Malware Analysis Report

2025-01-03 07:39

Sample ID 230501-smp6daah6v
Target 13dc441ec2f9e3f9aa1f354a4b14d318.bin.bin
SHA256 85025d82417b78241eb3e406ed633597911e1b73ae5f712f03ee18f60b16324b
Tags
blustealer collection stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

85025d82417b78241eb3e406ed633597911e1b73ae5f712f03ee18f60b16324b

Threat Level: Known bad

The file 13dc441ec2f9e3f9aa1f354a4b14d318.bin.bin was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer

BluStealer

Executes dropped EXE

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

outlook_win_path

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

outlook_office_path

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 15:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 15:14

Reported

2023-05-01 15:27

Platform

win7-20230220-en

Max time kernel

54s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1612 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 1612 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

Network

N/A

Files

memory/1612-54-0x00000000003F0000-0x0000000000578000-memory.dmp

memory/1612-55-0x0000000004DF0000-0x0000000004E30000-memory.dmp

memory/1612-56-0x0000000000250000-0x0000000000262000-memory.dmp

memory/1612-57-0x0000000004DF0000-0x0000000004E30000-memory.dmp

memory/1612-58-0x00000000002D0000-0x00000000002DC000-memory.dmp

memory/1612-59-0x0000000005B60000-0x0000000005C98000-memory.dmp

memory/1612-60-0x0000000005CA0000-0x0000000005E50000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 15:14

Reported

2023-05-01 15:28

Platform

win10v2004-20230221-en

Max time kernel

176s

Max time network

196s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

Signatures

BluStealer

stealer blustealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\39478c02c9ce9937.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 2356 wrote to memory of 3400 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
PID 3400 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3400 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3400 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3400 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3400 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe

"C:\Users\Admin\AppData\Local\Temp\6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 20.42.65.85:443 tcp
US 93.184.220.29:80 tcp
NL 173.223.113.164:443 tcp
IE 20.54.89.15:443 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp

Files

memory/2356-133-0x0000000000800000-0x0000000000988000-memory.dmp

memory/2356-134-0x00000000058B0000-0x0000000005E54000-memory.dmp

memory/2356-135-0x00000000053A0000-0x0000000005432000-memory.dmp

memory/2356-136-0x0000000005520000-0x0000000005530000-memory.dmp

memory/2356-137-0x0000000005360000-0x000000000536A000-memory.dmp

memory/2356-138-0x0000000005520000-0x0000000005530000-memory.dmp

memory/2356-139-0x0000000001070000-0x000000000110C000-memory.dmp

memory/3400-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3400-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/3400-144-0x00000000031F0000-0x0000000003256000-memory.dmp

memory/3400-149-0x00000000031F0000-0x0000000003256000-memory.dmp

memory/3400-154-0x0000000000400000-0x0000000000654000-memory.dmp

memory/944-157-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\alg.exe

MD5 9bb75136029908de1c0670080558b02f
SHA1 dfcdbeac59b83f05d73b7cc7d7a78f646f40e002
SHA256 307f564c705a89b9224bdd21b521402dce42feb3102b06f342bb8b728e68e05a
SHA512 2b4d757e74b9c10f8aca9912800a1215a0e7051b02943bfb28b4a6b2d416d9fb3681e4505db3173e19120640ecb9295f4b92aebc79a5d759619154d8b4bbc287

memory/944-163-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 94c98f4908c9d15bfedd691bcc6ffaad
SHA1 1ac89625c7d83939e54e4e90c4d6ca88a5e7e67a
SHA256 5be814989ba26b35f2407685c3730c2f18ad2fb9dd6a863dd564550eea28c73b
SHA512 fcc56f06e82ceff8084f2882c044f8c2626681e268a8e99025ebcf8e442b747547034e3f029060aba75f94c024b1fa84af7dbe15d20791f2f9d74fde69daab48

memory/4080-169-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/944-173-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4080-175-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4080-177-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 c1e0260dcf1fa1eabfd37fa09ad26932
SHA1 3201ac4d7a100f9e405bc01f211138f5d6137237
SHA256 8dfe046b77e4d997d27d3e4c8fdb35cd89e71c16295f504b81a5ff38e022a49f
SHA512 dbe9cdcafe4f96a30261f04ff4f5652f19ae02a7bc24eebe119cb143dd9a9c3212809a2eb4257c72336c03fa59ce58410f95fa9399f5b45fe68c3cd2be658c81

memory/724-182-0x0000000000830000-0x0000000000890000-memory.dmp

memory/724-181-0x0000000140000000-0x0000000140135000-memory.dmp

memory/724-188-0x0000000000830000-0x0000000000890000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 60410949490387fd67c128b1b314ee04
SHA1 e5e00428e8c47261ff54ac5b448e50aa77b722e7
SHA256 614cc7cca1924aac9ec32f151da7736713f8298e46182d1278dd0932a274a673
SHA512 3d36300446b498e52571cf1d152cd5287101eeb8e0d9678de8be87204eadd56b8d7937fe46c0f7543418f9301f13efae78e901af0cfbbec3ee4fc6b67dc141d5

memory/3008-192-0x0000000000C50000-0x0000000000CB0000-memory.dmp

memory/3008-198-0x0000000000C50000-0x0000000000CB0000-memory.dmp

memory/724-200-0x0000000000830000-0x0000000000890000-memory.dmp

memory/724-202-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 4f587da58e49e85abf3afe7251e5e71f
SHA1 776ea9c05657106f20a65a1c4914c15c0c8fd7ba
SHA256 4317784332f2208224d03b4e37e93e4681b265bc12be52f9373ed352a771e6af
SHA512 b61289d16ff5fddcc3f1e6ebbd2cea7ee81f170fbaf115871e9402740d7f959244b03f0f2769868008ca51d74c9138f3baebe8f0cd4bc9b6683c62d9defbc637

memory/1172-205-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/3008-210-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1172-209-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1172-213-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 2c39bf2c2a6dc653ddf868ba09788aca
SHA1 17c836b9e4bd26a05f881342e83eddea277bad33
SHA256 26f4b071fa04a98b15d622b927f0a81c1e9ebf575586485d8fcb31573a2843fb
SHA512 8a1cda99186223e0c8ebf5aed116324d5a58c8aac51a877de4580db429d4d0f84d0286ee9b7848e4c51eb0897d41a35c58fcbe959fdfbf8a42b58395c5fae78b

memory/1640-217-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/1640-223-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/1640-227-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/1640-226-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 4fc7d7df453218a727b5b55e7827d258
SHA1 2612d33932f7a01d24e7ec65e5f53146ee35796c
SHA256 326a1c1295a2b666d42e19037352d4bfb5edb48e8ac656cd3affe74526fbcee5
SHA512 aa275d7dcad7416b43e0c7ae0adacdde8581724252928d52fefa06832f55a279a2a3baccde4a1c1e2ddc46fb33ab49bc974e8b73c537d53ae855f2278b2bcaba

memory/1784-231-0x0000000000D20000-0x0000000000D80000-memory.dmp

memory/1784-239-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4080-240-0x0000000140000000-0x0000000140200000-memory.dmp

memory/2220-243-0x0000000000B50000-0x0000000000BB6000-memory.dmp

memory/2220-245-0x0000000005260000-0x0000000005270000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 420d7e11765763e53527b190c6171d69
SHA1 aef82e258607bb29fcd5df4e0a6c4b7111bbc9b5
SHA256 3d0b82642ac33c5a4b6bbf314302064789e13d966071eea608c55416ba712578
SHA512 3a550a0efa8fa2a54f4b849fdd2bfd6b34ff5df67692d8d59994b6cadf111ab1767b4aba8ac7e0b0a1874a614312308037a3b37b61afe34360d7d9550e73a786

memory/1172-255-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3008-256-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5048-257-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 7ac9666e27fa8aab251a73a19c7b576e
SHA1 9e2d925081111e62ce5b5a5da5e859af100a7287
SHA256 bbb39bbe82ecbad440cd427d78fe32c15aaaa5b36a8a572e17343d678106efaa
SHA512 5608e967dae22f68b347dc4d71714eca22e6867ff42111c3763e2c766a8d097666fcd2ce91f29a02d76b34fa3f5efba8108ebfbe46ab235c223bb99a2bbb2220

memory/1616-271-0x0000000140000000-0x0000000140202000-memory.dmp

memory/2220-272-0x0000000005260000-0x0000000005270000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 ae806e0769741fc41648315fda8ce5da
SHA1 41046482581c617ae4063138e7e30392386d2ba7
SHA256 edecf29dcc279c3605850e12284b3324d03a821acfa924b1ff9e2e7c5729a482
SHA512 ef63c4022ceda8d9c15cb7b88dd5de58413ed7d9a180432c48f1450cc2950b2df1e1914e6c61ec64577c33b0b9273f1ed9da0effa419b09279e4140b78b07361

memory/2724-280-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 5bdf987257196d5be9f776af68a4b7ce
SHA1 cd95591083ab3833a1ac887cb47944405903f398
SHA256 ec6e2e0c61fb89a0c61abc7f04cedbc8c25a679e6691c8a60771a0acc09c2444
SHA512 57f09863a1451195325bd6181b2c9eac0867fc84d85083cd02126202ee1c2227525fa2e9493260055d186123c2aaca48c6f6c33f3826b6cf5f444acd801b1cbb

memory/396-294-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 16a24f3f0dbbc3f3c3ba2d73b2598bbb
SHA1 7317cf4aa31f27aba0d12aafdaeba59edcfa0e0e
SHA256 9d761e7ecc7a492d80a5f345c0853f092974ab7340c4dfee374210c8907b47b3
SHA512 70738e100218848dd7a0c458272c9fe03000ce9faa58d46a3d7fc190f659fe24706e718bc35187abb837d91068e971633123d765dfaa64c31fab8224af353cdf

memory/2972-307-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 1d0c6acba38829e358dfee08d98d6f6e
SHA1 35f35a3c085a3b50b4b3cbc4c1c3e2ac10614560
SHA256 91d69975bd9dd8d8dfdc4c2186b50b9000a012cd9959571aa8f9038578ecdff7
SHA512 2db031fc12b177b16e569e7fcc1ef46320535412ee862e629313cd9f6865bfbce1dc13dc48a0d1c6833eb139d8e3bd05644372e1a3a9456a19595603e34a740a

memory/2724-309-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/4972-310-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2972-322-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 2e93c697017b7c13e67ca8a654ca0c42
SHA1 3d9e4089edbedbf960791950da0d4d3335ed1f7b
SHA256 409d3f6b0949cd5ef65b56caf233392fd56fb9373232fe90b85ecb3e0946a819
SHA512 771fe517588dc915f0ef4a46246bc013b46c5995add4b7873eff92162ef8a0a6ecf19fcd35a8e852ac10e05992e9ec357c3b8c16c595716e2b81d1f605e4686e

memory/4204-324-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4972-333-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 fa0c71cd87d59994a27674c1a064821a
SHA1 d69cd8dbbbfa91500fbf45aeb5ce5cee1ee01e1a
SHA256 4fa8d092896ba2520b08c875603b504324ada7f2184f6a6cd84d8d35fd9db743
SHA512 c084b4b9cebda9c3b4dfe33c1f53c6943d8b0985e37178166bfcb86e62f67eaa871a9b70e8f8133096c80e19a8f595d9dc95c4227f454156069bcd1d37b8285e

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 fa0c71cd87d59994a27674c1a064821a
SHA1 d69cd8dbbbfa91500fbf45aeb5ce5cee1ee01e1a
SHA256 4fa8d092896ba2520b08c875603b504324ada7f2184f6a6cd84d8d35fd9db743
SHA512 c084b4b9cebda9c3b4dfe33c1f53c6943d8b0985e37178166bfcb86e62f67eaa871a9b70e8f8133096c80e19a8f595d9dc95c4227f454156069bcd1d37b8285e

memory/1548-345-0x0000000140000000-0x0000000140259000-memory.dmp

memory/4204-347-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 e7c154dac750a527c1bd5c4cb49f1f22
SHA1 712e72dbb41d3945b13317c65e61fba17c4ddca8
SHA256 0bdd0f775d50cf8828b72443160c97399d5e038d73b7d5ff09dd5a210d4abd74
SHA512 792c64c8c8f3ce6a1fcdf50aea7db5b5f78493ada63996a8872ee11d388196bed231d62839803e5190499dc6a126a049cc7c06898ba43168eee7d5c8fa6ba0c5

memory/3500-357-0x0000000140000000-0x0000000140239000-memory.dmp