Malware Analysis Report

2025-01-03 07:39

Sample ID 230501-rfqmwshd8z
Target Quote 1345 rev.3.exe
SHA256 dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205

Threat Level: Known bad

The file Quote 1345 rev.3.exe was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

BluStealer

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

outlook_office_path

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: LoadsDriver

Script User-Agent

Uses Task Scheduler COM API

outlook_win_path

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy WMI provider

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 14:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 14:08

Reported

2023-05-01 14:10

Platform

win7-20230220-en

Max time kernel

139s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\58c26cae826a969e.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0E424906-E1B1-45F4-9C81-644E0F1C6929}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0E424906-E1B1-45F4-9C81-644E0F1C6929}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{88A3483D-1D7E-4570-A5CC-1E0ADCAB03F2} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{88A3483D-1D7E-4570-A5CC-1E0ADCAB03F2} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1756 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1260 wrote to memory of 280 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1184 wrote to memory of 520 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1184 wrote to memory of 520 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1184 wrote to memory of 520 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1184 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1184 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1184 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2484 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2300 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2904 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2960 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 2132 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 316 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 316 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 316 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 316 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1828 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 1e0 -NGENProcess 1e8 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 254 -NGENProcess 250 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 258 -NGENProcess 25c -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1e0 -NGENProcess 260 -Pipe 248 -Comment "NGen Worker Process"

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1e0 -NGENProcess 244 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 24c -NGENProcess 268 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1ac -NGENProcess 260 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 254 -NGENProcess 270 -Pipe 1ac -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 264 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 274 -NGENProcess 23c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 23c -NGENProcess 184 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 254 -NGENProcess 280 -Pipe 274 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1756-54-0x0000000000F40000-0x00000000010E0000-memory.dmp

memory/1756-55-0x0000000004E30000-0x0000000004E70000-memory.dmp

memory/1756-56-0x0000000000500000-0x0000000000512000-memory.dmp

memory/1756-57-0x0000000004E30000-0x0000000004E70000-memory.dmp

memory/1756-58-0x00000000009B0000-0x00000000009BC000-memory.dmp

memory/1756-59-0x0000000006040000-0x0000000006178000-memory.dmp

memory/1756-60-0x0000000007F90000-0x0000000008140000-memory.dmp

memory/1260-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1260-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1260-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1260-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1260-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1260-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1260-69-0x00000000007B0000-0x0000000000816000-memory.dmp

memory/1260-74-0x00000000007B0000-0x0000000000816000-memory.dmp

\Windows\System32\alg.exe

MD5 ee2ced01af20b84f6906ae5aac2d5591
SHA1 8c7cf5c092a83f8a3d0abda4f1ce57baa1a93627
SHA256 eecaaec749a4736c8a3450ecf62477b0b43f21ae4f207b7ff5f4227895801030
SHA512 3504a457f87c8650a10e7343c97fa1c02e6695db9678188afe726ec75eb78741272b819f98ad485e2a809aa19a8051ca846d99e68b36ad712adb4eeeea7f1735

C:\Windows\System32\alg.exe

MD5 ee2ced01af20b84f6906ae5aac2d5591
SHA1 8c7cf5c092a83f8a3d0abda4f1ce57baa1a93627
SHA256 eecaaec749a4736c8a3450ecf62477b0b43f21ae4f207b7ff5f4227895801030
SHA512 3504a457f87c8650a10e7343c97fa1c02e6695db9678188afe726ec75eb78741272b819f98ad485e2a809aa19a8051ca846d99e68b36ad712adb4eeeea7f1735

memory/1460-82-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/1460-88-0x0000000000890000-0x00000000008F0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 d7cbd60f8a3c538c3177f025e82a02d4
SHA1 d25c76a6bad5a0b9b8c49a4b319b0e7819503dae
SHA256 eacfcfc2bb6f06a5d3c24c458180afaba0e1f5c1e86cca9d399331cf2fb5202a
SHA512 2c9169d3eefcc26ee1e8f6b025a16945cfb2a1be681d7f47ed774bf88c42104025591120711bcc30588770db8b7451b10e64a945830e0d0666ec00d685309e95

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 d7cbd60f8a3c538c3177f025e82a02d4
SHA1 d25c76a6bad5a0b9b8c49a4b319b0e7819503dae
SHA256 eacfcfc2bb6f06a5d3c24c458180afaba0e1f5c1e86cca9d399331cf2fb5202a
SHA512 2c9169d3eefcc26ee1e8f6b025a16945cfb2a1be681d7f47ed774bf88c42104025591120711bcc30588770db8b7451b10e64a945830e0d0666ec00d685309e95

memory/1260-94-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1460-96-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/892-97-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 2d9318204b5a75d60c360a142b6b2405
SHA1 adcd1102c0008602a94b45639d5a66f8436002e9
SHA256 32b2623927a02e732d4c65d9681a0ef9e6bc747410534490d92ba2da83d1c9bf
SHA512 cfdd538420d49e366858fb822168dd1ad27722b612aad0851e708c78eaced28781ed59d6a9f49be06f015506be1bcc92fe467ca55ed473fd5cb7ba6f07ffa1de

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 2d9318204b5a75d60c360a142b6b2405
SHA1 adcd1102c0008602a94b45639d5a66f8436002e9
SHA256 32b2623927a02e732d4c65d9681a0ef9e6bc747410534490d92ba2da83d1c9bf
SHA512 cfdd538420d49e366858fb822168dd1ad27722b612aad0851e708c78eaced28781ed59d6a9f49be06f015506be1bcc92fe467ca55ed473fd5cb7ba6f07ffa1de

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 43d9e565fdbb6982169f7065a0781b13
SHA1 f9b7e7b7c9a61ed6cef89fd8ad6b16e76c4de4ac
SHA256 060b5247434e7c893d75dbedfb0fc77ec1b7f8eab2444c591152160320a08e38
SHA512 6084408a208dbbdb397209cadd47b60c5dd9f8c036f1ea8716ed1893d3650642e22a8caab9aea1e653304ecc90e9a2cf2661e586f00e8515fb034043d49477c1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 43d9e565fdbb6982169f7065a0781b13
SHA1 f9b7e7b7c9a61ed6cef89fd8ad6b16e76c4de4ac
SHA256 060b5247434e7c893d75dbedfb0fc77ec1b7f8eab2444c591152160320a08e38
SHA512 6084408a208dbbdb397209cadd47b60c5dd9f8c036f1ea8716ed1893d3650642e22a8caab9aea1e653304ecc90e9a2cf2661e586f00e8515fb034043d49477c1

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 2cdfdeb52b90b3650ce5fce0fe249f4e
SHA1 132c8821d15851d84d434c2f12f6ed64b28ad5e3
SHA256 49d1001ad2996fe56ae141a6271ae3ab40b33457f83e826c0bf8bed0fdce63aa
SHA512 6a07db4346d00986f2d4c043fff00d696881b514f4d290dd0013f6bbff62262014b4332caa318890de145241e8a931ca00f61fba6960ea0470507d6c3e3d6074

memory/280-111-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/280-108-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/280-107-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/280-118-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/280-116-0x0000000000090000-0x00000000000F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

memory/1828-120-0x0000000000600000-0x0000000000666000-memory.dmp

memory/1912-123-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/956-125-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1828-128-0x0000000000600000-0x0000000000666000-memory.dmp

memory/1828-127-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/280-130-0x0000000000A50000-0x0000000000B0C000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 43d9e565fdbb6982169f7065a0781b13
SHA1 f9b7e7b7c9a61ed6cef89fd8ad6b16e76c4de4ac
SHA256 060b5247434e7c893d75dbedfb0fc77ec1b7f8eab2444c591152160320a08e38
SHA512 6084408a208dbbdb397209cadd47b60c5dd9f8c036f1ea8716ed1893d3650642e22a8caab9aea1e653304ecc90e9a2cf2661e586f00e8515fb034043d49477c1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 c02870309c7adedb8c45da3035e1cce8
SHA1 1dc1f529d448db402a969085acfd1dd9622661e2
SHA256 677859334a5b9e52fb4e40f3ff40416ae2b7e95a1fe8b73cd64ffdbe797b672a
SHA512 fcd349a56e71efb59ce9bf5b9af34e933f2d0795bf5bbdc4f690b28581cfeaf8cb0eedee664b13ee1f455889895bf40dd94d5f4610e65a97fd39922c6e457cdf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a9149e3552114b0c5efed6e6edcf2a86
SHA1 a6350738f1041c1718f6cbba875f8262f948013f
SHA256 f96d593b1788e405231b77005eee5d8b99216c3d54c31dd9e54dcf83b45cd95b
SHA512 f0b999c7b1f69815997af668dc92ecde8ff985d42f605b741576d3b3e2adaf7c0d335d688ba2d0787c4691d22a4dbad3b250c3e9a57ad4f811a87327b2027235

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

\Windows\System32\dllhost.exe

MD5 1634923e5a0c43ba8e3eead1b18db37a
SHA1 10f13e0a734d92eb5ad5f426b3a3a5d92a50089c
SHA256 753805e0cb4776c79d908ac5a7b37e612f01e6ced8ffde1e4ea3bdd6a96da5cb
SHA512 43548060ef8c180448f20fd566b983fceb2ce13c2819c85be2dc3255924316353688492dd13d95719f78181fe8095e52adba219d4bac22a2d1dbc59bdf32346f

C:\Windows\System32\dllhost.exe

MD5 1634923e5a0c43ba8e3eead1b18db37a
SHA1 10f13e0a734d92eb5ad5f426b3a3a5d92a50089c
SHA256 753805e0cb4776c79d908ac5a7b37e612f01e6ced8ffde1e4ea3bdd6a96da5cb
SHA512 43548060ef8c180448f20fd566b983fceb2ce13c2819c85be2dc3255924316353688492dd13d95719f78181fe8095e52adba219d4bac22a2d1dbc59bdf32346f

memory/1184-146-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1484-147-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a9149e3552114b0c5efed6e6edcf2a86
SHA1 a6350738f1041c1718f6cbba875f8262f948013f
SHA256 f96d593b1788e405231b77005eee5d8b99216c3d54c31dd9e54dcf83b45cd95b
SHA512 f0b999c7b1f69815997af668dc92ecde8ff985d42f605b741576d3b3e2adaf7c0d335d688ba2d0787c4691d22a4dbad3b250c3e9a57ad4f811a87327b2027235

\Windows\ehome\ehrecvr.exe

MD5 f421ceac3e9bbec240181047627c9209
SHA1 4ff1309cb7e8e644e3fc221c7715c999f04c19f0
SHA256 17e5ea455dc358617a16a83d471b9646ee92f16f56d4f1585e3d2aa3b709da33
SHA512 ae9778f74281b21715d7fb115ac13f91db726237b96c19ff60bf17ae85d5df74ff53cc0b15ee88fe03f0a31e37dcdde0e0fdbd4b2a1b5d0f5ec7ef16ef13a86d

C:\Windows\ehome\ehrecvr.exe

MD5 f421ceac3e9bbec240181047627c9209
SHA1 4ff1309cb7e8e644e3fc221c7715c999f04c19f0
SHA256 17e5ea455dc358617a16a83d471b9646ee92f16f56d4f1585e3d2aa3b709da33
SHA512 ae9778f74281b21715d7fb115ac13f91db726237b96c19ff60bf17ae85d5df74ff53cc0b15ee88fe03f0a31e37dcdde0e0fdbd4b2a1b5d0f5ec7ef16ef13a86d

memory/1108-152-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1108-158-0x0000000000820000-0x0000000000880000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 b1f816d01a5439436fb842b1cb2900b6
SHA1 54d30edf8d5a6a4a0f27e0748bfbdfd5767a6b7e
SHA256 d50b66833346959b801005bcb1bac31297db55bc6d251741ebb3ff9bf1365239
SHA512 12e3581e217061369648edebbd15d7c66d74ae2e774d3b8313c3253cd4db7eff415d8c02df85b3898154d657ce84ced2c704cab14aa352b79cfd409abb7b15ec

C:\Windows\ehome\ehsched.exe

MD5 b1f816d01a5439436fb842b1cb2900b6
SHA1 54d30edf8d5a6a4a0f27e0748bfbdfd5767a6b7e
SHA256 d50b66833346959b801005bcb1bac31297db55bc6d251741ebb3ff9bf1365239
SHA512 12e3581e217061369648edebbd15d7c66d74ae2e774d3b8313c3253cd4db7eff415d8c02df85b3898154d657ce84ced2c704cab14aa352b79cfd409abb7b15ec

memory/1108-163-0x0000000001380000-0x0000000001390000-memory.dmp

memory/692-164-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/1108-167-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1108-166-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/692-169-0x0000000140000000-0x0000000140209000-memory.dmp

memory/692-175-0x0000000000840000-0x00000000008A0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a9149e3552114b0c5efed6e6edcf2a86
SHA1 a6350738f1041c1718f6cbba875f8262f948013f
SHA256 f96d593b1788e405231b77005eee5d8b99216c3d54c31dd9e54dcf83b45cd95b
SHA512 f0b999c7b1f69815997af668dc92ecde8ff985d42f605b741576d3b3e2adaf7c0d335d688ba2d0787c4691d22a4dbad3b250c3e9a57ad4f811a87327b2027235

memory/520-179-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 4e00854b8daefe694ddf4a3ebc7d5770
SHA1 e2e37bbe209de887c91fa9189514b8b67db2ca26
SHA256 5ee2166fd7d989a6a96347250d7a44df4e2bd9e60f39c887bb17994bbac6e752
SHA512 449fe627fe5b4ed9e4d2d651741a12394bb2b96d36806d5dddef8cc69ea52add69c28f570db22634bb136ef34274beb9703176e38c031f6c83fe217a70b6d104

memory/1756-187-0x00000000008F0000-0x0000000000950000-memory.dmp

memory/520-188-0x0000000000690000-0x00000000006F0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 a9149e3552114b0c5efed6e6edcf2a86
SHA1 a6350738f1041c1718f6cbba875f8262f948013f
SHA256 f96d593b1788e405231b77005eee5d8b99216c3d54c31dd9e54dcf83b45cd95b
SHA512 f0b999c7b1f69815997af668dc92ecde8ff985d42f605b741576d3b3e2adaf7c0d335d688ba2d0787c4691d22a4dbad3b250c3e9a57ad4f811a87327b2027235

memory/1108-201-0x0000000001430000-0x0000000001431000-memory.dmp

memory/520-204-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1756-205-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 08a30b0911dfbeb149fd59f5e19bf98a
SHA1 6212c776ac1d74da85372b1cebf87fac201e7ca8
SHA256 01dd59aa0280f455ee8af65159ca68bce3027ef2d3ff38dcf08c36c7fa2a7fde
SHA512 38b09bf130c364005b841e04590a6c0f4b1907b1f9cd1497b08e0885980fb4d19999c227ec416d4db422a248eaf5eaadb4161daa4ac7c5c899bdccb17119b514

memory/1832-212-0x0000000000DB0000-0x0000000000E30000-memory.dmp

memory/2004-215-0x0000000140000000-0x0000000140205000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 08a30b0911dfbeb149fd59f5e19bf98a
SHA1 6212c776ac1d74da85372b1cebf87fac201e7ca8
SHA256 01dd59aa0280f455ee8af65159ca68bce3027ef2d3ff38dcf08c36c7fa2a7fde
SHA512 38b09bf130c364005b841e04590a6c0f4b1907b1f9cd1497b08e0885980fb4d19999c227ec416d4db422a248eaf5eaadb4161daa4ac7c5c899bdccb17119b514

memory/1836-225-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1832-227-0x0000000000DB0000-0x0000000000E30000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 35a561c70cbeebc858afdabea0dbc8b8
SHA1 b2aed4ec03368380c09f06cb1fa980bdbf506548
SHA256 4e9906ae6683430bbeb112a9f28d458c8ade6fe9a07428fa7e9329eb0977311d
SHA512 ff489b33c44ab503f331936203b04e073497f159e1f870bfa0f9dbd281665eb6012802ef8b4082b8a6930bb454858e66bc2254062380054052145332330b3e40

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 fbc4907093e075d7f9a6ea0e034f6490
SHA1 27523202a4f1cf77f38ce3a9250eb40bfa1bfe86
SHA256 18812d4dbc57a4860d2df873fff241811694b05d08f6c74ee970ed322f7319bd
SHA512 17fda6658812126d9b3cc2b7fa0d92d125e3122048118f433100043dce4adc330698c2b6697ee999962459281ebfe44eaa7c882e6e910ca157bc52a30bbba954

memory/2116-246-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2216-248-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msdtc.exe

MD5 f4db865fd4e73e8566654de6a742f226
SHA1 d6a322d7f1a5015e2543ea34e7bbea098003fd6b
SHA256 4f7e372c662e0e2f41b66e58d6741cdb4b0c06202d94961e0bd5a7fdf4742e93
SHA512 a66cbe25071603a5f3d5f0b3008f8311718e4f8c415f72f8cd0991f09d232a6935092ed99582feea75c6f695dd6f9d2b02acb42de9265ef93bab28f7861650ed

C:\Windows\System32\msdtc.exe

MD5 f4db865fd4e73e8566654de6a742f226
SHA1 d6a322d7f1a5015e2543ea34e7bbea098003fd6b
SHA256 4f7e372c662e0e2f41b66e58d6741cdb4b0c06202d94961e0bd5a7fdf4742e93
SHA512 a66cbe25071603a5f3d5f0b3008f8311718e4f8c415f72f8cd0991f09d232a6935092ed99582feea75c6f695dd6f9d2b02acb42de9265ef93bab28f7861650ed

memory/2304-262-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2216-266-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 56223acfc512ec06cad2485f50da5110
SHA1 14a899d92cd0b13269be629094338c39b9876e43
SHA256 9ac8d1e44f78bac5625606b30676317c3dc91abbde0c4a0bfbc0a2e46a35c3b9
SHA512 f82991f770e95a2bbea18996652675786ff240bcc2e006e378400cd49ab074a944ce3a9f4e3d2e087038f630b04d560ee98503c92a71b7d72e5062306ff8c4b1

C:\Windows\System32\msiexec.exe

MD5 56223acfc512ec06cad2485f50da5110
SHA1 14a899d92cd0b13269be629094338c39b9876e43
SHA256 9ac8d1e44f78bac5625606b30676317c3dc91abbde0c4a0bfbc0a2e46a35c3b9
SHA512 f82991f770e95a2bbea18996652675786ff240bcc2e006e378400cd49ab074a944ce3a9f4e3d2e087038f630b04d560ee98503c92a71b7d72e5062306ff8c4b1

C:\Windows\system32\msiexec.exe

MD5 56223acfc512ec06cad2485f50da5110
SHA1 14a899d92cd0b13269be629094338c39b9876e43
SHA256 9ac8d1e44f78bac5625606b30676317c3dc91abbde0c4a0bfbc0a2e46a35c3b9
SHA512 f82991f770e95a2bbea18996652675786ff240bcc2e006e378400cd49ab074a944ce3a9f4e3d2e087038f630b04d560ee98503c92a71b7d72e5062306ff8c4b1

\Windows\System32\msiexec.exe

MD5 56223acfc512ec06cad2485f50da5110
SHA1 14a899d92cd0b13269be629094338c39b9876e43
SHA256 9ac8d1e44f78bac5625606b30676317c3dc91abbde0c4a0bfbc0a2e46a35c3b9
SHA512 f82991f770e95a2bbea18996652675786ff240bcc2e006e378400cd49ab074a944ce3a9f4e3d2e087038f630b04d560ee98503c92a71b7d72e5062306ff8c4b1

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 0937d934158bd2b6d4a0aba6790f872b
SHA1 6fc7aac45abb9c94fdeb5e8466a19b17e3af4261
SHA256 3cf648df2ffb1228b2e5eb50e55b9f033ae4f42b27ed610dd7bff76ea32abc90
SHA512 7b64eecc98936d519fbf7a899dee4f1d2053eaa2640c01767f9b889e127ae2ea88400e0c85481a2d11789877493433bfa79aece5afb124169b091b4f93e6b0b9

memory/1260-281-0x0000000000400000-0x0000000000654000-memory.dmp

memory/892-283-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/2432-284-0x0000000100000000-0x0000000100209000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 c44bd01bbf83dcec2c6c3e16ef6c6e46
SHA1 b222ca9d4b3aeff24a73b062cfb533c6d919f728
SHA256 907326ce7cbc9b38d339ac2330b2026d2690583edc38e4f18fcdca289d20f4e2
SHA512 8e6b649e48f3f1344e32d5332df0f2e2d5aae3dfe28d627c09d7ea4b3a1d4702ba0a3d872eecd2b62768d990b7030f1020936d70b691f143c5dc35836b86e4a7

memory/2432-287-0x00000000005A0000-0x00000000007A9000-memory.dmp

memory/2536-290-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2004-302-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 2c86100d7d78b4b41250d145e4d89606
SHA1 8ec43f7ad69ba527af7accde1406be1ee1337183
SHA256 87a61f6844feff4b0af070b496d4cad13b7421c249fac5ab8abbf97de9e3e44e
SHA512 3a87560d5587d4a617f7ae113f366dabce3f811d8706568da6d505e8e588836a0f8501c6ccbdbf3065c971fce75abb2f4aecfa69e34ae0116b67c92cb9eb4371

memory/1828-306-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2732-307-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2588-308-0x0000000100000000-0x0000000100542000-memory.dmp

\Windows\System32\Locator.exe

MD5 d8b378a79b674fd5c92a244bef3434b3
SHA1 d96f32db0337d0d09543bc9124087fe5218f9b0e
SHA256 e5cfbebb108968e95bbe73ddcfe702886bb9c97344d48958c490af77d3699022
SHA512 76b69ab638fa97f1cdfb45a2819899f22c331f3a6b12bae93d25b99eecde35b8127308ce680118bdf6ae9af0c02508ed6bd166f74fa44102d2fbd818bd0f1650

C:\Windows\System32\Locator.exe

MD5 d8b378a79b674fd5c92a244bef3434b3
SHA1 d96f32db0337d0d09543bc9124087fe5218f9b0e
SHA256 e5cfbebb108968e95bbe73ddcfe702886bb9c97344d48958c490af77d3699022
SHA512 76b69ab638fa97f1cdfb45a2819899f22c331f3a6b12bae93d25b99eecde35b8127308ce680118bdf6ae9af0c02508ed6bd166f74fa44102d2fbd818bd0f1650

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

\Windows\System32\snmptrap.exe

MD5 ea819fa7d2ba4c2d9ad0b48cc3032aac
SHA1 16f1ce4ffe17cbfb19a6489b9cfe4b196125ab3e
SHA256 f850819b8eb14f23e426cedbd42d5eb97f2f7ff24160f34fa6e92bb8151c392c
SHA512 1a345ae9d4d1ba7b64a33e0f11ee18edd2297925d0db34ff5bdb67bbc1d19fdb9d2d09963645e943758d9c693bcc0aa17f539da83c850c32dd98e81815f2e60e

C:\Windows\System32\snmptrap.exe

MD5 ea819fa7d2ba4c2d9ad0b48cc3032aac
SHA1 16f1ce4ffe17cbfb19a6489b9cfe4b196125ab3e
SHA256 f850819b8eb14f23e426cedbd42d5eb97f2f7ff24160f34fa6e92bb8151c392c
SHA512 1a345ae9d4d1ba7b64a33e0f11ee18edd2297925d0db34ff5bdb67bbc1d19fdb9d2d09963645e943758d9c693bcc0aa17f539da83c850c32dd98e81815f2e60e

memory/2784-340-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2808-341-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2928-342-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/1832-343-0x0000000000DB0000-0x0000000000E30000-memory.dmp

\Windows\System32\vds.exe

MD5 4c5fed60b4a9696580a649af6a8998f5
SHA1 77d05a492eed4b2607f6b2e650a1df52d15ab389
SHA256 b481ed95e87a6e321f020bd962375e02e90a597748f4dd621fe7d07314a3928b
SHA512 e89ad878bd2021630637138176e5fcd5a3f88c990b2a81a8a4fe6f4785d185f78ee114cf7d438c2046dab22d085ab141c4e7cf844c244a5a2d2a109a922ba8a0

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\System32\vds.exe

MD5 4c5fed60b4a9696580a649af6a8998f5
SHA1 77d05a492eed4b2607f6b2e650a1df52d15ab389
SHA256 b481ed95e87a6e321f020bd962375e02e90a597748f4dd621fe7d07314a3928b
SHA512 e89ad878bd2021630637138176e5fcd5a3f88c990b2a81a8a4fe6f4785d185f78ee114cf7d438c2046dab22d085ab141c4e7cf844c244a5a2d2a109a922ba8a0

memory/2808-366-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 eafffb05b23d28ba88c461e856c84514
SHA1 30a291d363a9c6f1c31e15dea3daed7127510dad
SHA256 45bd7194809f80aa770fe99634d8942fc2bc7231aedac5dd4e16258173c9d801
SHA512 ef6b46f2eee9fac1bfca3a583085d5d1cb1ebc5cf7978675258263b6c1a8b31ae56975839e81749ccaff14cea1b2f3c93e9b05e1fa237ce9ff2170718118b94b

memory/1108-371-0x0000000140000000-0x000000014013C000-memory.dmp

memory/692-372-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2360-374-0x0000000100000000-0x0000000100219000-memory.dmp

memory/1756-376-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3052-378-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/3040-380-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

\Windows\System32\wbengine.exe

MD5 b1eca918181430c27788a3af383c0948
SHA1 46ef61b97aa1e3c35d7039d9c75700191ef8aa52
SHA256 2ee10f6594c55f259dab005cd6085cff90d4023921cfe03697b65532b5cd7049
SHA512 d191e4e0d2a1c19f39503c724d45014b3911448873cfd5bd0c048020f618cdbfd1cd9563edf67c68ab3bb20171156c34943a247eeab5bdc946173d818922fd52

C:\Windows\System32\wbengine.exe

MD5 b1eca918181430c27788a3af383c0948
SHA1 46ef61b97aa1e3c35d7039d9c75700191ef8aa52
SHA256 2ee10f6594c55f259dab005cd6085cff90d4023921cfe03697b65532b5cd7049
SHA512 d191e4e0d2a1c19f39503c724d45014b3911448873cfd5bd0c048020f618cdbfd1cd9563edf67c68ab3bb20171156c34943a247eeab5bdc946173d818922fd52

memory/3052-395-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2484-404-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2596-405-0x0000000100000000-0x0000000100202000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 60d752f0a93ce358e65d2549eaf9afc8
SHA1 c48f6c3f1b2889620c26b2878c565124ded20f6a
SHA256 5006e4fafe9517f99ad5d6835acfd9d5acc92d33ab0952333463047402b7df3a
SHA512 e636dcf0f3cd9f70ebff6183e3d55ebbf02f944b4156fb80f4d2762f0e8e58c80737dc0cc484c3010b9e6fa3af3829e4acd9a8229fd4891ac377fa30e48e3366

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 60d752f0a93ce358e65d2549eaf9afc8
SHA1 c48f6c3f1b2889620c26b2878c565124ded20f6a
SHA256 5006e4fafe9517f99ad5d6835acfd9d5acc92d33ab0952333463047402b7df3a
SHA512 e636dcf0f3cd9f70ebff6183e3d55ebbf02f944b4156fb80f4d2762f0e8e58c80737dc0cc484c3010b9e6fa3af3829e4acd9a8229fd4891ac377fa30e48e3366

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

memory/2484-427-0x0000000000400000-0x00000000005FF000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 01480185f784f42274f722144dc737fe
SHA1 7df445c6e19e7529d10546cb3e6f27bb18139160
SHA256 5b8ce96439d77f7e8b71632a630aca705ceeb66002c4280b56e5b62b4c313d01
SHA512 1454cdfc970dabb2025cc5173ed4f3a7a39523cb4400bc9b2dd235a5c2d04e88202a9d78d492d67a7f2ada7414a416f8fef762a4250aab1e3412e387196d8d7d

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 01480185f784f42274f722144dc737fe
SHA1 7df445c6e19e7529d10546cb3e6f27bb18139160
SHA256 5b8ce96439d77f7e8b71632a630aca705ceeb66002c4280b56e5b62b4c313d01
SHA512 1454cdfc970dabb2025cc5173ed4f3a7a39523cb4400bc9b2dd235a5c2d04e88202a9d78d492d67a7f2ada7414a416f8fef762a4250aab1e3412e387196d8d7d

memory/692-431-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3032-436-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2780-440-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2888-442-0x0000000000400000-0x00000000005FF000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 01480185f784f42274f722144dc737fe
SHA1 7df445c6e19e7529d10546cb3e6f27bb18139160
SHA256 5b8ce96439d77f7e8b71632a630aca705ceeb66002c4280b56e5b62b4c313d01
SHA512 1454cdfc970dabb2025cc5173ed4f3a7a39523cb4400bc9b2dd235a5c2d04e88202a9d78d492d67a7f2ada7414a416f8fef762a4250aab1e3412e387196d8d7d

C:\Windows\System32\SearchIndexer.exe

MD5 3165afc571332294f6bec20fd5b85f1d
SHA1 be3c21d26f39313a7596f035b625a9cefc53d57f
SHA256 22aa2507bf1a297c734643cfc9ef6c849a80e3f6297433ef090ea8ad143a4fbe
SHA512 11714c570fec3c330e6c23849adcc6d1508c4355299e257189859a1be8606a636c12fa2e4d9d69ac1006c549a007a0414ace7cac984fd119f9b1e896a1197f64

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

memory/1832-468-0x0000000100000000-0x0000000100123000-memory.dmp

memory/2888-478-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2116-493-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2432-549-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2432-571-0x00000000005A0000-0x00000000007A9000-memory.dmp

memory/2536-572-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2732-573-0x0000000001000000-0x00000000011ED000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 bc96df88a3e214b05cd1ee3eff092f74
SHA1 6f0a74365bc3530da26861b65ca8953ab10b550a
SHA256 28377d2e413438770d443ee90bbb9de04228cf031d385b3d0fb6381b48f32e32
SHA512 b1bde5dbcb85c6d66c13eb0ccab1b85ab6e7426d0f436c8e3d4cfb06f8fe85b39af98a0672101a3043e48350035aaf17c05d5a885db92ba2c57be20dde5a1b6b

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 14:08

Reported

2023-05-01 14:11

Platform

win10v2004-20230220-en

Max time kernel

151s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9f3bd4abc0346ca3.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{12B41477-B896-4CE0-B721-49B4FD6AD28D}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9060db7367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1eeddb8367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a69b6ab9367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000750bcfb6367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000981612b4367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009697da91367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000658f54b7367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a1da7b8367cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 1432 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe
PID 3404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4704 wrote to memory of 4376 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4704 wrote to memory of 4376 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4704 wrote to memory of 2148 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4704 wrote to memory of 2148 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe

"C:\Users\Admin\AppData\Local\Temp\Quote 1345 rev.3.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896

Network

Country Destination Domain Proto
NL 8.253.208.120:80 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 52.152.108.96:443 tcp
GB 51.105.71.136:443 tcp
NL 8.253.208.120:80 tcp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
NL 173.223.113.164:443 tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 vcddkls.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp

Files

memory/1432-133-0x0000000000790000-0x0000000000930000-memory.dmp

memory/1432-134-0x00000000057F0000-0x0000000005D94000-memory.dmp

memory/1432-135-0x00000000052E0000-0x0000000005372000-memory.dmp

memory/1432-136-0x00000000052D0000-0x00000000052DA000-memory.dmp

memory/1432-137-0x00000000054D0000-0x00000000054E0000-memory.dmp

memory/1432-138-0x00000000054D0000-0x00000000054E0000-memory.dmp

memory/1432-139-0x0000000007270000-0x000000000730C000-memory.dmp

memory/3404-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3404-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3404-144-0x0000000003270000-0x00000000032D6000-memory.dmp

memory/3404-147-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3404-150-0x0000000003270000-0x00000000032D6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 897b5adff85a82501bd1b8acd971ea53
SHA1 8e239681bdcbf84b4053f36c55308c83b76ca971
SHA256 d535db236e59e212e393ba97050225bd424888b0a7c1c302c6e75e3a58f769c8
SHA512 ad51ff1a33d28b723034515a5f3842b2fc3ecd9ebb82e6ef1b5f25bce2e45819313ebe67d0733c90ec868fed356781371313bd4940c66a546750be3622b81da5

memory/908-157-0x00000000005E0000-0x0000000000640000-memory.dmp

memory/908-163-0x00000000005E0000-0x0000000000640000-memory.dmp

memory/908-168-0x0000000140000000-0x0000000140201000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 de8a11550b01aa775081ff586c34a004
SHA1 ffb92a1ed5ebb452e75ef859d6294579a2671c50
SHA256 ebea6f08f1ec3cbf6300c186d05242a4e871e85d88be45296eec8cbf3bfac167
SHA512 f4578fe511181f777b5a68ba9160b1248832fba6bcfd251e78caa4a8ba8110cbba29df303fc2af919e27056e67975b8603c9ae48478f415ed21d0a37d9f9191d

memory/5024-170-0x0000000000490000-0x00000000004F0000-memory.dmp

memory/5024-176-0x0000000000490000-0x00000000004F0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 c4e958fbe681fa001a5c4477afea220e
SHA1 1c37dcc4c79554eafb177b5e36bee7d8ee12064a
SHA256 9f8cfa7c4957ad87d43bd5003692906343eca9466275066e50c922714bb5f49b
SHA512 71bbb085e536bbbf38f29fcae5e735ed7399e1f3e3c36b08020407795091c4719dd78d24472961f626ab442fdf0f2a086522b4bf63bd9c9b931197a4c5b45a67

memory/5088-180-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/5024-183-0x0000000140000000-0x0000000140200000-memory.dmp

memory/5088-184-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5088-188-0x0000000000D80000-0x0000000000DE0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 8938157c5cfe791eb0d5a60876cacfdf
SHA1 d4761d9ffe4fbce565df0e9042c2491173154393
SHA256 7eaac00a07a664020ad9713a1964428506820dd0bbe4ba5e0ccc6c839cdea682
SHA512 37bb7b5501e9eec5bcf7a5d3cd3de8dc3546d8e7cb27d002a5340f3a14e7d31c103231c55a3f383cfb8c9887083ee8800c225ece6f6d662f9c3d7b663d1f6bb1

memory/4372-192-0x0000000000C40000-0x0000000000CA0000-memory.dmp

memory/4372-198-0x0000000000C40000-0x0000000000CA0000-memory.dmp

memory/5088-200-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/5088-203-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4372-204-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 235791bc93f488903d8256d3bdecfb67
SHA1 7bd3a050739bd0070e3ba38152d82f9650b5ea34
SHA256 81dac74883dec2b7b81dad27b0f4e26afb0e0d8e5f7ab391a0d4f175e2566f3c
SHA512 f2cbf84a40da4a6c92e0ae33088e431790f3d1fec23948233083dfb21d8e0e67984e15de1477b1a7da01a0c1d9938ecbeb7c19c277a3dc15356d166510fe14bd

memory/1584-206-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1584-212-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/5064-216-0x0000000001A70000-0x0000000001AD0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 772a1b122bc94e0ef865375497fd5173
SHA1 51efe02401ad216a1e8c10e3d750cd6c3b604487
SHA256 2f61a29406d566ecf2527241c9a62c09221f3c69b7b34d3144cac2bbca9cef61
SHA512 8519ec7f6404bede17f1250e1f5267fc5d52cfe2654f19b0ad7cc74e37f2a083d95f881204136e01dec1f6e591cf98cab7111850e2dd9675f3bed5e046de53aa

memory/1584-221-0x0000000140000000-0x000000014022B000-memory.dmp

memory/5064-223-0x0000000140000000-0x0000000140221000-memory.dmp

memory/5064-224-0x0000000001A70000-0x0000000001AD0000-memory.dmp

memory/5064-227-0x0000000001A70000-0x0000000001AD0000-memory.dmp

memory/5064-230-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 c2c05321d825e529e9ea3d0fb9490802
SHA1 b24c8322d4976b7353e1db22bd87e6b50f4df9e4
SHA256 b5643f1dd5094062d8352aebbdc317b9af60e0475fa4aa4d85136691e5a675da
SHA512 848a8ebaa37034ba6c058a56d19f2521077739294e7f86b2dff549de7b876565533d8ba154a0fa66d3e401b3ccaadb116ece1abb7bfd3cced34d049260908e62

memory/4368-232-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/4368-234-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 29af44788e8c2f5f868984d706249f73
SHA1 d9c9be2b2e255aa4193bcbf48b90a261997448a4
SHA256 82d0cc8610c9da8d117eaa8618effcd50ee5812174de7b6cad3aec32797c8f28
SHA512 d207c9bd7da451bb49d1664fdc750c082abcfd95f648e97f73bfb2348906bb689a9da5cc1c9e743452c8e424f3e585040515aa524efd78f1aec6d621720f75b8

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 f78599b31d65fae912cf298ad79a163b
SHA1 3c9fa0b5cde8b72381d594f87515bac68ee82217
SHA256 75d7a9e58a91acd9aeaa07967db82eaed905edae39be0c5776dafb40970e864b
SHA512 4b27143e2769f3a2add3708e1ef262dad1d34f50f5379d8eb4ca8d3f2966e824b172607f026dfe9831609377d8c364ba9a598a161323d2b6070a845b309b382f

memory/4420-257-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3880-258-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 c543ef47d45d8b34fc6c5daa0b1b9b52
SHA1 59bc52f381566e3d52db9c2c8b783a1aabcec7f2
SHA256 4dfd126315cbc7a530d2ee70636f0091b01714b78d5fa68b2ab351ff8e91c1eb
SHA512 a5685afe8ac4cb18fe7c0b0759b1b757932af1ca7b082bea7f327680ecd003296ffb76338b738fe6fcd7832917f1cefb078bbe28577ae64806345d4b8687afbb

C:\Windows\System32\Locator.exe

MD5 466d70bf7eb1732c57f25bedbe285282
SHA1 b2de4ef7b84e6dd62674d87e483f405ddff092a9
SHA256 2869e9352eec74d6cf23f6a7a7765696e6ad4214df6d443e21f9b0a08b683ef9
SHA512 3916e9cbe5027f28769bed8aa608263904dbd100a5959735e09cd884cd32492b5c77816dc542f64169afc7410e7a62769359278b2aca98f251bdb7706ab7f4e1

memory/656-287-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 edfc82f41046bc79efcc9e51c1eb41ff
SHA1 30724668c5e531b4b933c7f8bb6b0827212f02b6
SHA256 043b10280177801e7b13fefba1274a38f9b51a6ef5279095531c1c07bff9c438
SHA512 3d220a7dcdc608c1194ce5aae4c96066e6825b4051d51e8ae852c7518056f57c0ea45182037eca95575ee7ca19a184b36b1d80f9ada546428e94fdcae085825f

memory/744-291-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 68d6bcb3ccb89afb836437cbe4fc99f5
SHA1 a0e079fd7e492632ad5f1fca59695bb82f33adf8
SHA256 0cc4bd52c9f8ffeb76b08b194e0c0da812b3d667da9ad107918a82b5cb2d57ea
SHA512 210e5b18fa306e5e23e1f280d3abd52dab465bd2c976d2d2650d55f001ef427b8cef95260c91e21a41674abb05dd1cf1e492ce971d86edafe0ea5e95303e6d56

memory/4360-309-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1764-311-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 586b8737ff34d8552dd131f0dbd9b442
SHA1 30cf524936656cfd778f59e60c3151f602074eef
SHA256 d416335455f13a7a9f3ea65fe7eea0a8083a820e1a46ce0baa06208cddf6b8fa
SHA512 670c80ef4dbbcc31175b218ff6f6e7ebd8b05ba429790754f8e466eaaf2046f08ba62fe575ac305120423f96e8c2337c853b90fb7afec7c7fb10c65c39562728

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 65f0d9aa248c7714f67164dc993016bd
SHA1 82f9bb8c5e8a0639da2d2b1a374df6045adb8aeb
SHA256 e416ce822a2e0c982086a846fbb138020a1aea7d775ac82e20c161fbe496331b
SHA512 4e4991e15da272e45c0d463df22f204d69e00fdf68317bd8965cfbd97ae98d9a877dffea2920ec027f342b4b10e669bbff17df43681672930ec9fadcedd99887

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 65f0d9aa248c7714f67164dc993016bd
SHA1 82f9bb8c5e8a0639da2d2b1a374df6045adb8aeb
SHA256 e416ce822a2e0c982086a846fbb138020a1aea7d775ac82e20c161fbe496331b
SHA512 4e4991e15da272e45c0d463df22f204d69e00fdf68317bd8965cfbd97ae98d9a877dffea2920ec027f342b4b10e669bbff17df43681672930ec9fadcedd99887

memory/3404-325-0x0000000000400000-0x0000000000654000-memory.dmp

memory/564-327-0x0000000140000000-0x0000000140169000-memory.dmp

memory/960-329-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 409dd794341d8180545b73a8f104746f
SHA1 bb6bf500d53d321d3f2141024b8863666e8a2f25
SHA256 03d4aad3b9d0772414f015cf2573bbceeb65903e8c7b07ba4647645ee5ee0b9f
SHA512 eb35883a5ede5914fdfd297e58cdaecb1719d3d0436e77a8fe7262ac54bba0b0475d44e762d015e7d184fece47a6707bd6a83979bf737573d9163fe2ab50bf63

memory/2796-345-0x0000000140000000-0x0000000140239000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 94f6b81efb9761b329511ff6e03af6ab
SHA1 ee9e603c55274fdf1c5666487c597494de2db695
SHA256 5bfc5cfdc1e8d3dfca8e9442eb7446ed2131a4abb8f84172fb6c9c0e719c29d7
SHA512 404f1e162ecea08d32f00617cef0ac9914be05dfef4a18c221148d74560bca49572de60c1ca72307bf74da590af2174caf4fa96f79928981f252efe72bdc2f2a

memory/4724-359-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 d6117c4ec0f0671ac640a4b32010a537
SHA1 96967ccf63f91a0b2fc139a4fb68e988d127a9a6
SHA256 803491667de451fd8f2c846f775822b529dcdc8b8c9a7a3b1b0e7b993152309e
SHA512 4ec425c3d10ad6fd18e27acf647178991e28f77ee113bee19534c35a96a0852e85fbe9cf12f796db1681926d4cb383e5ec1287218878caf5132bc7950409a16d

memory/4320-362-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 4e6bbbc72cdcd70edca3ddc6b97f3358
SHA1 a412ad6f38922e0a459d81c7e6dd37654fcc8c1c
SHA256 de427cfa7556664ce658096e681fb396cfe8645d7df1f068c649817e88034fec
SHA512 0ee709457c93be358cd6ed0e6a17e1eb98d03c780fb767c67e6e383118425ccbbef0912f903fdcb7d7b60bfd0e5984cfdd4d922134d50b88ab1b3fcccfe0dc5d

C:\Windows\System32\wbengine.exe

MD5 951ee305339ed875d363c262fe85bd2e
SHA1 ab92d9d84f9870d07d30c18e7d403bf31467ef69
SHA256 fbef1266300f710fe5edd8a661b1b9a4ea8ab17b433847ed4a6e988b8eb849c9
SHA512 a6bdd0d2743d90b3951f79d2164006b5134b27519bebd1660955fc44f6ed662f39a684baebb3d443d2e978144c4c169b7f3e375be95d0a2efece4da304a33c91

memory/4372-383-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3932-386-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1796-388-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 c2bcdfb349b356186caba26154c30680
SHA1 a21881e514ea0a1bb35d0083bd0c6c9b9904ef0b
SHA256 a0747113f94a892d9dec074bd785788edb59f93e122923c9690521fbcc81eeae
SHA512 2adf795ff8b28837fff0e02e11a4b7c1ccc79c553040e8f87fb974907e93b5dc39124485f9e1e5b7ba60b60b91880bae37cfd839668ff11fc3031ba24e873320

memory/1584-405-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4576-407-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 9312c43a716120bedb7e012a6cfe2791
SHA1 3dacdb31d250ae84b3ceef345366064cd2b4c4e3
SHA256 5f8c074f84a081e2b8bc6159dcd5a223442bc0d6fe520826d184e1e53f9ff873
SHA512 c0d3b9dcc479c73d104c0c858b1a781b981555ea3a97c0f252384698df2afa69c8ea13c353feb2995dfcea45aee82412ef2242d2186e29254bca8a4743783dfc

memory/4704-422-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4368-427-0x0000000140000000-0x0000000140210000-memory.dmp

memory/3880-450-0x0000000140000000-0x0000000140202000-memory.dmp

memory/4360-476-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4672-501-0x0000000000D00000-0x0000000000D66000-memory.dmp

memory/1764-558-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/564-576-0x0000000140000000-0x0000000140169000-memory.dmp

memory/960-578-0x0000000140000000-0x0000000140259000-memory.dmp

memory/2796-585-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4320-591-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3932-601-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1796-602-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4576-603-0x0000000140000000-0x000000014021D000-memory.dmp

memory/4704-604-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2148-712-0x000001F03FB50000-0x000001F03FB60000-memory.dmp

memory/2148-713-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-720-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-719-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-721-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-722-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-723-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-724-0x000001F03FB80000-0x000001F03FB90000-memory.dmp

memory/2148-735-0x000001F03FB80000-0x000001F03FB9A000-memory.dmp

memory/2148-736-0x000001F03FC70000-0x000001F03FC80000-memory.dmp

memory/2148-737-0x000001F03FC70000-0x000001F03FC80000-memory.dmp

memory/2148-764-0x000001F03FC70000-0x000001F03FC80000-memory.dmp

memory/2148-765-0x000001F03FC70000-0x000001F03FC80000-memory.dmp

memory/2148-766-0x000001F03FC70000-0x000001F03FC80000-memory.dmp

memory/2148-767-0x000001F03FC70000-0x000001F03FC80000-memory.dmp

memory/2148-768-0x000001F03FC70000-0x000001F03FC80000-memory.dmp