Malware Analysis Report

2025-01-03 07:39

Sample ID 230501-rg6qhaff99
Target 2168-140-0x0000000000400000-0x0000000000654000-memory.dmp
SHA256 96f62d789e0958b3dc3cf346997044f128d29098116e340786993b5308209806
Tags
blustealer collection spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

96f62d789e0958b3dc3cf346997044f128d29098116e340786993b5308209806

Threat Level: Known bad

The file 2168-140-0x0000000000400000-0x0000000000654000-memory.dmp was found to be: Known bad.

Malicious Activity Summary

blustealer collection spyware stealer

Blustealer family

BluStealer

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Suspicious behavior: LoadsDriver

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

outlook_win_path

Checks processor information in registry

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 14:10

Signatures

Blustealer family

blustealer

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 14:10

Reported

2023-05-01 14:13

Platform

win7-20230220-en

Max time kernel

151s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\10b30211328eb3a2.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1236 set thread context of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{22CBC9DE-0126-4AEC-B6EF-36F7E2D6E0DD}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{23B3ED7D-AFBA-458B-B990-CFC1D3A44876}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{23B3ED7D-AFBA-458B-B990-CFC1D3A44876}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{93021562-F32E-4A8C-AD1E-753ED8DA3E59} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{93021562-F32E-4A8C-AD1E-753ED8DA3E59} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1236 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1912 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1912 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1912 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1912 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1912 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1912 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1620 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1268 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 1672 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2104 wrote to memory of 2536 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2104 wrote to memory of 2536 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2104 wrote to memory of 2536 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1948 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1948 wrote to memory of 2216 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2104 wrote to memory of 2984 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2104 wrote to memory of 2984 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe

"C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 160 -NGENProcess 164 -Pipe 174 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 250 -NGENProcess 258 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 1f4 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 260 -NGENProcess 1ec -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1ec -NGENProcess 254 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 250 -NGENProcess 26c -Pipe 260 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 264 -NGENProcess 270 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 254 -NGENProcess 274 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 278 -NGENProcess 270 -Pipe 1f4 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3948302646-268491222-1934009652-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3948302646-268491222-1934009652-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1b0 -NGENProcess 1d8 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 280 -NGENProcess 284 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 248 -NGENProcess 264 -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 280 -NGENProcess 298 -Pipe 184 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 120 -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp

Files

memory/1236-54-0x0000000000230000-0x0000000000296000-memory.dmp

memory/1236-59-0x0000000000230000-0x0000000000296000-memory.dmp

\Windows\System32\alg.exe

MD5 98983aeb058fc59b66c942c17f738895
SHA1 ab1774c9f35e370f53dfd4f72af32a291a3bf978
SHA256 5d9d35d5f61be1556ef0a57e337ecf6b721a8700edc32055750f885329019e9d
SHA512 9c94c31644552b2206f21c6c7ba061511bce94859ce273ffde6bd421772ad2b8bf97961b54e4e3b10a3af06f01c18cbbc964169b3fcadb3d4e9202a39e635a74

C:\Windows\System32\alg.exe

MD5 98983aeb058fc59b66c942c17f738895
SHA1 ab1774c9f35e370f53dfd4f72af32a291a3bf978
SHA256 5d9d35d5f61be1556ef0a57e337ecf6b721a8700edc32055750f885329019e9d
SHA512 9c94c31644552b2206f21c6c7ba061511bce94859ce273ffde6bd421772ad2b8bf97961b54e4e3b10a3af06f01c18cbbc964169b3fcadb3d4e9202a39e635a74

memory/1108-67-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/1108-73-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/1236-77-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 e4f7db4f294e4a82d71b518a518c1320
SHA1 19220d3438bba453e8c12501a848827385b28ca3
SHA256 fcbedf2b0e2f22386332322ff7f8638cb81dc29df096a7ce1e1435646b5dc6e2
SHA512 b4b0df906cd559c72acc186ff26a06ff6fd3eb5228cd6b559ad77e8063d298e6bfa7582d5ffe2adb0fb943f36fd1c07581430ffc19624f9a5c92e7e03f232469

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 e4f7db4f294e4a82d71b518a518c1320
SHA1 19220d3438bba453e8c12501a848827385b28ca3
SHA256 fcbedf2b0e2f22386332322ff7f8638cb81dc29df096a7ce1e1435646b5dc6e2
SHA512 b4b0df906cd559c72acc186ff26a06ff6fd3eb5228cd6b559ad77e8063d298e6bfa7582d5ffe2adb0fb943f36fd1c07581430ffc19624f9a5c92e7e03f232469

memory/1108-78-0x0000000100000000-0x00000001001FB000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 8391112e576d10444716b0009b630f9f
SHA1 1e6d10015b7c97febce46cafcb9fe05e1f9f4e62
SHA256 0f3789aa43ee84c2074a9df59dbe4f186fc912cbabecbe4e002e1fd323dd7ec9
SHA512 c60208c2124e1f4c24bd1f0c71b862361df668c0f5770cff99e63c1a928d9cca33ddf111d6ef807a4ff41dcc60127e138980f6b2c98a9c9699af9ce97aa37d1e

memory/1284-83-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1284-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1284-85-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1284-88-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1284-90-0x0000000000090000-0x00000000000F6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 a652fdb5a7e5c3ffa1e160d6ace57632
SHA1 21cbcd4a226cc30102c1fabf9523439f113c6e0b
SHA256 6a13183eeb7411efff19b6d8aa0a93b9aebb60d37b40819573400e9d7b01a4fc
SHA512 8c8f36f492dc2471083374650e5f92f6fc8269e6ac36223e3a8d793be3ad02b2276b6423cc2be272f9e14693fb659dcd715b996258b6a66f99b6b8119de5eeea

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 a652fdb5a7e5c3ffa1e160d6ace57632
SHA1 21cbcd4a226cc30102c1fabf9523439f113c6e0b
SHA256 6a13183eeb7411efff19b6d8aa0a93b9aebb60d37b40819573400e9d7b01a4fc
SHA512 8c8f36f492dc2471083374650e5f92f6fc8269e6ac36223e3a8d793be3ad02b2276b6423cc2be272f9e14693fb659dcd715b996258b6a66f99b6b8119de5eeea

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 a652fdb5a7e5c3ffa1e160d6ace57632
SHA1 21cbcd4a226cc30102c1fabf9523439f113c6e0b
SHA256 6a13183eeb7411efff19b6d8aa0a93b9aebb60d37b40819573400e9d7b01a4fc
SHA512 8c8f36f492dc2471083374650e5f92f6fc8269e6ac36223e3a8d793be3ad02b2276b6423cc2be272f9e14693fb659dcd715b996258b6a66f99b6b8119de5eeea

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 8391112e576d10444716b0009b630f9f
SHA1 1e6d10015b7c97febce46cafcb9fe05e1f9f4e62
SHA256 0f3789aa43ee84c2074a9df59dbe4f186fc912cbabecbe4e002e1fd323dd7ec9
SHA512 c60208c2124e1f4c24bd1f0c71b862361df668c0f5770cff99e63c1a928d9cca33ddf111d6ef807a4ff41dcc60127e138980f6b2c98a9c9699af9ce97aa37d1e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 653258f67fa86585811004e735c21a11
SHA1 35b9e4c4a42b4f6e3e8542c9df433a53e5a60bb8
SHA256 ee7c26d038765484b59c145aad6d295c6ca4e1418a8dad17c0e16da5cd182088
SHA512 f1168b74efdeadc93e0d61c26e8d6e598d04a7983cca21262facb118089851c9f67dd261366a1a7e0102bbfe7e5d14d4286b1c3c0ce2f84b6422879bb36ffaae

memory/1756-105-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/668-108-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1948-107-0x00000000002F0000-0x0000000000356000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/1504-110-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1948-114-0x00000000002F0000-0x0000000000356000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 fd360e853a55a8207e49e6963cea3996
SHA1 5a71e67583540a1f27da2826c252a894dedd6b4e
SHA256 ab4360b84635d69c353e2231ef2c3f6ec3877257d0985a533f93c4279bef7ffc
SHA512 c565c6039b5581c81414f71faf76edb9b388511df0b7f62a556f95ef3e7d195c46f01928622a0a32dffaceafe72752677246a427dda3770ebd6646427d1681b5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 6b63ce57eaa30596799a5fc64181561a
SHA1 25a4288c598269c6e60789b7941fa7e358740f9d
SHA256 dcf2f5fce8bfc05689cf93428484369a11cce625ff4b5f76452778400f0efa08
SHA512 2f1de989bfcbad2858f9ed2edb253c3d88ae63e44ec53e8d9c82cb8d1e54a4c124a10db2508596ea5db1eb4812177c03bb0f0091922ea0904365ce809ed3a3ed

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 6b63ce57eaa30596799a5fc64181561a
SHA1 25a4288c598269c6e60789b7941fa7e358740f9d
SHA256 dcf2f5fce8bfc05689cf93428484369a11cce625ff4b5f76452778400f0efa08
SHA512 2f1de989bfcbad2858f9ed2edb253c3d88ae63e44ec53e8d9c82cb8d1e54a4c124a10db2508596ea5db1eb4812177c03bb0f0091922ea0904365ce809ed3a3ed

\Windows\System32\dllhost.exe

MD5 6c6e73158596002058c98369be67223b
SHA1 bb2bece0fbcbb28b4d0a4628547762936b058aab
SHA256 4bc7efa3bf818994ac5367e296553b049e80d549d4ed8b357d42c5d057cc1ef3
SHA512 d6a1277260e1c493e8c6b6a447da95c215b3c08169ac5eb73f1f346592f3be62f16f058ace5a023b31320ff705bb21014508dedc7110f8c01c0e6d2804631078

C:\Windows\System32\dllhost.exe

MD5 6c6e73158596002058c98369be67223b
SHA1 bb2bece0fbcbb28b4d0a4628547762936b058aab
SHA256 4bc7efa3bf818994ac5367e296553b049e80d549d4ed8b357d42c5d057cc1ef3
SHA512 d6a1277260e1c493e8c6b6a447da95c215b3c08169ac5eb73f1f346592f3be62f16f058ace5a023b31320ff705bb21014508dedc7110f8c01c0e6d2804631078

memory/1948-130-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/912-131-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1912-132-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\ehome\ehrecvr.exe

MD5 8e9c1313a3e1154c9c292fa2b072cb2b
SHA1 926f218c154eff707a3bd3e123f7f4da5f2583ec
SHA256 72ea14b4dd22d285dddcfa3dac77603f9a7cdb2c9c5839af52cd82ec4927bb2e
SHA512 8d63f32f2f256f7d0aa0d4b8869b84ad5b7a40651de05936fbd26b543a4d4b2e31de4a3c1d3b47c0eb6a447db200ccb11da0a329a2cdd2b4804e7f57a0078d8e

\Windows\ehome\ehrecvr.exe

MD5 8e9c1313a3e1154c9c292fa2b072cb2b
SHA1 926f218c154eff707a3bd3e123f7f4da5f2583ec
SHA256 72ea14b4dd22d285dddcfa3dac77603f9a7cdb2c9c5839af52cd82ec4927bb2e
SHA512 8d63f32f2f256f7d0aa0d4b8869b84ad5b7a40651de05936fbd26b543a4d4b2e31de4a3c1d3b47c0eb6a447db200ccb11da0a329a2cdd2b4804e7f57a0078d8e

memory/664-136-0x0000000000820000-0x0000000000880000-memory.dmp

memory/664-142-0x0000000000820000-0x0000000000880000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 c857ed641c40a518acc1bb59f1c687fc
SHA1 c227247b6adf3fe442127d16a03b18034a5234af
SHA256 67e11b67ac35eee1e9d9b8b02a607b0995938e374fca21721993dc8e093e1fff
SHA512 35ecc69bab838bff085db4ea009013ef95533044b17c8dfd198258bbb2755587632282135c0ccb93f558e497e9e964bd9a243b67e5cbda6cfbdb4ffd3a9add13

C:\Windows\ehome\ehsched.exe

MD5 c857ed641c40a518acc1bb59f1c687fc
SHA1 c227247b6adf3fe442127d16a03b18034a5234af
SHA256 67e11b67ac35eee1e9d9b8b02a607b0995938e374fca21721993dc8e093e1fff
SHA512 35ecc69bab838bff085db4ea009013ef95533044b17c8dfd198258bbb2755587632282135c0ccb93f558e497e9e964bd9a243b67e5cbda6cfbdb4ffd3a9add13

memory/1284-148-0x00000000008D0000-0x000000000098C000-memory.dmp

memory/664-149-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1284-150-0x0000000005060000-0x00000000050A0000-memory.dmp

memory/664-153-0x0000000140000000-0x000000014013C000-memory.dmp

memory/664-152-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1704-156-0x0000000140000000-0x0000000140209000-memory.dmp

memory/664-157-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 6b63ce57eaa30596799a5fc64181561a
SHA1 25a4288c598269c6e60789b7941fa7e358740f9d
SHA256 dcf2f5fce8bfc05689cf93428484369a11cce625ff4b5f76452778400f0efa08
SHA512 2f1de989bfcbad2858f9ed2edb253c3d88ae63e44ec53e8d9c82cb8d1e54a4c124a10db2508596ea5db1eb4812177c03bb0f0091922ea0904365ce809ed3a3ed

memory/1672-161-0x0000000000AA0000-0x0000000000B00000-memory.dmp

memory/1672-167-0x0000000000AA0000-0x0000000000B00000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 6b63ce57eaa30596799a5fc64181561a
SHA1 25a4288c598269c6e60789b7941fa7e358740f9d
SHA256 dcf2f5fce8bfc05689cf93428484369a11cce625ff4b5f76452778400f0efa08
SHA512 2f1de989bfcbad2858f9ed2edb253c3d88ae63e44ec53e8d9c82cb8d1e54a4c124a10db2508596ea5db1eb4812177c03bb0f0091922ea0904365ce809ed3a3ed

memory/684-170-0x0000000000400000-0x0000000000460000-memory.dmp

memory/684-176-0x0000000000400000-0x0000000000460000-memory.dmp

memory/1672-179-0x0000000000AA0000-0x0000000000B00000-memory.dmp

memory/1672-180-0x0000000140000000-0x0000000140205000-memory.dmp

memory/684-181-0x0000000140000000-0x0000000140205000-memory.dmp

memory/684-182-0x0000000000400000-0x0000000000460000-memory.dmp

memory/684-184-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1620-188-0x00000000002E0000-0x0000000000346000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/1620-199-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1312-202-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/1312-217-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/864-218-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/864-229-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/1268-238-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/548-239-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/1268-254-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 29ea11306ee39c726b0595524e16f927
SHA1 edd70b5c97321cee69da9e86d0cc9383eacf9bdd
SHA256 bcc09552d1409f5b1332a6598137895d11a155f44a31ec6d0ef47899f5f39c61
SHA512 44d013bfbd7088178432071c6b1b793e2361718b9f8e6133ad3e48551949f1aba448eb47ad84bd6f5d64e136cf4c7f209b41b6eceb5263e42db06df89e32f25e

memory/1688-265-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1672-266-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 a15604ff1829ec150af87daf221e0e4a
SHA1 446096e74c3af3b165a7e256c1a250deb59b7012
SHA256 07642e64a830bece8e8c4161ca9ee9fcd9418ac80d242eaa9e628c30e5f7ec88
SHA512 81410d17bdeb33d8dcc377d12f51f08db16e78c57d38d9bbc47697849851d88dbe9ef57e943ca5232621803603dfa893c6a918cf01537b63dfad5151acafd1ca

C:\Windows\System32\ieetwcollector.exe

MD5 a15604ff1829ec150af87daf221e0e4a
SHA1 446096e74c3af3b165a7e256c1a250deb59b7012
SHA256 07642e64a830bece8e8c4161ca9ee9fcd9418ac80d242eaa9e628c30e5f7ec88
SHA512 81410d17bdeb33d8dcc377d12f51f08db16e78c57d38d9bbc47697849851d88dbe9ef57e943ca5232621803603dfa893c6a918cf01537b63dfad5151acafd1ca

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 1756b2c96263a8a9477069e6038b8b30
SHA1 8833f0e9e835d2cb0d350edcd4da2f321918fadf
SHA256 8d2afc5acee8bde116917e333bc7f13d2e6211f7601ec363086757f569c91f11
SHA512 927eeac35987debe50a9b8d68fb6d40478eb7adb5e3ba6b142805a299e38d782beb9399fdad9ecfb68b9df284a65ee0cbb44f5a4fe90eca949e7430a625b6c3b

memory/1236-285-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1612-287-0x0000000140000000-0x0000000140205000-memory.dmp

memory/472-289-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 8e1f94571bea7cc90cf132b71ca6d26a
SHA1 7d7d2fd7cfce62281075c937b316c9cdc99471f1
SHA256 65adc34ad5ea4d715e4877171daf8957266386e2559ec0576fc3110c10874b24
SHA512 09524e2218587e95b3cd7718524355eb37315653270109552c18050d5e89267bcf98fe4691eb63241f5bcc4145f58bb93046a3bafaa2cdb432619b559afb62e0

memory/1164-303-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msdtc.exe

MD5 219d8e3ca44bb43a7e087aa84fc14d2d
SHA1 926785647c1777ec31726a7741b0dee2b63d4ba8
SHA256 9da59ad40bce83305475b456404c545f0b90da9e503c895f35c29cea074263cd
SHA512 cc2527eb7e163242ffb33c9ff6d7ef317544650206fc52ce1081dbae19b5888c8a9e3bfcba6e903b18a6a380c1085969c6bdf7e2d80913c9953278f8ecb4a272

C:\Windows\System32\msdtc.exe

MD5 219d8e3ca44bb43a7e087aa84fc14d2d
SHA1 926785647c1777ec31726a7741b0dee2b63d4ba8
SHA256 9da59ad40bce83305475b456404c545f0b90da9e503c895f35c29cea074263cd
SHA512 cc2527eb7e163242ffb33c9ff6d7ef317544650206fc52ce1081dbae19b5888c8a9e3bfcba6e903b18a6a380c1085969c6bdf7e2d80913c9953278f8ecb4a272

memory/628-310-0x0000000140000000-0x000000014020D000-memory.dmp

\Windows\System32\msiexec.exe

MD5 9b093a56352f951b77e42160c72eb5b1
SHA1 3abd0dba21243065eae5d6f2e40160df92db4491
SHA256 624a229980b912853507415a52de1cacf363a9067c778536a30b963dc8eb2977
SHA512 859d72ca3658f526ab343996e09a9d85075fde905e4d0bc597dafa29a7aeb297d420120dd0b7691ee1f938be42bce445c886e2f852bef592673c545298e7ba99

C:\Windows\system32\msiexec.exe

MD5 9b093a56352f951b77e42160c72eb5b1
SHA1 3abd0dba21243065eae5d6f2e40160df92db4491
SHA256 624a229980b912853507415a52de1cacf363a9067c778536a30b963dc8eb2977
SHA512 859d72ca3658f526ab343996e09a9d85075fde905e4d0bc597dafa29a7aeb297d420120dd0b7691ee1f938be42bce445c886e2f852bef592673c545298e7ba99

C:\Windows\System32\msiexec.exe

MD5 9b093a56352f951b77e42160c72eb5b1
SHA1 3abd0dba21243065eae5d6f2e40160df92db4491
SHA256 624a229980b912853507415a52de1cacf363a9067c778536a30b963dc8eb2977
SHA512 859d72ca3658f526ab343996e09a9d85075fde905e4d0bc597dafa29a7aeb297d420120dd0b7691ee1f938be42bce445c886e2f852bef592673c545298e7ba99

\Windows\System32\msiexec.exe

MD5 9b093a56352f951b77e42160c72eb5b1
SHA1 3abd0dba21243065eae5d6f2e40160df92db4491
SHA256 624a229980b912853507415a52de1cacf363a9067c778536a30b963dc8eb2977
SHA512 859d72ca3658f526ab343996e09a9d85075fde905e4d0bc597dafa29a7aeb297d420120dd0b7691ee1f938be42bce445c886e2f852bef592673c545298e7ba99

memory/1164-330-0x00000000005B0000-0x00000000007B9000-memory.dmp

memory/1164-329-0x0000000100000000-0x0000000100209000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 93f188a10ae59a76626f28c2ee6bc7e3
SHA1 a689c9041579749df61e4783b10779aa57c8e27e
SHA256 5d9964a77882d03353de3b6873f876d7493babdfeaf0d965efe3152ba87e15b5
SHA512 791ec48a388bae4811494ab7f39d8ddd06dbbd1de1c62fe8e95a1c46a90b3030354a909d53218909b310be306359e9d56627ff388594dc630cd31042e11b662f

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 9fb5dd45e190d3f65dde3fe574cb1c2a
SHA1 ef6446bb3312fa3dcd900a014d189fe0232380bf
SHA256 0bd231fabafec2eccf3c98d2a1100b2bbd26b862e024afe16a2a24ff16151843
SHA512 25426fe06f58e99a42e2db154054130fa3832d7c8872d697e3526a8e123fef63eb481550f8e74c8ab566f2cb7271337bbfa05e50e0559b40d943e7a9e75f6490

memory/664-344-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2124-351-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2168-353-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2180-355-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 0476f8d660ea90584effd4f51ccfc909
SHA1 50261d7ec04e15bbb68c8fe82a060c9166823a68
SHA256 64303e781daebe06fd14c51e870c0b5b6bbdb4906f21e7d906a9a91995e8d2eb
SHA512 f57928dbda8d092effb24625aff6bda6eb2437bc861faf46af3ed134a09a39231f2d043705d23657cdb50ae061f3e7496007f0404895702e40d2422419ef05ab

\Windows\System32\Locator.exe

MD5 e8fb69d2d64aaf610e138981e19e77c0
SHA1 6cef41dbba520fc5f8ac8d278e290a46cf0d353a
SHA256 1e9b01133d9f45d03c60f3688d2ab08f3ee4cbf2638dfb425d0cc79c755403d0
SHA512 b84417fd18f7491a869b7a8d0ae3431e815781d1925a7d459837b9d9681a07d555a6307f1940503bdf7c945c30b019067b5405bdfc5f7f1961723ea6477055c5

C:\Windows\System32\Locator.exe

MD5 e8fb69d2d64aaf610e138981e19e77c0
SHA1 6cef41dbba520fc5f8ac8d278e290a46cf0d353a
SHA256 1e9b01133d9f45d03c60f3688d2ab08f3ee4cbf2638dfb425d0cc79c755403d0
SHA512 b84417fd18f7491a869b7a8d0ae3431e815781d1925a7d459837b9d9681a07d555a6307f1940503bdf7c945c30b019067b5405bdfc5f7f1961723ea6477055c5

memory/2372-367-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2412-369-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1672-375-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 c08e9c8b6b5f5a65fc55b2d21404f47b
SHA1 141b514c6121f3203a723717ae389404638a8afb
SHA256 c4d3e449746c4c5dad46429ffe2538f6803795fe3180e9f885ea14c2545d2031
SHA512 c422fc42628892b240ec319e46256cd760a3079c82e9fada85f9b9f4531036069c98afd705c9a3269d2821327ce6430b9afd525883d28e33d573297e3e874019

C:\Windows\System32\snmptrap.exe

MD5 c08e9c8b6b5f5a65fc55b2d21404f47b
SHA1 141b514c6121f3203a723717ae389404638a8afb
SHA256 c4d3e449746c4c5dad46429ffe2538f6803795fe3180e9f885ea14c2545d2031
SHA512 c422fc42628892b240ec319e46256cd760a3079c82e9fada85f9b9f4531036069c98afd705c9a3269d2821327ce6430b9afd525883d28e33d573297e3e874019

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

\Windows\System32\vds.exe

MD5 42c7507ba9c873860fa9c740f4a15a41
SHA1 ee91ac4bc33f9597b0e04e19c55658af24a4e300
SHA256 4426ca11b2fcc525fc088ab3abd38c4ee36b2ab10fa4252d07acb1f2865d2ae8
SHA512 14e96f4cc8bf7bb5c0f41da193161e5f5952e634bef7b56c004146e8bf761ddf8b52bd22527c8fcba740203e900a095d94004103989004a140ccd871c8c4ee62

C:\Windows\System32\vds.exe

MD5 42c7507ba9c873860fa9c740f4a15a41
SHA1 ee91ac4bc33f9597b0e04e19c55658af24a4e300
SHA256 4426ca11b2fcc525fc088ab3abd38c4ee36b2ab10fa4252d07acb1f2865d2ae8
SHA512 14e96f4cc8bf7bb5c0f41da193161e5f5952e634bef7b56c004146e8bf761ddf8b52bd22527c8fcba740203e900a095d94004103989004a140ccd871c8c4ee62

memory/2500-400-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2596-402-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2620-404-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 1631144ee17b8050fe94f185d8f791ee
SHA1 bac64979e1f1fc1b76ca531a7c4e07f815a5439c
SHA256 e053986505dc555c8e050debf34389211bef697517f9adddfab0051904f4fbec
SHA512 4eb11e4ff40b520035b3b87010152dec74b3a947db56bca93b44bec58d8b5b3cc2e20cf5ae9a327ddbdd252836d2bec02f7ba3884e8fc16a913d14480c9e9fa4

memory/2756-419-0x0000000100000000-0x0000000100219000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 044330fb39bf64faee14aa14d92729ce
SHA1 405e8adf0d2b635f784072549b7736669fcb1188
SHA256 5fd666977c4f4b565d3c663d56315d1cadc44f3cc1371c74a99de91fafba1605
SHA512 e4dd1ff880d9bd6d8b44c6d99f60db0f37be12d87c39c01869860abf08292303c906d77c36841e40d3388cdeefa8f07bfab511c4c1b0af4116609a558d0aaf21

\Windows\System32\wbengine.exe

MD5 044330fb39bf64faee14aa14d92729ce
SHA1 405e8adf0d2b635f784072549b7736669fcb1188
SHA256 5fd666977c4f4b565d3c663d56315d1cadc44f3cc1371c74a99de91fafba1605
SHA512 e4dd1ff880d9bd6d8b44c6d99f60db0f37be12d87c39c01869860abf08292303c906d77c36841e40d3388cdeefa8f07bfab511c4c1b0af4116609a558d0aaf21

\Windows\System32\wbem\WmiApSrv.exe

MD5 452c4f328ae6537ad9032222eb1a6efa
SHA1 d8d9675536d56dc674eb0933d821316146e7c145
SHA256 702185a3fef8ac67afef1ae427bd02d3be2ee1ac180edbf264345fa7e1d6577f
SHA512 1e27ebd8ab21eeee0497977172aa0fbe79d40815ab6c76c4553a4cc9c744671237abd5d05f21ceeae97cedae6cb5937a52dddf194ac363f5b31593b09d1a302a

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 452c4f328ae6537ad9032222eb1a6efa
SHA1 d8d9675536d56dc674eb0933d821316146e7c145
SHA256 702185a3fef8ac67afef1ae427bd02d3be2ee1ac180edbf264345fa7e1d6577f
SHA512 1e27ebd8ab21eeee0497977172aa0fbe79d40815ab6c76c4553a4cc9c744671237abd5d05f21ceeae97cedae6cb5937a52dddf194ac363f5b31593b09d1a302a

memory/2852-442-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2932-444-0x0000000100000000-0x000000010021B000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 b643744832f0c8e4b3b6df3afaa6b25d
SHA1 417d4aaf32e7987a3eb9e5de88c8d0f9fe5615a1
SHA256 6c64c5881430144327eb8fd5b3cbee6dda169891553fc7121aa3b75caf5578ad
SHA512 da972e61517271a76be151f3bd1114df2b69315761eb1e91c0f4af8d4f50f54ac1974ffcd5b63156b00565f8f1cdcf3a24e042459c8cd59610ffce99e0529d64

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 b643744832f0c8e4b3b6df3afaa6b25d
SHA1 417d4aaf32e7987a3eb9e5de88c8d0f9fe5615a1
SHA256 6c64c5881430144327eb8fd5b3cbee6dda169891553fc7121aa3b75caf5578ad
SHA512 da972e61517271a76be151f3bd1114df2b69315761eb1e91c0f4af8d4f50f54ac1974ffcd5b63156b00565f8f1cdcf3a24e042459c8cd59610ffce99e0529d64

C:\Windows\System32\SearchIndexer.exe

MD5 672367454ba007885bdd1bcedfbd52d5
SHA1 0c7d438a10f4bd6315af0e9d7287e245453ab897
SHA256 5a04cea56424a87b13c6c3529acbf6b503d4029d1ea37eb5b9fcc9043f1040c2
SHA512 41f160140fbc99dcd5ce67db93f3753997e1caa6e834ed0435873fa47f55459b08167802616f69e6cebbab0853e756542c192c04769b0f2c1ef1d021507f6925

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 b643744832f0c8e4b3b6df3afaa6b25d
SHA1 417d4aaf32e7987a3eb9e5de88c8d0f9fe5615a1
SHA256 6c64c5881430144327eb8fd5b3cbee6dda169891553fc7121aa3b75caf5578ad
SHA512 da972e61517271a76be151f3bd1114df2b69315761eb1e91c0f4af8d4f50f54ac1974ffcd5b63156b00565f8f1cdcf3a24e042459c8cd59610ffce99e0529d64

memory/3032-473-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2104-474-0x0000000100000000-0x0000000100123000-memory.dmp

memory/1688-489-0x0000000140000000-0x0000000140237000-memory.dmp

memory/472-502-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 603b03cd3fb07d905d5bd2baf23e77c6
SHA1 1dfd2c27609d2a35612a38632b2cdb8d9659d40a
SHA256 8b6f97b1a606204d4b4ed9f377d34afbfd67c6fdf2fa09bdf806668c763b8782
SHA512 4e70e5bf808bb642b039711cf31c8843e481cb861fd27872ac489a1fe8b49d991cd2b101052225c168359a631934338d6e1fb579b560e1f3313129fcd070d19d

memory/628-571-0x0000000140000000-0x000000014020D000-memory.dmp

memory/1164-611-0x00000000005B0000-0x00000000007B9000-memory.dmp

memory/1164-608-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2168-616-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2180-617-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1612-631-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2412-636-0x0000000100000000-0x00000001001EC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

memory/2728-655-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2596-656-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2980-658-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2620-657-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2756-659-0x0000000100000000-0x0000000100219000-memory.dmp

memory/2852-660-0x0000000100000000-0x0000000100202000-memory.dmp

memory/2932-661-0x0000000100000000-0x000000010021B000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 19f316aae49a766ae447a9d1fec682aa
SHA1 55f90c1f62de6d2bcd1785745e6a93d62892bcbd
SHA256 1a6f352abbc2de5fb38533d569e13cbaecce774ba1d5815f69daa90eba914405
SHA512 71c6e30d55ee0b579891b67c7c0b8e0814741b39f450c191037fe3c6ae0426d26c44dc168d978c29e0be5b8686fe832b81de4ad07d9f452c1131c97dc6bc0856

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 14:10

Reported

2023-05-01 14:13

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2254130cea807a0f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2128 set thread context of 1508 N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3161294477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aa58093477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d34c6a94477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d175b95477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a9cb090477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009abb3693477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b721dc92477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcce2a93477cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe

"C:\Users\Admin\AppData\Local\Temp\2168-140-0x0000000000400000-0x0000000000654000-memory.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 254.5.248.8.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 36.146.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 20.189.173.9:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 50.4.107.13.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 76.74.6.107.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 61.13.50.169.in-addr.arpa udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 199.21.76.77:80 gnqgo.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
US 8.8.8.8:53 gnqgo.biz udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 199.21.76.77:80 gnqgo.biz tcp
US 173.231.184.124:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 173.231.184.124:80 jhvzpcfg.biz tcp
SG 72.5.161.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
SG 72.5.161.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp

Files

memory/2128-133-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2128-134-0x0000000002500000-0x0000000002566000-memory.dmp

memory/2128-139-0x0000000002500000-0x0000000002566000-memory.dmp

C:\Windows\System32\alg.exe

MD5 d4002dd280afa73353caa646019d674b
SHA1 3b02d1a4e4f3db58b9438931d70a1080e5ff3c97
SHA256 e1ce9ef3b73a89c6da0b32e537f68030acf2f327ff6373f311a1139a452e06ee
SHA512 965e5a44be56eb2501004a5048a1a039c3ef05491e7a10e8b21a04e139990ec756df26bb077a06c945450afc864ff6dee95b7555ac9b39a3e2775cf45e5f2aa3

memory/1788-146-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/1788-152-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/1788-154-0x0000000140000000-0x0000000140201000-memory.dmp

memory/1120-159-0x0000000000410000-0x0000000000470000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 cea5ef5e52ef9b1850bc62f471e1ea2e
SHA1 37e7138c62f4542befbaf692bc464eaa8f5b29f9
SHA256 f6a9821e30a3f4977ec1a431c4675d5696b008326f5fa2ff6d2b7a0ea088e976
SHA512 2de1b09186656b6fa2559f5533c636810b0d95323014177b59cd840de26f8f81929166d097df6943aa8c4439abcf133d3cf5a2201e6f3f4f3745370f9245eb41

memory/1120-165-0x0000000000410000-0x0000000000470000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 e094e1d6e0fa94009b3f0fcf0f3607af
SHA1 a725698edf8665c300ca3982ac255385cf10c910
SHA256 bba03f0382b04bbd21ee05ce497ca176cd0945ca4049aa293bb2fe14fd271842
SHA512 4783620a36d75af3db57b58e0b782d999bf82358d1b3a5e5fa82f1d16997745afcf8a506230fdf7b4cf8e18d149037cf5169ecd532c43036dc021dcd2e728f6c

memory/3116-169-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/3116-175-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/1120-177-0x0000000140000000-0x0000000140200000-memory.dmp

memory/3116-179-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 90ab47a6766bddd1db1c9ad1ea016a52
SHA1 6e93d813ea71ff9fdfefb494ab8be0b790deedde
SHA256 8cc8380b8a7952325ca2cac302d4be76b7cf31aaeaa052dcc173912d533e7558
SHA512 ad327e53e54d0c024fa683f9916995a3a289a3307d7cdba995706bb8450738ae11732525e2e0ebe553a3b91ee6fde24f9554bc386801d3e6f287508f67110741

memory/2884-181-0x0000000000400000-0x0000000000460000-memory.dmp

memory/2884-187-0x0000000000400000-0x0000000000460000-memory.dmp

memory/3116-189-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/3116-191-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1508-193-0x0000000001100000-0x0000000001166000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d77e649edef0f6f11d55eab6ba329324
SHA1 2a387429f6acc984d6c451cd0fe5e47d1f7c2e10
SHA256 2db55d62604579871888cf039339c665a37f2a65c03124d603bf9fd1ff91c514
SHA512 0b757edd8e2c82baf0a7cde2f8a1eebcd5422056b7bf01c552d5e7b21531d720397aa18e61d55b6e1792a1e538c15abced56d110834f7c553477d04f7bf4fbd5

memory/1972-195-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1972-202-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1972-201-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2884-204-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 5725a68e50f1d6b5b0a726045bfee12b
SHA1 db49c0e4b7f4dd7668dd53fe2725cb2f67d575b7
SHA256 9f58bd48d519266062b0a3b79e3218502681ef276ffa0337c03153fea92f67a3
SHA512 c5390256f3088375975a4ed2c2d074956dd8341c312c2a51812813eada74666138bbfc382d9cd20d4dec8c927bc87c6e3ab84579fbe927a4243ff8788d0f42b9

memory/3952-207-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/1508-208-0x0000000005900000-0x000000000599C000-memory.dmp

memory/3952-214-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1508-215-0x00000000056F0000-0x0000000005700000-memory.dmp

memory/3952-216-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3952-219-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/3952-223-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 8c14aa00291312ef257e898f59026214
SHA1 00d85691df9d84a4d4dea1f4b47e5c6a01675c6d
SHA256 d344a57a7aff35bff561d91c9f98d364351eb1c1a60466d55a5245555d758bb3
SHA512 0f58fdb0a88b5d03c6dea644b8c73d8df201665fbb7faa9b035d239d84cd8a635525f193889b0ad3561e406190d57a4bbbc81907632574541d271e80ef7451bc

memory/1984-225-0x0000000140000000-0x0000000140210000-memory.dmp

memory/1984-226-0x0000000000D20000-0x0000000000D80000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 a565531317746d77249f4a693d3b86c8
SHA1 9828dba20b3aff2f59dc9f02af292d92906adc3a
SHA256 e8972b5e8ad76fb706d390073e56d7893d337f3f91d43b191c1291234aff8e2f
SHA512 3bf6a1221594bb5f317ea43fb4f60ec266ad4e33d2b2e55085e141eb58c3cdba46acc5bb03e5c4fe144d57beb6e2818e4bb8fdc6515bbf677855b923b5ca0c43

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 ce94b18a4c274d51f621bc5ea2c26d91
SHA1 638c636281d00f7bd6cc68c06c04d98863754d19
SHA256 aca3e39c10ff59973a2f27fdd485a6e427c80c80cb84794dbc939da593eeef20
SHA512 8c223064e8741f86921abb7e29179277210d9632faf5b256bf16662395e6f86318d3f63ddf64129a4f6967553036116e93ba22c4cab228481c59b5b885f7062e

memory/3128-259-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 db8d03f5fe7fa21d0300bff6d9b0d903
SHA1 175022946c58ff43a40369876e80df152835216b
SHA256 13174889f2972397de7ba40cebb76064342a1cb7618e38f8ba441431f3310f64
SHA512 a18ec96be19701e49af1e3957c1e28dc4f5a4c2a07c6e9948b896f09e3b57652549c6f361e9215408e09a201e508e2a6392230d4bae0d758eb118f0571cfb1a9

memory/3584-261-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 0a1365ed195544e92673da7d778651a3
SHA1 96f9675f86ef205a3cb5b03871c37ef3b28bcc7e
SHA256 39e357244163be30325f06319c418ef1ef8679559166cdabbfb917baed505149
SHA512 a44f84d7404a03b608b9825408f6486bf33e6c2516fccf56c8093e7ef6ddd9555edbb162f69c3fd48f41463c4c5638b1e85458fd00f71527d6d29a127fe9771f

C:\Windows\System32\SensorDataService.exe

MD5 f729a34561e39dafae8349d8aaf6e8a3
SHA1 453eb7ac6a441e3ba68c02bdce18fd6918cc8716
SHA256 b76014964e935d7cf3177dd820d297b56cbe34b58358882099b6f579b7ba6bb2
SHA512 8b0f95d27c85ea117bdafbe4c5dc4acf824337ba97ad7099fb12e34f0c39f0943c89ceb13e3e3e330572651c13aad6f964d1d9263644f1d0e17a0b97536552c0

C:\Windows\System32\snmptrap.exe

MD5 0a42a98396e9ea63f9211640c616128b
SHA1 2ea1e9bc8d20e8eccefb6204f94cc78ea60de8dc
SHA256 c1dd01291f9c3a684aad4e109c388eadc4a6562076816fc283f01e94572a94f5
SHA512 5fff7d073d03ca1be771e8d93658548f67997c18f26bed8007cd5323a644824675fd69870d9cc5dd6443a5ea96382b45f6a4cc4db3329167904e1251c4d1412c

memory/2832-293-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/2220-295-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4016-297-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3708-300-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 b0f75b9649bfaabd1fc49b4949076d55
SHA1 3db0d3dd98f111534ba22172b8d6247153085094
SHA256 311885f2c1627114c87360c5b597c9b28fba5e35cfd0fc76c87e4ed49c490aec
SHA512 afcc239c6eab98703e237dd790b39bcff666a5cefab9ce9f2649e864b284f1ca9e66087dadb542bcc9e6388e6b70c53db34f3ec5e02fd6778936887d91280911

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 93125813f850a9b20c7ebb0ea66cf6c1
SHA1 d9f2d01495800dee844abe1f6b0b4e239861cdb7
SHA256 b1bd4fd27f4b0dd89487943640018a04fe5d5f6344dd6bb940ae8ace592d929a
SHA512 d9005cbb42ffdf944921af7bc9a244fee8afaf2f2cc42c4426d2fc68a773498585fafe20e472df1383bc5ea6d97d2472047b2626ef9299516f4799703dd1e869

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 93125813f850a9b20c7ebb0ea66cf6c1
SHA1 d9f2d01495800dee844abe1f6b0b4e239861cdb7
SHA256 b1bd4fd27f4b0dd89487943640018a04fe5d5f6344dd6bb940ae8ace592d929a
SHA512 d9005cbb42ffdf944921af7bc9a244fee8afaf2f2cc42c4426d2fc68a773498585fafe20e472df1383bc5ea6d97d2472047b2626ef9299516f4799703dd1e869

memory/1252-316-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 e3607b481f033859e901095b451a666f
SHA1 10398d4608a1e1d73d48ab2d9d8e826cb92688d3
SHA256 bfa40c242db1e23370990f10323eb4e77e2238906fc61809ca44d2140335135b
SHA512 19f955d278508ab1cbbc9de47f4c7fbcc9dda1fc5498da84b2d3477580f2b541b08944bebdae7a752b44db45680a38984ac88d21fd9b0d417646f998036a0779

C:\Windows\System32\AgentService.exe

MD5 284dc260120bef3655e0aedf03e7b574
SHA1 16f33e82d193f946bf07c3b7d382d1432c062e58
SHA256 c1e8b4474458c257de3578c690ac9ef8d27b9e14e286fb6e8da5d9d64f8e53d5
SHA512 208f0b7172895d77abb12f3caf5378bb76922a5660b03d4c4661de11fe191979e9eb95479c239474de253cd6f24ba92d833bd283d8ee0e41cdfeb1e569dd49d3

memory/1712-338-0x0000000140000000-0x0000000140259000-memory.dmp

memory/1472-340-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4896-342-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4896-352-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 85310e04275239b28a5692fd2142c0ef
SHA1 acc413d3ef2c25a35308c53401a55be027fa3766
SHA256 82147b0e7e2297693dfb4bdd9cdcf7cd4256e49c461daf85ceebefbe100beb09
SHA512 e824f31edd39af70dd5d10258a3b63fd092d9b0b1ad465b97722ecb4e0d3cf338e727e61e5afd5211ca2c8599c5ddb76a94b953a06413e4c578691efc44064c0

C:\Windows\System32\VSSVC.exe

MD5 96068d8915290f835fdcddf443242c47
SHA1 12740c02e7303ad5e74a381d0918a16223b0f555
SHA256 6b563d10d16c3de11632b56219958209bc7ea4e425f0dcbc6526acf6ffb138fc
SHA512 41f72846b1918e3397df0f4670dfa5de17425787abe3800015932ce4fda6a3b693641d42b6868a61155580b9b1923f130585e771032e9344c2f4e019a0f8472f

memory/2128-364-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2404-367-0x0000000140000000-0x0000000140147000-memory.dmp

memory/436-369-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 c22eea419594fd20c0d3da8c40a3cd9f
SHA1 af550628d06a42d21ab58af13230467f5ac5a7e0
SHA256 d9625ea8ac684cc1bf32708a58c1d2de6b1e55472bd19bb87a0b4bef2fb98f76
SHA512 4c4e60817b145a5a5ca6d0093ac98331e034c50abdab896f4c85512181ec7f19aee3fdc8215dfbb101421531cf6cc29d3d5f9b4c5aeba4691aab0ccaf283bfd1

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 a46581a6263aa9f1d4fc9f3683b553bb
SHA1 cf4469c84b1ad2e11bf0191080ef007c7f26f1d1
SHA256 1aa4fc725107d00e4e7a043075a289bf3c7ad9c982a84e902938822a31068b9e
SHA512 74a5893a1df6e4fee9d188c7807ae832ccbc251ffa67a45e4e37f1c99d34181571e39e1f1df635ec5b2cf72e93c2247130cac32631efe2c5600f1e4f7d2f4339

memory/1788-395-0x0000000140000000-0x0000000140201000-memory.dmp

memory/3804-396-0x0000000140000000-0x0000000140216000-memory.dmp

memory/3176-399-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 dda5463c6b961236fd7b91ac0f5b4a1b
SHA1 f3ffd2d20834ba72b33f41a606a50c75f144bc76
SHA256 579d6e12f7ceedd331351833abca6f623c3b0330f20d591c4293a4b8f1264439
SHA512 0bebd4ee8989286be9cd99dc16d3cd04e108de0c3738825c7e0600b5a7bc3e17dbf01b2378a21ba473e142cf128ec690bdbedfca90abf1d05e43b83199d32ba9

memory/2640-438-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1972-490-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2884-492-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1984-544-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4016-570-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3708-586-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1252-588-0x0000000140000000-0x0000000140169000-memory.dmp

memory/436-600-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3176-601-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2640-615-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3740-648-0x000001D1E4EA0000-0x000001D1E4EB0000-memory.dmp

memory/3740-649-0x000001D1E4ED0000-0x000001D1E4ED1000-memory.dmp

memory/3740-669-0x000001D1E4ED0000-0x000001D1E4ED1000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 520bb66822629ad29cdfd786ffb3de43
SHA1 5959315ac705354b29c75f1dc13dffcb0d66fbb8
SHA256 6adf7d10802a63298144eeaaaacae359348ef50e1d736f8c1e9e841c719be257
SHA512 717335d4f26c9474b432fcd64123020ac17f96e1fd88c474757ec7edbf933b37d184ecc478367e983116e3e3ba79d32739e49a4346c939ed5206d9dcce09e0e4

C:\Windows\system32\fxssvc.exe

MD5 e094e1d6e0fa94009b3f0fcf0f3607af
SHA1 a725698edf8665c300ca3982ac255385cf10c910
SHA256 bba03f0382b04bbd21ee05ce497ca176cd0945ca4049aa293bb2fe14fd271842
SHA512 4783620a36d75af3db57b58e0b782d999bf82358d1b3a5e5fa82f1d16997745afcf8a506230fdf7b4cf8e18d149037cf5169ecd532c43036dc021dcd2e728f6c

C:\Windows\system32\msiexec.exe

MD5 cc1bfcc7bebd2f03723215c79a76752b
SHA1 2fe2f0f5111cd0b003046706c07953e0255a35ce
SHA256 9bb998252078eb6f5b274b7585238ef27a98d5354175453388ef95941ed3d890
SHA512 4bffed9b93282d222c343d2162f661d70673adcd0c5355f57db4bc849f25058026004126eff745fc9de6a2c6609df26ae9c494a4baeb31cf687afdb831ff7b3e

C:\Program Files\7-Zip\7z.exe

MD5 56238c73607fa428909bebe399cba4fa
SHA1 7ca3029e654b6e0a13a9a400c869b0f5be166fce
SHA256 2ae5df7c837ca87e8660e2a9c381d342f73b39c9cd620f8704fea240548c2187
SHA512 c990a98be4c631d27d3f307b71ef799302691104a03cb2522b7475de1b861cfe586c33e6a9d13e3b376adcae08bd0b5f3954b56d61f3a8bf95be8bb1295bac0c

C:\Program Files\7-Zip\7zG.exe

MD5 e3c8c3439738f1405e06fd1dc955efb8
SHA1 57e89d17eae1b2168e01d39c78e2cae07e7c802f
SHA256 0c30201fb01b615bf00f3155267810a1966b42cd19932891a40d00d253d48fea
SHA512 f9101845077f0c08436c1fdb5c4b72d15d69f885a290f69ba50c2f5fbe7a59aed64e4583d224ad110a13d7ed88364a7df79c034b16367ef1bc1b3089e717514b

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 45eabd6f6b90e8b52d61aa6ab5896131
SHA1 6d91b59a2ad4515865707a1f7529fb7b97341306
SHA256 6220e4105731da64b77038205e07e90b090b83f31412854670d555825a2eb79d
SHA512 f298b1a2eae656d143ec2caab06a797fe3a880f7eebf7e44a159aa0404a44a5900c166112dacfb3880bc2846fdf45fd3eb85a2e14e98498ce886252ac8174a00

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 5284418c3b18268def06ded464c3e589
SHA1 94f92869082907e14a63c6967270b87c3b5d1dae
SHA256 3a070a65fcaa05c30b33ba9004879e1066fb35418a136c2384d4b7b7d91a780a
SHA512 8071ec45358c89346c9a293f7cfeb1001c655b8d0450c388c101bcfa69638197f4855f0be8d9549b06e09834282939dd5200c77169dd52a8c7f649ae9a283fd3

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 269b8c32243e51c798b87655e0276374
SHA1 4818e1a13a3d15c6907a3d07b754aff0b2c963d0
SHA256 a689812ecb72f61b971546b1f007b8da5affb2fdef795e8689d267282028e3c9
SHA512 bb386730f83c469b261a5e3f0d321fc2409d5d14864a51ca52aa0db6265e63e3451ee53fc12318c7b179495ba2c6cb5843ff982db76304cce9674e320ea3098b

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 7364b2f3f7ff54ef0a9f297f7124afa0
SHA1 24d80d4bcd0bfc76f22be53fc6b71e7c81427fd9
SHA256 b06a236c631c85f6ce20ced7cc1bd3aed01d72cd0e2f0846553ad3bd2ae888fc
SHA512 c6ea8151f491da1a82473fcc4d9f50430cab2bfb49f2135b07914760a7085267c213fed9ff6a68ad18222e497fdda08b366cb6863fba6e14a13d4e13ccfbed29

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 63e59f0d87b2152ea1ff76c25e30ab85
SHA1 fb6b0b840c75716ea5152f3db7c1002b85167cc6
SHA256 935a7a338d445762a00351d62d6071b64752d00ff3fd1299f585e56a229e4117
SHA512 2fc173f474cb234b965a2eb70b31abbb8d8615b76577eb9f51282db732bb1dda8763a211bf6ca5afa87fe57fc7d9a56a78ca2ee50d76248c8b3c8b3f34074d29

C:\Program Files\7-Zip\Uninstall.exe

MD5 5a9371ab49f038ea2f4667ba91cbd34b
SHA1 96c8a0db8cc22e4a5fbe9c7d560074e0a15f4e0a
SHA256 706c9bfae62a458d1ffd4ea2ca6297286cd1da52f11c43e7e0896de7f7131f1b
SHA512 cff903ee389001c72df7c0f3ed3b00b134989183514f11e73cb2fb42f268792628419b5b10835d1d84dde6facb3887dcc7b4e22297d10d62658d903f40310ed9

C:\Program Files\7-Zip\7zFM.exe

MD5 f6881c0491600d4390b94248e67b0117
SHA1 095c5e653eb6f50d3ca3fff407b3165eda22a654
SHA256 662a16000412a2078149f367a6826d31b78dbb1e445b1d7a4402fc9dad7285d4
SHA512 417cd39939b9266a32fbf9df228f63fd0d02a391024df292532a6aeb7b633eade2c5e6f21a2b6a25fee6baf97a113a25d6c92b73fe89e2b106a60e7c8e11a582

C:\odt\office2016setup.exe

MD5 147cc8807a4271259888d0bcee8916db
SHA1 fd9851cd611f3456ba5d47aff20a690fd719fd58
SHA256 a59ef5f1cefffd32210dc74ac7282d0b4b0a84aa6fb1d52dc57deefc3f4467d9
SHA512 a78bc39a3dbaefea9a92eec5b56e800019f7da44152f6be499277d9f433a4132708862e04ae0663ab3798088165b389363b7f93f678ad342b9be11ecdca729fe

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 6842b9b4a183936a2681054ffe2fce1a
SHA1 85081806b8736bea6277494ef7d280911ae7f55f
SHA256 5c9554f7bcf9327307dc040e20f24d6f0a052d1e1035b0db7a2c57abd367e38a
SHA512 e6fa46ffa7b7a546859f2a4189c7078f01065f0a06c7ce504d40228793f7a92055f829cf0ca9ec5834d4bd640eb9f92e47aee2849caf3eafd01ba7d104e7d0be

C:\Windows\system32\AgentService.exe

MD5 284dc260120bef3655e0aedf03e7b574
SHA1 16f33e82d193f946bf07c3b7d382d1432c062e58
SHA256 c1e8b4474458c257de3578c690ac9ef8d27b9e14e286fb6e8da5d9d64f8e53d5
SHA512 208f0b7172895d77abb12f3caf5378bb76922a5660b03d4c4661de11fe191979e9eb95479c239474de253cd6f24ba92d833bd283d8ee0e41cdfeb1e569dd49d3

C:\Windows\system32\SgrmBroker.exe

MD5 95c05beb89923acf429e7ddf8c2d9081
SHA1 4264d8184114a95a574664832eb32ed05892da68
SHA256 db281e9dbae7e0e27847fcde0d4dd8dbb4b55700a240753e3992c4bbcd25f8b2
SHA512 c0902c012dd5a0a93a8dab230cf0e1139a84d68d834f696e7fb54ca0a2ed23cad2c7902a915d43851d4355df5c9bd8ac62b1002a513e0295cd3b1d00b3934167

C:\Windows\System32\SensorDataService.exe

MD5 f729a34561e39dafae8349d8aaf6e8a3
SHA1 453eb7ac6a441e3ba68c02bdce18fd6918cc8716
SHA256 b76014964e935d7cf3177dd820d297b56cbe34b58358882099b6f579b7ba6bb2
SHA512 8b0f95d27c85ea117bdafbe4c5dc4acf824337ba97ad7099fb12e34f0c39f0943c89ceb13e3e3e330572651c13aad6f964d1d9263644f1d0e17a0b97536552c0

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 5725a68e50f1d6b5b0a726045bfee12b
SHA1 db49c0e4b7f4dd7668dd53fe2725cb2f67d575b7
SHA256 9f58bd48d519266062b0a3b79e3218502681ef276ffa0337c03153fea92f67a3
SHA512 c5390256f3088375975a4ed2c2d074956dd8341c312c2a51812813eada74666138bbfc382d9cd20d4dec8c927bc87c6e3ab84579fbe927a4243ff8788d0f42b9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 32bb97d34701f0f630128f4f6ee98f5c
SHA1 95e5872be72d81cad4c6a69f883c6bf66d6eef4e
SHA256 dfaed4678a44602f48501af47d2f3639fde58f3dd865ad8be1b5a8f9725084d9
SHA512 e5a088190cb629bae4cfd4e6e50eaab46cf4846a798ca68b2a7f6c32615b3a606b698c810c7f086d6e95e8488fd87b2952116514a08cee5cf460203d7081a012

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 d57f8caf4c45011fdb33478994b90d01
SHA1 324183d9875720d49eb1cc500c14e1452dea3c5d
SHA256 9368a5cf569e92057f8c6288e4bc012d3ab783f0ec3a76aa7192f1ffd3525671
SHA512 6a2033ceed23cf28307aab769e48ff4fb02105b409723480a4181c28b7823356b29acf6aa3655083c1bc15dc1af3471f9fc9f592b25e6df35c04ef98dffc8801

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 ebdbcc8a750e59568e7611916cc49a15
SHA1 7f747bfc50eb402ecb2725ed28168b79e51db8a1
SHA256 ea56e1d9110abe4c5d9edb8e2234ca4bf226d765aaa593b76b1c28ec215ac359
SHA512 f5d9a6d0888a1b82ed5c903b43ef940efc384ce88ec046822b9b2e6c77165764bf889e60a2c1d683f8a1ebe970ab5d3fb717f7be61d0f56d65f568e340c540b7

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 5ce9257825109cd44495f3efa6699800
SHA1 45a153a727de1215f880ef73c1d467ecdaa6ee44
SHA256 aa088271ef36e8d88039e58bbceb5ab4bcb73370f5e8a2d81875da8763be2f9c
SHA512 a795b2ed2410ff063da368aa8dbe1b6244f8df65ab876d573ce03f5b4b9151b4c185d345b5f6b00da719900233f0a9c12281bfb6d8c4b81e6fd44e88dcc72b5a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 f41775fdb2aaee691155fef11d270b04
SHA1 49be03f7df599553129f42d15b2ebfd2e4670c02
SHA256 65b1c8da04353d97c95fd43163104c9aea037e913d2ef56de17c69c3d2e99b98
SHA512 5d230597bebcf416449f72351e7e9030ea65d4f6ab5da81be595545c68bc724bd6b9a33e3eee575e0776c5e64a014124ce19537e5aae6532c47794873bc15d40

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 d4bc79966409169fc16554298afc0aa0
SHA1 41f203510c346b086be42acc7e8714ca1ba356ea
SHA256 ddf7cac4bad25d798afbb8532119f1ccddba610e94648ad6107efb11642c6f3b
SHA512 4c0973d4aa97454eebca705a2e5c31b39ed586e2cd578ccde2cd19b60f8e1ff941cae15b06335e54651feccf5c56ac7aed10350863565d8901584747910f68d5

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 35b245887c36c94a41845f753b1427f4
SHA1 efff80ecb3e972c60fb3013f74a6169ecea7957d
SHA256 aa25f8b32e119701b2c3524efd1e1c0fa219807576d6b5bf97910ca9122cc8cd
SHA512 df13f9a395d82884011dba1592287e20abd627e20df9dfbd2b359436b1ca565629094f114be3490a0b3a8fb2faedec999e970e95a51128d2e86b065523e8a3e3

C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

MD5 892cb77bddc0605e0b9bb4f172a830ae
SHA1 4701e4b2a9858b4f4eeb107eee41c265e3001e40
SHA256 a63a024fc1f0478b8500c7ec0bd8a08f7c23ff568ff8530106c7a51cd0168127
SHA512 45912dcdfb6c4402e04419a1d22606dab701e98d3fd73c45552471315c9a424b6b495bbab63f823745d913b0b11927002e59cb9284d1b347f56bef8acce900a5

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 6698a3d84dddae3529a4cd3e12e2dc8d
SHA1 dee7f64eb7bd5250d46afde21007ae7ffebff60c
SHA256 52cedb872f9f1fd160874f0cfe37d9b33fa58db1850db15977e36b670540bc5e
SHA512 c7265e3bd0bb7988308a8d84fe14d825aa826acae4e0826aa571bc96560009613e3f26b9124881377ec4fcbc898a874e5af316117fe52e37e8c8b6e84df2c774

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 30c83a56f002e5322e49e1ec84a0e0f0
SHA1 94999a07a14d91921bf95df979dcea0b22b2719e
SHA256 fa3cb3fa7700192a47e8b6b0dcabc6a54dbb458c92b8774d720094deb605c69a
SHA512 7da72eda09ee4b4beae2aa26f4f6c43fbcd20fdcb3a2887d35cc8c02f22eb1eaf58fb3daa07c4e2581b1bb51b5ee4557bc260edaf68e0e0fe21c9ce69b3e67c9

C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

MD5 6a4f7664659f385c81ced58444bca8fa
SHA1 2b7c1db972d4705a9dee24718a1670b8b93d93e1
SHA256 1758183ae496925f1350c0926bbda0dbbb4183a8a013e63c73d5cb2b745252ae
SHA512 bafb575126a266dd520fa6dd14d55fd28410f5c7653e93cccc509fd0c02fc6c8db32feaa95fd1ffbfc501047e851d990a21d094fc7fc67155fde8b1b5ca7ea45

C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

MD5 c9da3160e9f00330bf528bff8b073f87
SHA1 7c4ca3a05fcdece66c23c8db362b5d62e704dd8b
SHA256 b4e1d1feede35d534c126e945d005808a4d75b68db958a7c0c8f272804f3bafb
SHA512 e5c5d28716f263fdda38229f97f3313ba08b662ce83bbd92da4317a44916305a463a3e2820157c32398ec8e5aab565e8a95ddc6486af1dc73714e27350280bb6

C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

MD5 f764af76724c2d901b985c42ff228812
SHA1 2415c25db8fd4005ddebc6c3496b148f93efa616
SHA256 7253bffbae4d9ef2812dd6cbaf8c43501e4bf18f335be82477d766796554325f
SHA512 1c46a8eb5011cc74f343bb9273c8e8e490669fed7ef9253f61fd85b57dbaf552aaaf38bc3eb8981404e746d05f3ef69accc451fcb23c4284466a55e0d8b849c7

C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

MD5 4439507286a2a84e479a1b679a06cea8
SHA1 be467cf6a16f568a98fa96c691a177be3c64b42b
SHA256 d0b75f52d4749c929f4d12543ee2f3065b6ba8313efef97a4286b677dc689865
SHA512 06259d656031662cb4898bae8b0c79206eda5630acebcff96365eeee09695ca8d410a8fa1f44ff70c8ddac9d6d89906f12540099f5a4539171c9aa47fc62916c

C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

MD5 d9d8e7d7ae2239af50342b5b087bf26e
SHA1 b525607633b54035559c645ee5bd0a9bcefcbd7a
SHA256 3ac4c43f6e8c736b7353261aebb37e6ee1bbda6d0b8558b95771b1fc0e92c123
SHA512 74bc952fac73f80965f14076400fded8be8aac5d51fd8726fc71026001931e83dc729640d01276425890ac6f72c9ba2e61d5b8a32429ab00aa20adf10bec552f

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 3606f73a80abc95f7a997b34d0e3f71f
SHA1 ef8ed0ccbe4378ce2c573bbb984cafd8e05e86bf
SHA256 18d8ff775b999d2e605b2454850d418385737553ebf57d42d3d2e45dd74f1efd
SHA512 4ede83cc41939db7c5d4a7d4129393e5d212b5b7e35900603d7cc01bb32891c5c0e4825f31d4303c3338573913ff02af508a5f3bcb58ba27ac747a9fe3d2ae7d

C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

MD5 189646f986e3670104ccb7ac18ccd684
SHA1 6af5299009fb6c3cc4a963b34253daed146f33c6
SHA256 14f57baf032d057ae3dceb344db01c33c29bef16e4ea80d607b82551307d1bd3
SHA512 eed7be55ce0c41d74371964cc7240c95636abf7a533b42999e04040204284d2f8e40ae5a644086a307ac7b6e2d0c36906cc9daf6fba80578b55ecc539c0fbe19

C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

MD5 7cfef69e002411974ab9852c3853101b
SHA1 078574dd866f7a504c66e2605c9c739123a4348d
SHA256 ca127b9d73a8f71677af54c6cfdc323b8528006d52008f936a12cced6076940f
SHA512 40e711802ed0909adea60d1828678a006742697bbe339eeb79fe771969cbb11b2cc2afe2d2ad73ad801eb0ebbdb529685d6de810402dee196f34c6ec517bc2fb

C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

MD5 40bbd05f0a2e255f283569911df23d80
SHA1 c5584a58e926196a9df8ba9f6f334508af446e4c
SHA256 0a8889fc1162457d4a448650dfbdd7c3bc15e4dde5157611825c8ff6087a5f7d
SHA512 6e50fd2a3fd2bc9f97e7898445e8b4b91c32fa42f793eac59b3640e9fa0f36e03a266e0fea2137dbe9d750150eeffb10afc1ecb35732055bb4a70f100be6b70d

C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

MD5 355086895564866c0346b3d5eec3e862
SHA1 489743ae35e598e262f345c88592462fb76c3edc
SHA256 03152934626302d679a05fe1edc61b9655d866e6289debae42e9c1c0dd4295b2
SHA512 0222fb3da49f9e219edd6d2bd85472651ab25f75473f6c809b411317c7d256fbfe73c50be2093a1ada3e5a2b65ac7b8399268c6351529fb707d8b2d5a9b0cc35

C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

MD5 c00e285a46ccda01926fdb0470430a18
SHA1 72c280fd0034b4c1fa5a1cbb63838778d2869f7b
SHA256 74166d1d31d5c9cac395b865235f0f782f5d9d09c6fc943d24c7ca00060d193e
SHA512 a99b5af8a48b59c8ece2c1ad73228f65c10cac5b0e2a901bb48fdfc3dcabde37a58ad9d3cf15ef78cb14b45bfd551f791c607b7676e749842045bd4e5631c53c

C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

MD5 bff6007a45b408c94411af5bacc2b73a
SHA1 04204fb2e4cd7ad6f6a11542218974169dd4a956
SHA256 a10f016ef0b6214e006149fe4f5008c054130cf4552f7da3908042d78e949dc4
SHA512 99a5af9d5f43fca428c1700286f89bd0bea46b89d12974cad2ee803af492580266a72e0d815933653ff76e352719c72f8406c74fd97acc908e11b90a5a9e78be

C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

MD5 4866cc938d35aeb399199ab8d2e70f7e
SHA1 23629b6deda858d27a32e6bfcc0cc0b91c530752
SHA256 59fd77601aefc750ceccc3e76cda8b3395b812b2acbb3a7f5bd1578351ec2270
SHA512 9768e0d2e916789a995280d49607fc2f8b07b6e4f902cfaf42f5d043ff2886f64b595a0cdf9e2e1184a19400f4ee79b742328c61f3d97ea654fbd727e64b519d