Malware Analysis Report

2025-01-03 07:55

Sample ID 230501-q2accsff56
Target 2492-140-0x0000000000400000-0x0000000000654000-memory.dmp
SHA256 ef241b30e7e55b276b860ee69841d5062ecbe09d9bb5c156c03e2029730730a9
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef241b30e7e55b276b860ee69841d5062ecbe09d9bb5c156c03e2029730730a9

Threat Level: Known bad

The file 2492-140-0x0000000000400000-0x0000000000654000-memory.dmp was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

Blustealer family

BluStealer

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Script User-Agent

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

outlook_office_path

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 13:44

Signatures

Blustealer family

blustealer

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 13:44

Reported

2023-05-01 13:47

Platform

win7-20230220-en

Max time kernel

151s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3d4d6f8d7693df14.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1088 set thread context of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{DAC84675-37FF-4FBE-B599-BD322F822B5F}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{ABF43BA5-245D-4C9D-8E27-0E41B4AA15BD}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{ABF43BA5-245D-4C9D-8E27-0E41B4AA15BD}.crmlog C:\Windows\system32\dllhost.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{243A3245-5F50-4F21-9DBC-0EAF16DE7C7A} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{243A3245-5F50-4F21-9DBC-0EAF16DE7C7A} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1088 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1680 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2512 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2184 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2460 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 1432 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 3028 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2240 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2248 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2248 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2248 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2248 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1680 wrote to memory of 2144 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe

"C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f8 -Pipe 244 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e8 -NGENProcess 260 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 264 -NGENProcess 1f8 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 26c -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 1f0 -Pipe 184 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 264 -NGENProcess 240 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 260 -NGENProcess 1ac -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 25c -NGENProcess 270 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e0 -NGENProcess 274 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 278 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 280 -NGENProcess 248 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 1e0 -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 288 -NGENProcess 248 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 280 -NGENProcess 1f8 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 28c -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 25c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 248 -NGENProcess 1f8 -Pipe 1ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 294 -NGENProcess 1e0 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 29c -NGENProcess 25c -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 260 -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 1f8 -NGENProcess 288 -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 154 -NGENProcess 15c -Pipe 168 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 154 -NGENProcess 15c -Pipe 16c -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp

Files

memory/1088-54-0x0000000000350000-0x00000000003B6000-memory.dmp

memory/1088-59-0x0000000000350000-0x00000000003B6000-memory.dmp

\Windows\System32\alg.exe

MD5 66d85b19c777b6da1743f2a14ff8c78b
SHA1 8ce0d15bb1fd86d4835cd4e1b7dffe6697399044
SHA256 a422586d5adaaadb8acbb9eb4d441dd304538f15c11f169884fae83e69b748c5
SHA512 e8fb09a3cdf6fc701babb2d3258fe5dbc1ddc57493d12df272fd7a7f0baf28fbf9271ad61fa171afb85120b183a23dacad6b35526bf7a02f1fb348fd7d91e074

C:\Windows\System32\alg.exe

MD5 66d85b19c777b6da1743f2a14ff8c78b
SHA1 8ce0d15bb1fd86d4835cd4e1b7dffe6697399044
SHA256 a422586d5adaaadb8acbb9eb4d441dd304538f15c11f169884fae83e69b748c5
SHA512 e8fb09a3cdf6fc701babb2d3258fe5dbc1ddc57493d12df272fd7a7f0baf28fbf9271ad61fa171afb85120b183a23dacad6b35526bf7a02f1fb348fd7d91e074

memory/524-67-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/524-73-0x0000000000890000-0x00000000008F0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 e72bf688acf24b7a61d364a3a7cbd2a7
SHA1 7642390dabd2dd3365094661632bf69867c52c8e
SHA256 b77ed0ae755011db0d55dd38a21d796a3d036e45a05898ff1e2a9ba1e34d5f79
SHA512 a80276606d0071e5e92105c47db3eb413412ec3ca20c4979761b8aa8761aadd8823c99e4ee3a319205d0e0adc4110bdb6ccc5c27af3a2f5165062ebcc2b95d3d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 e72bf688acf24b7a61d364a3a7cbd2a7
SHA1 7642390dabd2dd3365094661632bf69867c52c8e
SHA256 b77ed0ae755011db0d55dd38a21d796a3d036e45a05898ff1e2a9ba1e34d5f79
SHA512 a80276606d0071e5e92105c47db3eb413412ec3ca20c4979761b8aa8761aadd8823c99e4ee3a319205d0e0adc4110bdb6ccc5c27af3a2f5165062ebcc2b95d3d

memory/1088-80-0x0000000000400000-0x0000000000654000-memory.dmp

memory/524-81-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/1700-82-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 05c328debdb7c238b3daa84e9f1d4e85
SHA1 1bb9f96721095ef22c3d0bef3a2a93d665692969
SHA256 05606365c065b0f539a446e0e0492dfa6777a16fcceae50a1f25b917eda5a733
SHA512 d576d8363a7fb236f9b8e7b1e9c6a575efc88d3202e0a7b52470140364ba0eb33d113249e1f10b514589e2e6b2151787ec7b4bf8b6068544539b8a12da309ee7

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 05c328debdb7c238b3daa84e9f1d4e85
SHA1 1bb9f96721095ef22c3d0bef3a2a93d665692969
SHA256 05606365c065b0f539a446e0e0492dfa6777a16fcceae50a1f25b917eda5a733
SHA512 d576d8363a7fb236f9b8e7b1e9c6a575efc88d3202e0a7b52470140364ba0eb33d113249e1f10b514589e2e6b2151787ec7b4bf8b6068544539b8a12da309ee7

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7f0e4014300695d2a15180ce06bc3fb1
SHA1 dd2db445aa013b4f8dc9b6192c8589852ad22639
SHA256 93ae652fb810cab71fc844b1ba0b53a688ce433f49a40e8c7dd3fbcf8a4e3e14
SHA512 35a0d002b1ce73ec630c242a4a2b0074b8bfe3cd5dd71b7121b568846f440234beecae26954fb4a37a33a9a125999cdb8044531d876777103df8d833fd520f60

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7f0e4014300695d2a15180ce06bc3fb1
SHA1 dd2db445aa013b4f8dc9b6192c8589852ad22639
SHA256 93ae652fb810cab71fc844b1ba0b53a688ce433f49a40e8c7dd3fbcf8a4e3e14
SHA512 35a0d002b1ce73ec630c242a4a2b0074b8bfe3cd5dd71b7121b568846f440234beecae26954fb4a37a33a9a125999cdb8044531d876777103df8d833fd520f60

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 7f0e4014300695d2a15180ce06bc3fb1
SHA1 dd2db445aa013b4f8dc9b6192c8589852ad22639
SHA256 93ae652fb810cab71fc844b1ba0b53a688ce433f49a40e8c7dd3fbcf8a4e3e14
SHA512 35a0d002b1ce73ec630c242a4a2b0074b8bfe3cd5dd71b7121b568846f440234beecae26954fb4a37a33a9a125999cdb8044531d876777103df8d833fd520f60

memory/1440-97-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1440-98-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1440-99-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1440-102-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1440-104-0x0000000000090000-0x00000000000F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 0c19a71accdf24ba46c821992b9e9105
SHA1 51b68627ba4f1c4b40304bf23ab050e24ea4ad72
SHA256 35db02df5677920f611761c016932d2aec28f72a8c19a43a19af5b7a592de506
SHA512 7cb2d634fd88fcd92a8cb8c8beb611f868621471f410aa9c162ba158194d862a60fb51e6bcab1a75faa25ae76336003a6f417c0d47b9d9f1a60719aac7c6caac

memory/788-106-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1328-107-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/1680-109-0x0000000000230000-0x0000000000296000-memory.dmp

memory/1680-114-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 5dac04edf0b787d71875f7eb4b6614b4
SHA1 433bad1c5269e11c26122d3232c42ffa98ea24e0
SHA256 359604ed6282ae791d14de810058cb0483c45669d4490f149d32715a831c2615
SHA512 6c15d0d3aec96e4ce45bc94113e44f2fe3ac8755a979faf57dab313c58d5e983376055279ec72d4d0d3a78bc23deff303751149609f3774b21e9c6e3aa1c00ac

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 631cf1f5d679c5b273d0d0bfb421bd58
SHA1 d241feda4f2b9f90672b1787ec6292239acc7bd6
SHA256 3724f241da0000eae98602fdbaaf08877b3579a7b80e334394ac138c26f84615
SHA512 755e366bf07f395ce7e76f69a683a5d184c856a5db2a6d06a61fbb084d0bf76ad18f9b0adda7f7e870d7a74c85d21b4c33d8c3834e8911d309fb18e45c994333

memory/1680-123-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\dllhost.exe

MD5 0226486f4eccc69d857a9b27f2546fce
SHA1 b310987edd1c6b51d8df09ddf4ab61a0265e7add
SHA256 f0fd5ac4a3eeaf74bfcdd29dc3321de49ae4ac2286f008318d9a738666d57324
SHA512 2d458ebdcaf9a539e0da60a49c1441aaadcb64b61efa0416ab74deccf77adb8194e4993d6ad582c0447136c47f4c80d38b1d71020efa3ee9f4bec2a45fea4178

C:\Windows\System32\dllhost.exe

MD5 0226486f4eccc69d857a9b27f2546fce
SHA1 b310987edd1c6b51d8df09ddf4ab61a0265e7add
SHA256 f0fd5ac4a3eeaf74bfcdd29dc3321de49ae4ac2286f008318d9a738666d57324
SHA512 2d458ebdcaf9a539e0da60a49c1441aaadcb64b61efa0416ab74deccf77adb8194e4993d6ad582c0447136c47f4c80d38b1d71020efa3ee9f4bec2a45fea4178

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 631cf1f5d679c5b273d0d0bfb421bd58
SHA1 d241feda4f2b9f90672b1787ec6292239acc7bd6
SHA256 3724f241da0000eae98602fdbaaf08877b3579a7b80e334394ac138c26f84615
SHA512 755e366bf07f395ce7e76f69a683a5d184c856a5db2a6d06a61fbb084d0bf76ad18f9b0adda7f7e870d7a74c85d21b4c33d8c3834e8911d309fb18e45c994333

\Windows\ehome\ehrecvr.exe

MD5 e21bd3d1238fe3c5c0cc1176f8fb8ec0
SHA1 3e776db09410eff9fd9d65ca9d4c5b3c9dc1cb1a
SHA256 d95dc634b68c9ba7f6ee4ec6ac56fd48f11d67f804947c4350f0cb62575ce46c
SHA512 538e49e7d7e701a0ad3d60f20da0f6446bbb217af42fabfe689463e81c6224cf09be9932212ef2b44c44d022fa15d5c44747c3c0e6e2fdd7820bcfaa79aa5d0b

C:\Windows\ehome\ehrecvr.exe

MD5 e21bd3d1238fe3c5c0cc1176f8fb8ec0
SHA1 3e776db09410eff9fd9d65ca9d4c5b3c9dc1cb1a
SHA256 d95dc634b68c9ba7f6ee4ec6ac56fd48f11d67f804947c4350f0cb62575ce46c
SHA512 538e49e7d7e701a0ad3d60f20da0f6446bbb217af42fabfe689463e81c6224cf09be9932212ef2b44c44d022fa15d5c44747c3c0e6e2fdd7820bcfaa79aa5d0b

memory/1732-134-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/1732-140-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/1248-141-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1160-143-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1732-145-0x0000000140000000-0x000000014013C000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 ea368de5b6f0eafaa95185e92c277389
SHA1 8733f7e8eb5cc4ebf323a96e949b9d8f11fa3254
SHA256 80b634526d8da89298158d5629038edd1bc82dc4ee043352902791559787b72e
SHA512 9c591f95260946e6d7802c7a71285df53ac8b8b9ea5c84bc585645884a2e16aed84b0dfcea756e1ef8c06c249ffdc4e40e43a234a2f59b0899498b7816415c43

C:\Windows\ehome\ehsched.exe

MD5 ea368de5b6f0eafaa95185e92c277389
SHA1 8733f7e8eb5cc4ebf323a96e949b9d8f11fa3254
SHA256 80b634526d8da89298158d5629038edd1bc82dc4ee043352902791559787b72e
SHA512 9c591f95260946e6d7802c7a71285df53ac8b8b9ea5c84bc585645884a2e16aed84b0dfcea756e1ef8c06c249ffdc4e40e43a234a2f59b0899498b7816415c43

memory/864-148-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/1732-150-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1440-151-0x00000000005E0000-0x0000000000620000-memory.dmp

memory/1440-154-0x0000000000D30000-0x0000000000DEC000-memory.dmp

memory/864-155-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1732-153-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/864-159-0x0000000000870000-0x00000000008D0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d4fed718140ce2f7fc8169ae48c01e4e
SHA1 44b0fd767eeceab8bc08b88068528532fdaf3a86
SHA256 8d753765b6b03fce3e121e991b6248a34bc92ffcb8bab64862232cb46564660c
SHA512 4803891ccd78ea1f2617fb279a6ca5d079c932b7d4110accbe42b35e750ee0e17f87f2758efd1328465ba1d2c42f2fe8f159ddb220cff9667dd9e8c0c5ad08cd

memory/1196-164-0x00000000003E0000-0x0000000000440000-memory.dmp

memory/1196-170-0x00000000003E0000-0x0000000000440000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 fe28d822dcaef881de9be92320d3d356
SHA1 30b87d6b611a74280b59a8f10a5b0fc482320d94
SHA256 ccbc7318632fe6763ff8a0751858ad309eac918cf07fb235c85d70c86a5966b6
SHA512 fa9fd013d9c82b804ec03c7021404366e5eaf2c1bddc095edd014ca7d794ab44a41d4546aef27013f31392565f7dc2054608072b1eaec5e1b6fa5e552f23cc64

C:\Windows\System32\ieetwcollector.exe

MD5 fe28d822dcaef881de9be92320d3d356
SHA1 30b87d6b611a74280b59a8f10a5b0fc482320d94
SHA256 ccbc7318632fe6763ff8a0751858ad309eac918cf07fb235c85d70c86a5966b6
SHA512 fa9fd013d9c82b804ec03c7021404366e5eaf2c1bddc095edd014ca7d794ab44a41d4546aef27013f31392565f7dc2054608072b1eaec5e1b6fa5e552f23cc64

memory/940-175-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/940-181-0x0000000000440000-0x00000000004A0000-memory.dmp

memory/1732-183-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1196-184-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2012-185-0x0000000000D60000-0x0000000000DE0000-memory.dmp

memory/940-186-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 62e59e88539dd6a1abd64004eb743c8e
SHA1 d692de6769835a3236eca22a6e94c5d9e15e8763
SHA256 2973141bc5a85c2bfb2a355544181f73480d58e1fdb97d087210887c700098fd
SHA512 96cc126eeed74c54c1bd2b4f6ab38d7e34f93e036711af51ded5bf1b1759db356d9b96aa4e02a02ce60e9996f0a1a638356f3c558adc665904b080d9d1dcf08f

memory/1664-192-0x0000000000AE0000-0x0000000000B46000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/1664-208-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2012-209-0x0000000000D60000-0x0000000000DE0000-memory.dmp

memory/912-210-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 82ef859af7b153bfa6fce685e1a86418
SHA1 f3857294331a1cb1db9bfd9064a5f8ab56b116fd
SHA256 7caa3f55ad29e48082a86a2bc552401d8aa1d63ac19dcd5bf3ae4d925197b6db
SHA512 b6816460cb48e31f3265858639f967e1a4bff59ca429008a725ff7b720ad00897e7a2aa8bdf20049616d233f6f7364878acbd753d21a749636e817dd577767da

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/2128-226-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2204-227-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msdtc.exe

MD5 94066eb54b297d75a2697ef31f78d137
SHA1 3e4a177ace460e18d620c784a17ab1268af33ee8
SHA256 e66f78249d9d42b8e59aa653c9440f6620d7658dbba4ec9491b9324867be4fba
SHA512 69e34e80f3694f932a292446e59d41a507676f069986dab2f9adaf0d05123d0a2932d9fab45bee3dfcedd72d3df7ff39ec333ac4a383acb8733ad38a7f4fc4ac

C:\Windows\System32\msdtc.exe

MD5 94066eb54b297d75a2697ef31f78d137
SHA1 3e4a177ace460e18d620c784a17ab1268af33ee8
SHA256 e66f78249d9d42b8e59aa653c9440f6620d7658dbba4ec9491b9324867be4fba
SHA512 69e34e80f3694f932a292446e59d41a507676f069986dab2f9adaf0d05123d0a2932d9fab45bee3dfcedd72d3df7ff39ec333ac4a383acb8733ad38a7f4fc4ac

memory/912-246-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msiexec.exe

MD5 c3d13dafd5f3564303344164e209b216
SHA1 301f79ad8683d0b2b31cc94b7a4dd4f0f6439855
SHA256 70dea84792b76db8459c7be54006eb167e858ac18dd535ed1f99123bbaf55361
SHA512 cb321c74ffe213819b1b2b2e0a009adb2c8ed20e61f2e6904c59196af30f675493cf7b51ded018497f16f74588fea652c77865f313cb9799527c026f8f1ee6ba

C:\Windows\System32\msiexec.exe

MD5 c3d13dafd5f3564303344164e209b216
SHA1 301f79ad8683d0b2b31cc94b7a4dd4f0f6439855
SHA256 70dea84792b76db8459c7be54006eb167e858ac18dd535ed1f99123bbaf55361
SHA512 cb321c74ffe213819b1b2b2e0a009adb2c8ed20e61f2e6904c59196af30f675493cf7b51ded018497f16f74588fea652c77865f313cb9799527c026f8f1ee6ba

C:\Windows\system32\msiexec.exe

MD5 c3d13dafd5f3564303344164e209b216
SHA1 301f79ad8683d0b2b31cc94b7a4dd4f0f6439855
SHA256 70dea84792b76db8459c7be54006eb167e858ac18dd535ed1f99123bbaf55361
SHA512 cb321c74ffe213819b1b2b2e0a009adb2c8ed20e61f2e6904c59196af30f675493cf7b51ded018497f16f74588fea652c77865f313cb9799527c026f8f1ee6ba

\Windows\System32\msiexec.exe

MD5 c3d13dafd5f3564303344164e209b216
SHA1 301f79ad8683d0b2b31cc94b7a4dd4f0f6439855
SHA256 70dea84792b76db8459c7be54006eb167e858ac18dd535ed1f99123bbaf55361
SHA512 cb321c74ffe213819b1b2b2e0a009adb2c8ed20e61f2e6904c59196af30f675493cf7b51ded018497f16f74588fea652c77865f313cb9799527c026f8f1ee6ba

memory/2408-255-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2252-257-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2408-259-0x0000000000570000-0x0000000000779000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 e347d13f2c0c2163561207289bf2c0c7
SHA1 10bc1c54def601665b8094d151aa43aad4260a50
SHA256 5a08fe51b5a362b0caff090a97c22645b0acb8b9884bac535b22075ea0a28555
SHA512 1fb394bfa5b5aa43e9fe1535198739ea684976d8f05bcc8a330f9c2ffde74c19e808df85ed417f5ef4c33cc975d961951ab742a25613ad457d79eb83b4d86029

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 d9655c324a37f0f7e4a1f9005d900559
SHA1 c18a69f6ee852b49ba64ea48a72934603409f7c6
SHA256 418c2d72b22ebeb6196bb189a12d42b8c36bf92ed7d12fc280d4eb1b2d856c55
SHA512 9aa4fae1af6d3ebb3ebf2177ed62681e468ea103311574c14f3d1e3f82c3c29f6c0f670df04d9426bfad75235b9839557413456141a30f067e8ef09a2f45e99f

memory/2204-282-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2012-291-0x0000000000D60000-0x0000000000DE0000-memory.dmp

memory/2512-292-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2556-294-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2660-295-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 e22e6217f624accd9b82f38cb984c457
SHA1 246231a6be9bca47704a8a5b6d05743eae9f7180
SHA256 a666bffc0a40122093417327fe7ec27e3dbb0c6b3ddb80b966fa710b6d7c64d6
SHA512 5c2beb682c77be3f2ac48b83b49bd0614445d6381c92990af8fa9427a73f3e1b9b8f1108d7fe10c706b980fbb3f135ee1245e931df7395b620ec1d5a407293c1

\Windows\System32\Locator.exe

MD5 a884a672e0c25b9706a2e960fe538b32
SHA1 b094e1e658562bf882c0c7e2fa5f3a3143e06611
SHA256 bbc17dd6d0b436b5cf8635ddde95688eed8eeb346eecbfe81bcce879da5aef8f
SHA512 b40157ee1c0e478646913033809cb0856d4cdfa93d0334024ecfa917238f113a5b185a5b1c98d06aa8e2d81b14d3be23cf3020370e88c5086fea30e8c20ce082

C:\Windows\System32\Locator.exe

MD5 a884a672e0c25b9706a2e960fe538b32
SHA1 b094e1e658562bf882c0c7e2fa5f3a3143e06611
SHA256 bbc17dd6d0b436b5cf8635ddde95688eed8eeb346eecbfe81bcce879da5aef8f
SHA512 b40157ee1c0e478646913033809cb0856d4cdfa93d0334024ecfa917238f113a5b185a5b1c98d06aa8e2d81b14d3be23cf3020370e88c5086fea30e8c20ce082

memory/1088-310-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1700-311-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/2800-313-0x0000000001000000-0x00000000011ED000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 fc78e65e425f45a754395684a9d64eb7
SHA1 bdb939059d05aeef5aadfad0e84d950d13bb9ce8
SHA256 7c068256c91f9c7be78f53d53fdec3775dff21c248bbc2c9a060b266166c11c6
SHA512 8a3aea0c5d3dd87818fb4405555b4c8c20e02f82e2e64d7a9197e5ced84cecc685be108cd27f5cf237cb74900f933d6d312b2315d43d892d02b6808bbce1de8e

C:\Windows\System32\snmptrap.exe

MD5 fc78e65e425f45a754395684a9d64eb7
SHA1 bdb939059d05aeef5aadfad0e84d950d13bb9ce8
SHA256 7c068256c91f9c7be78f53d53fdec3775dff21c248bbc2c9a060b266166c11c6
SHA512 8a3aea0c5d3dd87818fb4405555b4c8c20e02f82e2e64d7a9197e5ced84cecc685be108cd27f5cf237cb74900f933d6d312b2315d43d892d02b6808bbce1de8e

memory/2828-316-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2128-325-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\vds.exe

MD5 74fe0bd07d7d3300ba5813ada020342f
SHA1 9a1f52e7d3f2efe505edf2e68387b478f2b28199
SHA256 a019c6721f84f54a851f708db4f4ed4f97e9032a995e9f1e3c7ec34aca0d2c63
SHA512 d9c0eb127b202f75554416154b5d9f4dd5070076d95f4afeaba600a4b9d19f2b0604b456f4227f67913717b9903501613f18ccc59d131839bd2a06f31ea1d2aa

C:\Windows\System32\vds.exe

MD5 74fe0bd07d7d3300ba5813ada020342f
SHA1 9a1f52e7d3f2efe505edf2e68387b478f2b28199
SHA256 a019c6721f84f54a851f708db4f4ed4f97e9032a995e9f1e3c7ec34aca0d2c63
SHA512 d9c0eb127b202f75554416154b5d9f4dd5070076d95f4afeaba600a4b9d19f2b0604b456f4227f67913717b9903501613f18ccc59d131839bd2a06f31ea1d2aa

memory/2908-339-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/3008-340-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 73c663e86d3cc63749a096af1957dd5d
SHA1 3227590cb84c5a81d427dd08cb5b6731a65df5e3
SHA256 c3b046b529984c08921a8dacf2a5e93a6385f5b0dc32226713f2e94196e8959d
SHA512 ede4e862989f934d74f332d4d344a0a052c37bf8a139372974ae765c1d257cd9f861375bbc0498a2217d10b3183420549a21868cf1e47133fdf76ec2fd629961

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/2512-360-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\wbengine.exe

MD5 420ef50ec441fe3269c0d841c398e8e5
SHA1 5a50310b4b27d72afc2bfdabc954780fb0fb6377
SHA256 e45958905bb3df9a3180a826447a22161bb118a806602761490a4eb146413500
SHA512 abf12e33da03fa0f3ac0e0d314dbeeb318c4c82e4fd240dd3efe1f59602de6139755782b5caabb1c7de0062a6e4d41fc18d3aa0039e4ec574a4fe4ee78f20c48

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\System32\wbengine.exe

MD5 420ef50ec441fe3269c0d841c398e8e5
SHA1 5a50310b4b27d72afc2bfdabc954780fb0fb6377
SHA256 e45958905bb3df9a3180a826447a22161bb118a806602761490a4eb146413500
SHA512 abf12e33da03fa0f3ac0e0d314dbeeb318c4c82e4fd240dd3efe1f59602de6139755782b5caabb1c7de0062a6e4d41fc18d3aa0039e4ec574a4fe4ee78f20c48

memory/2124-369-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2184-372-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 8c0361f61f04352c48ade8d9a8639cdf
SHA1 9e275babdb6eb59e75d997d3e9cf2428a845ef5d
SHA256 dcb26afa8b53413d944fe7a5010d56258ee8e9ad10ef7e0c25de835138ad783f
SHA512 f6c3490c8f2ea077cd561c80f00ad2fdb60a1bb0257a1e7ad63a9959a425ec90ea4fec3903dd2472de099ef94c5e5739f42951916bc9bca3624a0d5f53c6c181

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 8c0361f61f04352c48ade8d9a8639cdf
SHA1 9e275babdb6eb59e75d997d3e9cf2428a845ef5d
SHA256 dcb26afa8b53413d944fe7a5010d56258ee8e9ad10ef7e0c25de835138ad783f
SHA512 f6c3490c8f2ea077cd561c80f00ad2fdb60a1bb0257a1e7ad63a9959a425ec90ea4fec3903dd2472de099ef94c5e5739f42951916bc9bca3624a0d5f53c6c181

memory/1732-388-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2416-390-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2704-393-0x0000000100000000-0x000000010021B000-memory.dmp

memory/864-397-0x0000000140000000-0x0000000140209000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 5c8fa9ef4664ee4f1ffacbaeb471118c
SHA1 c72fc3b4a2d224af170dd97720e3b32921205e33
SHA256 88c5039875ed84f1c5b6388bc71bbeabfe145d0a8c351022ebe1f626e4ac7214
SHA512 6c61276857975d80f1dad0c7e0bd0168c161a8fe095c76f959ed7a8feaa1d8e8512464421a2dcb22b77db4c9e5bf8e0ccccdf34dbac0aada6a0bfef4fbc7a5de

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 5c8fa9ef4664ee4f1ffacbaeb471118c
SHA1 c72fc3b4a2d224af170dd97720e3b32921205e33
SHA256 88c5039875ed84f1c5b6388bc71bbeabfe145d0a8c351022ebe1f626e4ac7214
SHA512 6c61276857975d80f1dad0c7e0bd0168c161a8fe095c76f959ed7a8feaa1d8e8512464421a2dcb22b77db4c9e5bf8e0ccccdf34dbac0aada6a0bfef4fbc7a5de

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 5c8fa9ef4664ee4f1ffacbaeb471118c
SHA1 c72fc3b4a2d224af170dd97720e3b32921205e33
SHA256 88c5039875ed84f1c5b6388bc71bbeabfe145d0a8c351022ebe1f626e4ac7214
SHA512 6c61276857975d80f1dad0c7e0bd0168c161a8fe095c76f959ed7a8feaa1d8e8512464421a2dcb22b77db4c9e5bf8e0ccccdf34dbac0aada6a0bfef4fbc7a5de

C:\Windows\System32\SearchIndexer.exe

MD5 3dda240929a77d6bde1fbd27ab95287d
SHA1 619b6a3956c9ee2614b10a31b71fac6c200d5d5c
SHA256 24a67b9a21e319655d417fbefab59d7c1ad475806916e4388d01b9f5f442c328
SHA512 527c493277fcfda7898026265ec03b589e4d85b160b71fc27340246a993753a68e2e2829f5e7c56d249be78a3ae068150da87ea603333e01fda18a3709400193

memory/1196-415-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2092-416-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2864-418-0x0000000100000000-0x0000000100123000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/1664-493-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/1688-497-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2408-541-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2408-542-0x0000000000570000-0x0000000000779000-memory.dmp

memory/2660-543-0x0000000100000000-0x0000000100542000-memory.dmp

memory/940-546-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1536-547-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/3008-548-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2124-549-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2704-550-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2092-557-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2864-558-0x0000000100000000-0x0000000100123000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/1688-601-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2460-602-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/2460-624-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/1508-644-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

memory/1432-649-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 68fb0599c1f173f24a0f4f602057ac81
SHA1 cbc3560050772234cfb549fe21cbce1a3563cc4e
SHA256 3acddb895a7bed5af33a72e38095e2d1233d1525db12c1f435f354f092c29977
SHA512 191963cc4a18ed7bb3106476b1fc1836cdbb8d2342f72736e9418bcae5cbc228c795bd017c24efcaf5fae3210ed3d4fc731bac73bfa8fa3697b8697f55f08a91

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 13:44

Reported

2023-05-01 13:47

Platform

win10v2004-20230221-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e5b6b505c9ce9937.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2404 set thread context of 1880 N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{989CBEF4-A34C-4AE5-A19C-57B2F66BB278}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b74c72f5437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edc2e1f3437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000692987f3437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000339078f6437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000719918f4437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092d83df5437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000175aa7f7437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000719918f4437cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe

"C:\Users\Admin\AppData\Local\Temp\2492-140-0x0000000000400000-0x0000000000654000-memory.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
NL 167.99.35.88:80 przvgke.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 24.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 40.125.122.176:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 20.189.173.3:443 tcp
US 209.197.3.8:80 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 1.77.109.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 40.125.122.176:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 76.74.6.107.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 61.13.50.169.in-addr.arpa udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 40.125.122.176:443 tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp

Files

memory/2404-133-0x00000000023F0000-0x0000000002456000-memory.dmp

memory/2404-138-0x00000000023F0000-0x0000000002456000-memory.dmp

memory/2404-143-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 a9a53d1c621687dd68f8c27233a589f3
SHA1 e740fad86bbcebf5dc855dadeac831f042f36e0d
SHA256 f86753ced1d9e0a20631c462f290d06b49e650211c8d684835fb1b9b4bc279bb
SHA512 2f85a8c7bfd0e0ad5e0472f308a92f745cdd49d6ffac2024c6e023cfc6556de79908a985acaafb0c4b947807874fa721e8347338e9986919e6522be5a4a6d97a

memory/3492-146-0x00000000004A0000-0x0000000000500000-memory.dmp

memory/3492-152-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 a60a65b50b19834b9a71cee2e8e7c256
SHA1 02a8bb1c3a690e5d52d07c449778340d1e402f10
SHA256 3bdaf8b7c6c326fbf304d6ab152d4abf4406188b8973a7ff01cba9a0bb183dd6
SHA512 a8b33387c542d1d9f94983a25339d6ea09c0ed9dfe6e241e6ddb03385690e035cfebb46df0ffc230ea869ec50a293b2c730af38e25a3b2a85abb40721d731677

memory/816-158-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/816-164-0x0000000000670000-0x00000000006D0000-memory.dmp

memory/3492-166-0x0000000140000000-0x0000000140201000-memory.dmp

memory/816-168-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 c20de2bd823b9e511c36874faec81e8c
SHA1 fbcf64eec686af0b95495e15b907d20364880899
SHA256 a5961c9992e21ff58e3e14ea83792dc7b0f5746c54f7866501254c7acf45f55b
SHA512 0229c7698f6f7efc8bb76e792a3b341d0627e6e962466c2ee787e857293aa4b1b660b18c9eca36bb5b632af9a5879518a9a1edaaa64b2874ca94fa1558de4fc9

memory/3400-170-0x0000000000EB0000-0x0000000000F10000-memory.dmp

memory/3400-176-0x0000000000EB0000-0x0000000000F10000-memory.dmp

memory/3168-180-0x0000000000BF0000-0x0000000000C50000-memory.dmp

memory/3400-181-0x0000000000EB0000-0x0000000000F10000-memory.dmp

memory/3168-186-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3400-184-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 be69b417cc21cd07f9c866019cdb9dd3
SHA1 16705146796d281001ac0edaf3722f9dd9f58094
SHA256 09d76e1278cd24ecbb9e3a2822c4297a7204d8bce8584d1c4a299238dc79df5e
SHA512 34f90ed75947cd31f0844c9898b657f452f953ce7d3bff0d909a5da8782d55486520cd143c6a9957dc6ee1977063ab22d75653d03e0b66b8b98d80ce88faa740

memory/3168-190-0x0000000000BF0000-0x0000000000C50000-memory.dmp

memory/1880-193-0x0000000000340000-0x00000000003A6000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 6dbb77c042a1be4be6d5a7694decc487
SHA1 25d7361a6154fb9078abab697903a463de5efedf
SHA256 d41c7b405ecbd067db2f37cd8ba1fd4957c499a12c4c93d26afc595a9a717f17
SHA512 4af34e7ed537f01d0d8ee29d72e161986d84ed77eab2f71b179784c8bc63d4665c1d58afa078f18aee401f2b789ac57b09cc1fbfd8b501ee030799699741181c

memory/2684-195-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/2684-201-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 619eab066adad24ccf3cd6edc6c88d2e
SHA1 48e876556dc3bd223617ab5838f69226e04b3237
SHA256 97b61a91ac597de74d2206097865355dda6c94087290672b7bf8009934378a70
SHA512 5110eb96603c0633f2bea5dfcebdcb022bfc46d060737a1e5666b7507ff9b1723b9c3eae03c8b1e39cc46181e2ef621ec9ca7b09ae28138cde5eb9bf3751223b

memory/3920-205-0x0000000001ED0000-0x0000000001F30000-memory.dmp

memory/3920-211-0x0000000001ED0000-0x0000000001F30000-memory.dmp

memory/2684-213-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3920-214-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1880-215-0x0000000004F30000-0x0000000004F40000-memory.dmp

memory/3920-217-0x0000000001ED0000-0x0000000001F30000-memory.dmp

memory/3920-220-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 05d39d94b0e5c367fa76d915e11c6bd2
SHA1 fe02f0cdb99658ccac1d27b7df2cd3eadfd8eb5d
SHA256 2a13479b5c5818289164c421f5e2b198dea446de662f3b157aaed131526f3001
SHA512 c98c08581f77b3224a53fda115c56b28dbf5591ea62bd870b1e41511103686a7db975bfd10208a1f21df5beae6e1a64776716c203476362d297f345ede0bd618

memory/1880-222-0x0000000004E60000-0x0000000004EFC000-memory.dmp

memory/1028-224-0x00000000007A0000-0x0000000000800000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 a61944346d04685775821d32e5d2c0a2
SHA1 b21f2337f7a51d3e62ea5ac9e188f98a91c0f59d
SHA256 7052e1327ae60908c79f588896f2e0a5fc24288398384476b03955011b54c9ae
SHA512 3aea46812ce9b2c27fd9d1215b2a404d248f6ffe51605359d1aba95c9cb117c0f4ae00e46809ad565fbb74a631dd5a625ffa77783d63e1e4a44827716730ba81

memory/396-236-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1028-240-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 ed60cc965515813046d37d9c568f166a
SHA1 7677099a8c14f4cd19fb3c5bb2900c04968a0951
SHA256 ed883c581845703606cb4d987350657bcdffdd22432fb3b7a78491f582f8084f
SHA512 f5a4e8376c3fc33fe7874cf38a582b6618940e73c364c550d2d3f1e013371ab15fc507a37373b0d88abcf9b1638be6dbdf991b20d32b46f2d5403dc119ca8065

C:\Windows\SysWOW64\perfhost.exe

MD5 0c7bc97ad1d0edd8c813359038b71b54
SHA1 838ddfa3d424acb8de1239f7eb72f0bb1b3d256b
SHA256 8800e6b5194ffad2cd843558d61cd0a7345b7bfe737fb9d122a01a0638bbbe1a
SHA512 9e104a7b3ced5f822a093e7cd245a8aeb8e6c40c50cb2d07c8674b816bc5af1899c7e215b73bee83e56fe65855e6cf7cfbbcc96b8ec088c44cc3c4bbae16cfb9

memory/1044-261-0x0000000140000000-0x0000000140202000-memory.dmp

memory/3992-263-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 979e69ffa16593c9878883360fc1e5f9
SHA1 f47c5e806eb35d7934b51327e378480c0b4bdd7d
SHA256 091f528b8eec0fb19f2f1b3dc52dbfa93df1d4862c4c48c93ee21f1116d2690d
SHA512 135110b2caaab1756faea1ca57891a63a91173978f2c6b9282af457056bddec47127c66f57d0db586d1f4b6118218e8f2014bb8de39e5ac754a5291112687b32

C:\Windows\System32\SensorDataService.exe

MD5 bd5ce4bec137e4552ca74c07dc2d8196
SHA1 c17eb5f3f3015bd790a6f41ef3f401618ccb4b6d
SHA256 60e4b750b8fa8b9acb331e1c3bb507dbdd60da9b3911a6aea731dadd6b1a18bd
SHA512 a6ec87774fed387ecc503d2b0a028a9b121a8083c50f292442111ed3b40d32a60aff512c79961ec5850c44ad129d129fc3af912686b8ecbd3adf62601ff4b89b

C:\Windows\System32\snmptrap.exe

MD5 fe6268b3d169b8153736e04bb819510f
SHA1 3561a445d243252eebe50dea11b9140d6e1e148f
SHA256 60e26bd7205ffbd548b338074ed67d147b242b9260d0a525fc9fe7c6d26b6fe6
SHA512 8ceefc1112a6104dcb7dc7bf35bbb4cceafe445271326f2973af7e04b9cd3d145254569ded0839d403ee121e35d46911e61a7fecab600cc02f499f2cd6b335f7

memory/2180-293-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/872-295-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4724-296-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 0e448fa659f85778f41561aba7ceb98f
SHA1 927aca6aaa9dc1f892683c985e7dbf731a52593e
SHA256 ae1482af5fc76e981406f777ad4ce70ce0577122698c37b3ca9591acec6aa83f
SHA512 4fb0f3173bf461dd2e7f5acca1a4e547e1494c1b2ff48bb8fa26ef66491aeaa31a7048f825338a2b688c44b546fb8921b5073ffe790677f47a71213ec4547828

memory/2436-314-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 e57d61a9fb2898277a0946da158af412
SHA1 f6460c08e9d295aff0198a05f592c187c815c8df
SHA256 5dbf74a2243f71ae02220e1ec847ed72a5297c4ed559e92918fe0a796292a415
SHA512 6ef6e15c665430fe51fae62ac554faaaf155f84ab65798756fbccb0eff6a18e0e33a625b87e4b56168474af393e2b6382e61d1f200d1e6bc77165349203ae1f8

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 e57d61a9fb2898277a0946da158af412
SHA1 f6460c08e9d295aff0198a05f592c187c815c8df
SHA256 5dbf74a2243f71ae02220e1ec847ed72a5297c4ed559e92918fe0a796292a415
SHA512 6ef6e15c665430fe51fae62ac554faaaf155f84ab65798756fbccb0eff6a18e0e33a625b87e4b56168474af393e2b6382e61d1f200d1e6bc77165349203ae1f8

memory/2040-317-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 6b08da517f9a4cc779e3f01f153d0c54
SHA1 5981ae51ce24140f7dbe94c84ccef7ede577ebe8
SHA256 d1927fee66a757412b6536f1a81cb847e8c9661205eec88a9685536e3c59b1ec
SHA512 e170f091780939df38d3046e3c7ad5f25b3f47e65bc43fb98c7a9f4a0d7cc9d74ce8198988ffe79b6391e58f525f2f6261fdfc64108b0cd717e35ff84790d015

C:\Windows\System32\AgentService.exe

MD5 f85a335172005af3c755214ef75f6518
SHA1 29cbd67974902fdbd407dea3feb539cb669c6970
SHA256 82cd171997d9457e864aea1adc40bb4952f507cc1b58150be73c74a6de08180e
SHA512 ad25edc58286aa6a8b68e2d1970188ce5e56cbb84c94ff11d624c3a670288d026ac1115b8a26fb0ba5ddebc90ee27cf57ab0fc0346c2e51340c253e794c44191

memory/4040-341-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3384-339-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4040-351-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 7a773c6c9bdb0354c2664ff05db1c1aa
SHA1 22af40c6b90b5d50f5152e9c0ce3cd96861ce3a4
SHA256 3dcd5107466b49c43b5254c5c72dcbdfbce1e33a140e6c8f7630a6775c2bbf40
SHA512 539e2bb52b135690886f9eea1e8e3c69adff94a5d82ff1ac8d1632fcaa1780916edcdf3243ef3d7582190e2eb44bc844c982246b512ecebfd3a2dfbbe9d66795

C:\Windows\System32\VSSVC.exe

MD5 339faffbb6fa3ee555a407cf844e55c7
SHA1 d3f811b40e0e6cb62ab12b7518ee95891f986865
SHA256 b01bad283d9e1319698cc5275b04cb0909e46c1f0c04fe7a87f493d5c3ab2ccc
SHA512 6f1e1f265a118fa8e8e0ab806cdd2419cd7e8a6a47b57501c19ad3c937db90d531fb27fc71802d840ee1276b6f87bc32cdfdbe145c18fe35f2f98781b67d4d41

memory/2404-363-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1488-365-0x0000000140000000-0x0000000140147000-memory.dmp

memory/5052-367-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 c97a60cbab6931bcac28bb9985c42660
SHA1 a3dd99ec2dc0ebd2773a9627845760efa7c039b5
SHA256 58879c879741f8f5b96023d6f1ce3a02fb8ca506a7bc51bcd6017d46c4b6b16a
SHA512 3bd23347c93a326738f9824db22377f332818c96fe12e3281519a8e60026e8c9bd7fa8405c134a3793df9387be808a6864c4b79d3d11c072c5558305baf5fc3a

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 271f2fd6be8fb8e03515997042a4f2db
SHA1 e79ca827fa0541b94b567e9d8792616c70669de8
SHA256 6186ee4d71ff545efc314efb4d7dc5a75999c99991d7f6292a5b3518f09f6781
SHA512 26a00fe40e06fb5db0560176b8c9d4fb118452bbce5b74a9e9073ee00008f3070a27c3aada82ba7637f147c7d5862d9b4b5aee3242cba2f20f81358d6c7cbf8e

memory/4460-394-0x0000000140000000-0x0000000140216000-memory.dmp

memory/5088-396-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 11ee30860e5cc9641a3b6d8a80eaed5f
SHA1 1e4c725ee258c2e85b3cd5af433fa6cd2b9e4a7e
SHA256 329116003f824c6310138b5ce416661b6f2fcd07554750e9549ec871ddfbde76
SHA512 5a67401c05f938023603f48e4138a07cf2ee6ba875da0d98ad8ead0281aef2bfc9163a557f7e66b15266b7b8702085bee5e89ebcff2d3878f49cab3dcef58f5c

memory/3168-448-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2684-449-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3912-451-0x0000000140000000-0x0000000140179000-memory.dmp

memory/396-562-0x0000000140000000-0x0000000140226000-memory.dmp

memory/872-574-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3992-582-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/4724-583-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2436-585-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2040-588-0x0000000140000000-0x0000000140259000-memory.dmp

memory/5052-600-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/5088-601-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3912-615-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3144-641-0x000001C652E00000-0x000001C652E10000-memory.dmp

memory/3144-642-0x000001C652E10000-0x000001C652E20000-memory.dmp

memory/3144-659-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

memory/3144-660-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

memory/3144-661-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

memory/3144-670-0x000001C6540A0000-0x000001C6540A1000-memory.dmp

memory/3144-699-0x000001C652E00000-0x000001C652E10000-memory.dmp

memory/3144-700-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

memory/3144-701-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

memory/3144-702-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

memory/3144-703-0x000001C6540A0000-0x000001C6540B0000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 36710915dcf9ceed0eb5974802be4856
SHA1 9a6e58d1b1c6160ad4d3b874cf1b0462ce623f34
SHA256 5bd458ef840d88f3b839389d8cc559e707a95e6e03625521ff5dbc6cb4e75167
SHA512 edd21d48e558751559d55d76458dba7d42fd6c03e1aa06f71f17ecb1e0bd53191489848d6f672c9468d8c71c373f50b1ca4a6f6cc51006314ed4c222bfe33266

C:\Windows\system32\fxssvc.exe

MD5 c20de2bd823b9e511c36874faec81e8c
SHA1 fbcf64eec686af0b95495e15b907d20364880899
SHA256 a5961c9992e21ff58e3e14ea83792dc7b0f5746c54f7866501254c7acf45f55b
SHA512 0229c7698f6f7efc8bb76e792a3b341d0627e6e962466c2ee787e857293aa4b1b660b18c9eca36bb5b632af9a5879518a9a1edaaa64b2874ca94fa1558de4fc9

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 619eab066adad24ccf3cd6edc6c88d2e
SHA1 48e876556dc3bd223617ab5838f69226e04b3237
SHA256 97b61a91ac597de74d2206097865355dda6c94087290672b7bf8009934378a70
SHA512 5110eb96603c0633f2bea5dfcebdcb022bfc46d060737a1e5666b7507ff9b1723b9c3eae03c8b1e39cc46181e2ef621ec9ca7b09ae28138cde5eb9bf3751223b

C:\Windows\system32\SgrmBroker.exe

MD5 476b78c5f68fc9280f3c53c579c9621c
SHA1 500527f42ec454b6b8a4670785fb505ec1172e83
SHA256 6b124af79bbd465c2ae7bebb42d92c98b763d4cd55468e90b7f08dcd135c63f3
SHA512 b11ffcf33ed8079f215e9e6eca7f5939baf2a45d80906b1170bdcf756372b8e7efe81c213f0e26fa98734da04242fc9c8527e37be776ce28edca01c2c5d48e24

C:\Windows\System32\SensorDataService.exe

MD5 bd5ce4bec137e4552ca74c07dc2d8196
SHA1 c17eb5f3f3015bd790a6f41ef3f401618ccb4b6d
SHA256 60e4b750b8fa8b9acb331e1c3bb507dbdd60da9b3911a6aea731dadd6b1a18bd
SHA512 a6ec87774fed387ecc503d2b0a028a9b121a8083c50f292442111ed3b40d32a60aff512c79961ec5850c44ad129d129fc3af912686b8ecbd3adf62601ff4b89b

C:\Windows\system32\msiexec.exe

MD5 e39bd87250673515b7788e9c6db356ff
SHA1 4c64493553afe436882a52b8afbd42305deae8f1
SHA256 dc6baded8faaf211a7f627adc62a3fa5a361cb01368c8d7cb9b25040f0603445
SHA512 daee7e9ce4cd5a971dbeee5a1d156379a8842cf2f352c932b7e781a1453f260a3991e2c3d67c02268789724eabbcef235b591c78e6f23e57445519ede11a8f4c

C:\Windows\system32\AgentService.exe

MD5 f85a335172005af3c755214ef75f6518
SHA1 29cbd67974902fdbd407dea3feb539cb669c6970
SHA256 82cd171997d9457e864aea1adc40bb4952f507cc1b58150be73c74a6de08180e
SHA512 ad25edc58286aa6a8b68e2d1970188ce5e56cbb84c94ff11d624c3a670288d026ac1115b8a26fb0ba5ddebc90ee27cf57ab0fc0346c2e51340c253e794c44191

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 3406e4907fbe2f5563f3cbb4010a05a8
SHA1 49fdbcd687e42045a73a0159b3d618f917c8f71a
SHA256 4953daf3f58002a108db0f3d8359091f726c02e5220648ac3ca16f68e1ddde32
SHA512 bf91de70045febed1886d91152808e6707d5b47a81d65a68e4533e0b476faac51cc8b1c546bf86716ef30156ea7ad0c345a6ca184ac68a8907a43619417764be

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 b90202f202e88bde2d4aa2f69b7c6ed2
SHA1 34bda1b035e0e8698bde3ee5a3274c6fc08d06a3
SHA256 3a29a97ac994beb4961aa5498896a9c4423671356587e3b3607c9dffa3fc1156
SHA512 a3a130752889fbd47ae0d7e8e624e39ffd260433d3f77fb19d964101aea856ba42f4430ad623a38b45b3aa12f85a306bbb754f7873d46819d547618d0da0af40

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 9f720fc6c27db423263c7413b040be78
SHA1 5784e6998930d9ed125bbdf4ba80d038fa70c920
SHA256 8b0fd9748586e6a79af0ae27a80a7b39f6b929ec1013b7791676608d2ce66967
SHA512 67520fc61affb5bedc702eed8eedb9edf38fef97087155b8c0eeb7e250655a21bff9542461a2648e2054c7e232f1b04cc6347b93aaa0ffc069e41cf589d27544

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 cccf96eb76c549755c53e1916c12fff0
SHA1 e9447a9f416cb6fe0944cb7a065264d245181182
SHA256 725e03abb1897fa9672c7ddb8ddcb925e345810576f1aaad4a479295cd106871
SHA512 4184222069d1b998bbf54c116f001c19e1f127134a3329a3b3b2ad376969e237628bf657624663c57d1e5af460fcfebf5acdf8f5d5317a9c07b83913dd14d0c8

C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

MD5 79fb182be4bb7a7345497c9bd93aa751
SHA1 fbdcde5547a27e3832be7b532c24acc5ca1f5c77
SHA256 c789fdcc6c3ba31a83ffdd8a6062b1b05d5894d3668d2f3b5e2a195426aac199
SHA512 306461efd8b6f74e16e35fef8a3a71c0f1c274aaafdb99375db704000813ea5af81913cbe4f9b4deabc96bd6a0a6994f4326c5b2aab717baef8f0a56a1ac2471

C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

MD5 79c691888632bd54525b188a84799030
SHA1 ea30757cc7401382830578f53fa9f12c0d59ed85
SHA256 b185f9c3d210c1b461aa90db5eb31965e7dcb9b4690cd30f896d6f9c4774be22
SHA512 a7b58f3de25785f191ec8f2a8d322affc480ac31adff70a2dbe2067a1d80633f3fe953be4202daacf9da6563932c9996928df327152ad50f090fc9a49ca390c1

C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

MD5 f90100e08114cae4c68dd27bb043bfec
SHA1 a26ad3fa8acd5d96309eda1510891bd5e9a85dfd
SHA256 b6fd96f47de0ebc9cb590624e0d1dfe0aa67dc905733b0d5861f588eb6732110
SHA512 6243c5dbfc1ab7fd0cd727602738d8642f5a929e651e50c67e3c86fadf62b10e1a885f253c6232e863454611e5a3df966d5e3ee6ea49e2438409c700420f4c3d

C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

MD5 2eaf95af4f12cf0835145d6c0bd242ad
SHA1 59eda7629aa6cbeeab0fe85f5ff2d0395110b441
SHA256 e71e2cac00633d8a3a7ef36dd07f35570ec0f276e263093e82f1ba83f7560df1
SHA512 b5a3992d11f1afa60a2ab8bc7854c694972b5c40b5c8b516d105dcc82770d2977f39fdcaac139f9c0a9b439aa2f09f3fcda92c1fb38402d30c8373a09b14ff1e

C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

MD5 1988fe595eedeb99b89ef3923e215836
SHA1 5deb85c3c1013c39c5a96378198ffe4b3827cd33
SHA256 ff4713f22bafc69ff50612c33e311918f3c6aa1c439145c8237fc7f1b95c907f
SHA512 e5b6954a1d0abc9d65e2b5eb99f112715d828c680fe627c9db700a0fe96a8663e0477b387b4d226bd76a6c7d0c05901d65582ef637db51cb0e7d6715307df8ff

C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

MD5 be2403e04c7505023b4316cdc22c2a97
SHA1 5877ecb1c61570bf5270c0aba7a9472f01fc06cc
SHA256 d2d026654429ccd0d41e1d6101f94004b19a396e2f909af5accf922dea5a6e54
SHA512 d6c04c008c43648d701b7f64a4f47e9fc64d2a22cb39df5876ee43d5f48730ba3eca243fdaf6b55a9cfe20a9fc7c8881fa10c8d624fd82aac0f267a1389fc3ba

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 146831321d78c8e3bbb9b88336732b22
SHA1 596a76c0876dc474051fd48af8e3e56dc5d34ed8
SHA256 5e1de4aed9e11f8492e241c45cffad243868eece76be09f86acc0d963f236ac7
SHA512 2069b2e81aa3111f8f04bcc9e2d74dc27c56bc5ea28a0d50091954a36d12ca8135c1dff8d73d18385005bc2d8d8836943b395e9cce673b83d1c67aa642708778

C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

MD5 9ca6b4b32a349892265622a1bcbe22d1
SHA1 0013760afbf36edf504e9063c16c881130c77763
SHA256 243009f0b31185e90764f37f01bd13ffddfc19561e67d0746cb0c4ea99563bcc
SHA512 0308bba225be448ba349012fbbb7b8f8b30ba93d632a71ace5e32da552a945fd55ff0a03a12650b17d3788ec0a38ed4d2c2486b6fc76c0a501c65e5de57f1602

C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

MD5 6313419e4e0bc6303ca75190a2232c2a
SHA1 82de2a4eeb2517695fcdb6f612bd8abcb38294f8
SHA256 35f365e52f5e3c98c00c9551be44b24a189b71d8570b4cedddea55c2223d7ed8
SHA512 bb23f0e3776b357e3d7437dc7e88e05c862db417be70c2f01cecdea3d2d731124a2d2e6168f8fc6c3bead6ea33e97568010e50c9dfd45a9f6ec1b8ebc1c65c53

C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

MD5 aaf435d98666736b4de5584b2261a014
SHA1 2508116571510dd9e6065249a42ad963cc4e85b5
SHA256 f4f6ca4c3c9ab26d6589b658398e2879fcb0ca1e30700eb46313209aa3dd7a18
SHA512 8dfc6b0cde254b369fee39a07acef491d1f36edb3f334868c1258cb3a0dda7b70f37abfb08a4166801712a11d5587063a2379e4a70453bc5fff5ce725d7f6580

C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

MD5 f8be505e9cd6c72beba15286f17b8610
SHA1 f85668447deb471aeb69b3f45f6ac00a29aa97e6
SHA256 34b61e5b9532c0b8d4cc730412036066a867193b623dc4a1a9b622570b32e3c3
SHA512 a459ae557933764fd2e3a10adc2fe1154f396d140a76df4cc6bedd37f3cd2afe56f55daee4321d6e9175a60ef9bd765b744c0baabcc93868a96ab652fefbfb8f

C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

MD5 9c6339c9823dd3a68a50904c11023e7c
SHA1 00f90b8379cc671d4c8c9d8860a9552705116a15
SHA256 a197e6c302434e5878e1ad7a7feae8dd6d24267db681987a5e460ffcd6d06bb5
SHA512 a59f5580785ac9fd453daa4bdf3bebc41c43800ad6abcc025a66fb74235dccd692833786ca6979b98f90687c19a3b0d42135d0c0e10c849eaa26e4350090c5e9

C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

MD5 4bc8348ad4c36f6e4a4398e380a68ec6
SHA1 c316d9b8fed162a5b328a16aa3a4a724cc508fd9
SHA256 2e3c1a6186c052d89577f92186ca2c81464e6eb96c576722007162745bbdad7a
SHA512 a61906516c648aedcc134db6efc20cc589a183490b8c775b92fecfec2df82be013ef2e5c09c83a654e293954f7aacdff56b1c4e396bea520d8d45fb92b3e6a68

C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

MD5 207b82a065d40074a2ec02bc46983ef0
SHA1 03090aeac9b8c894a27564012f2ef17d818d84b4
SHA256 13a46710fe21bd958cfac3a4a43dad246a2679a92d6f1ccf6e6884a211f46079
SHA512 6532931f47b19f9d55433a7e4f10405e2e6d93352b609694af722d97fda4cd3e48ef204916e448d1dbcc8ed9ca526f0d61a8782a8e911c292c88229c9820e23e

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a6b2bec608763e0a8ff9accdabbb52ed
SHA1 9ad78d3ef6c83d80bd4705d802a8d18d5112ac09
SHA256 119d1af26330a69fa0a074eb223c2fcf6ea6910857b46d6bc72eb8942c74fb13
SHA512 2902384ddb359731540ae95d04e8def81a08f289ee046a51931b172a85e332e9187abdda64b81770658f01440f1be80e99a2584e96dd146e84877d372fb52fb2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 6d0a80c7b9cfe324ea2dc746d9f57b55
SHA1 3c3ea2f6ae03d5b42565b788ac44d3b5389801a5
SHA256 069c86481f21958cf2b8ff89747b46b500196035fc1a02a794643c11a48be60b
SHA512 93d05fac684b54664c1ec7689fe5cfa025bd17229e5ee1f28a1d3820498d92d70de01516e63ca1b06bbe89a22496c9098d0ecfcd18c2e6445902fcc070261138

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 eca80594ad6dca4877a2a0f1fa020ee0
SHA1 33e7647aa2bb822df420c1f6d9392f73a4f7519b
SHA256 813765700be4cfe8ea1906469b9f7cdceb047538f6b38ca8fad9105f9385e9a2
SHA512 d6a5fbd9d4eb7ae946aa38b5be96460c65967640fd0c7f64c540a9e08da03220cc40d0ab0f9eb3e9687e261c5cc401df04596f8983903a599cf3dfb0a82e5c43

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 e56141e56e9d55e4b68b8a48f9e7f4bd
SHA1 27b5e47f0b726914ae33497d50ce2cbfe1dc433f
SHA256 3e224c285fe7a0aa4edc57a7a665dda200892ed1ee3868d94ed400b618fb15d3
SHA512 b00549466179e9c49621d8906f5efcaa0bc6e45905a72044292659bc356b335b5af40b5605081c006cee6008235dc6ca1619574a0ca24cfe2c1875e84d50f3ef

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 e5911ab45b55af1a51224a1bedf460c8
SHA1 6cbb2344c66dc41b1bc6229a176432748aa5a98e
SHA256 20c12befd236e838e535d78f7afb6c6d470335c6490ee52cdf57676e2ce5d762
SHA512 353632cc9665e714a45ef7208ab23fa65fce17b063d37eb5d3a4c1c88cac32d4bab699bd103961db495051850592fe6c3d09fdd7573c239eb7cca498d554d347

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 0f197bbf9a3df35734fb62ea548eedc7
SHA1 9843a853bef1a99abd8086a4e84e3befde91c92a
SHA256 0650e06218982fcde037d342d46953d60d4393a16c3c0b95eeabdbf59a2f9c05
SHA512 bd24e6622af8f3efe5df1a1dd6b26fa6df7690d1756b1d4e2796c983ff0ff12f3f726c31ff8e08105432c02cdd126a03fcaf137de8ccf7b9e51375e033b629b2

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 930b8ab2ebe4c97f8c4df6388f4d5be9
SHA1 f7399c25c411f328752590175cd8b83e7d75305e
SHA256 004bae18cc9ea3edf5b830f1ec9e6dabf0745599a1fc2328b748ac92c628de7c
SHA512 6f78d68a829091a89769e0e87944265f55f838bacc78ff7e12aae0f48179d57958990267fec4a9a4d6bdeb3b8013813ad42e350cdf226c6424f53a4c51be88b2

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 5aefa9c2e2c289ff817727185da4e91e
SHA1 cd8ea6b771d405ca77c1cf5b811732511cdc83e1
SHA256 8465074db66c5ceee7bca56ffa89bdd217889d8dcbc6b82810ecb0413f13268b
SHA512 4197837530499a8c249e4f0e09df57b74b10f5af5c3d439a379c375bb9216627be0c713a33622a9b5b5fbe567da17d0a2ae6ba7346b8742e4720315c1b0a16f2

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 bdb7beca7518967c56ac1f2bbec8bf30
SHA1 c4177ae6b7a946a393f4f1dd1536d4377ba4927e
SHA256 fadf575b8f2b3e6c6fc5ec4c3487d372a94934649d6bda5247d8546584440ac1
SHA512 72ba6d18340d226a7c4b9870dc87645237e07e72d4d1f2856f2960e2074f66979c11d5a689ae0e7aeb7fd938fe7f0b5cc53b894faae54adecf732ea251223bf0

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 617c11682f499df0da014fdce3b1bfbd
SHA1 9bf81114cbcd0f11a0fefc17175dbcdccf1b9989
SHA256 2cd693cc2edcdf4268ecda933f43747adf96b40cf1afa261f0ed18d4855f8857
SHA512 e4cfee742b56d7d8f98f356775b73aad04dcac28cff0ce537d6d0b1a4ca78614d95a981dd36b24fa4344f013ae6eee3df77a2b21dc61514e332bc655d30c3e0a

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 9724ac3363678c176b404ad95b3c8e11
SHA1 60499153715fe3680ad225b9b47c52edb825532a
SHA256 7fb172031caaf11680391fb695275796f4445e97b984bd9c6ad5d038a61d91e6
SHA512 036ad720d0ad91fd48fbdec636f273637e5f073bdaf0f6a0db3cf2e8699ed220c421f7402403cf59964bf8fb321d57b4e2294360ae200bd4df1653234c5945cc

C:\Program Files\7-Zip\Uninstall.exe

MD5 818dba17a1eb4e46c01332451f47d540
SHA1 1db45528a96aea06ab59d1a7e2a2d215fbfd96c9
SHA256 277c2a76155004a090048b4b0d0503b264fff089014a4baa0af32a84858a0c7d
SHA512 910c95745926b34673bec4a3a97623756a9ae5516475cbe9b616c8212214ff2ec02f3cd14cda5a671caae692042d78d7f5f5f46aa6a94c92097e12c394a07e48

C:\Program Files\7-Zip\7zG.exe

MD5 1e0077a2886a9fb42783d311a337e101
SHA1 9ecaaefbce3d16278362ec0b9238991af9c4bec8
SHA256 a2275e37a0c07e322ce266ec455f3657b29e1062583885d89e6daa6a489addb1
SHA512 b65dd619927841d2a9ff9e0e29beb5b68bc923899fccd354c3abf3eaf414cc42adc12cdc17236809bb9338d160cd3b898cb92516620f5f6190326e3221dd607e

C:\Program Files\7-Zip\7zFM.exe

MD5 bde0d74c254d4d1aef4ea4a3c4f70247
SHA1 4b00606685413010a8ac414863ebdfa3b53c3f64
SHA256 9f9a07107a947265ab02d99b13cf379f6324e7dac66959b1a5d35253938495af
SHA512 68f25426b4cde960cf4e5807073479bd6a67ceb6bb8759e1dc42fd9fed3bcfdad7acb9701c1829ff2b7e0064aea75ca781b45ecc4caba0f4327275c7d433d081

C:\Program Files\7-Zip\7z.exe

MD5 94654cbaeb5e84aa73d934fc5b6aeeed
SHA1 a3a6902968a9b3b1b1202e10f8c4beac552b825c
SHA256 6ed64bf64a9c2aba46c36e66d15fc9afeeee9c6ab6f31ee4c7d6083a42e79153
SHA512 91f56ea138e5849c28ffe757394ea5aec87bda7ff164269084f07fe8647468c92ffae7818368614da75b5ae327ebeeaca78383e31e5764b820ac046cbc185bf5

C:\odt\office2016setup.exe

MD5 5b4fed2c4408ec127fabd7088dd482f7
SHA1 26962592f841ad6b461dcf10c1525d6ab83f484e
SHA256 81e045066e8c0130d9f4947378f56b9f23368b57995cbdee1a6d4418fc19db57
SHA512 cdaee5f018b77d144c166d0313efe19f9237c0a73d85fd853a9a2ffcb24f1c8ef9634027286ee85f663989eda535c6667e271d56b0d263d6572d6e87c1a79c72

memory/3144-771-0x000001C652E00000-0x000001C652E03000-memory.dmp

memory/3144-772-0x000001C6540A0000-0x000001C6540A3000-memory.dmp