd7be475687665c60405
SHA1 74fe1338c665fa0784b66b4717ad4be797480697
SHA256 27f9934efe9b5d95b05db5d1ee1daf34a6b9e55f290e6bc01eead15071dafb3a
SHA512 43d29db6c5d4829f6fcf097394fff39e56e392364d5719fadb4899baf508ee4a856c0a52916c1490747a6eec5eff1ddd9d9fc79ad1c55d09c790683479d736ca

C:\Program Files (x86)\Google\Update\Install\{71ADFEE3-430E-4776-83B2-F32638BD7B7F}\chrome_installer.exe

MD5 3f253068ec8fae8d9a8acda85f1776b2
SHA1 730b6ed42b6c6d4d457596eb05b120382702e243
SHA256 89a73d694b6fa3108ac09f56d33b89003a29b0b6e9ebd864f49125b6fecaf2a9
SHA512 2be39cb55e037bb9cd9c10a71ae8cdb2d90cc4cba8447dd410da491feccb47d2c485a7b76cace66b73ee34acbd619ab7957eaed164a7bbf25c4ee2b74def8675

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe

MD5 0dbf51f40824e1955d7e91f6e2e3156f
SHA1 110bbaca9f043474a46bd8932c867e3c915beec0
SHA256 6808f17b9f5d61eeae0a121ffb6f42eaccee312e0ef7308e12349c0adcaaa4a7
SHA512 13a0a877b9fb7498c33c0a1cd21290710313d42697df7f9182957112d2893dc5709f904894ed62681840c793a7c4b010ad0831d499f681fe242be2dc86e663c6

C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe

MD5 fa9836035452614e4251a61fe5bb23e4
SHA1 db780e9aafc531d84cbf8b3ee10009f9d8354941
SHA256 a5d02094960b585449fdb0866ee4e3552e17d5c5d33be724299e4ee638b5a34e
SHA512 cec12aee99d8e7ba8105890c5eade7d42f7b89796d193e104aaf87f4a4f8241c36c4e09ce0d7fff6edc7a6c2334ecb69f02352b35991c04b77d4dc06f6f94143

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe

MD5 4e5d055c1fd3f962819c109bfdfb220b
SHA1 249e74a420f83aaa83d7dff3ac10c5fda31a6803
SHA256 a1e57c2296bd663411dd3e4be16242f35392136eeb9295f959c07fdd0293e05f
SHA512 ec4a0f79d6ed14f27e5e64b16a15c455ee584a036b7f7588261526d35759a69c417f1f7bd7a766c75f0359977393d30567e061755fe9876803d27104a17da15a

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe

MD5 54811f2194b75a38118c923a2f34a7c5
SHA1 6d9f0c078854a6b92546494d039d673b963135e7
SHA256 b9b68c27405ed37f6f6300518d36a1ae61ab919c26aa2318be64fbcce6bb6358
SHA512 664f48d2ebdfa5f407627afdb19dd496c2b4d528b080f5e76f64805a092ad814c0cb759cca107d8bda812b7d8ee0aeaae670348ecdbe8a11a4f0a7f526da809a