Malware Analysis Report

2025-01-03 07:39

Sample ID 230501-tkykeadc2w
Target 35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe.bin
SHA256 35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097
Tags
blustealer collection stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097

Threat Level: Known bad

The file 35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe.bin was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer spyware

BluStealer

Blustealer family

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

outlook_win_path

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

outlook_office_path

Script User-Agent

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 16:07

Signatures

Blustealer family

blustealer

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 16:07

Reported

2023-05-01 16:27

Platform

win7-20230220-en

Max time kernel

176s

Max time network

189s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d36029ab7693df14.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1C927F30-9185-4587-B71A-5C14E7C09DCE}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1C927F30-9185-4587-B71A-5C14E7C09DCE}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 688 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1056 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1776 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 868 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 840 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 1728 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 684 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2156 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1056 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 168 -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 25c -NGENProcess 264 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e0 -NGENProcess 1f8 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1e8 -NGENProcess 254 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1e8 -NGENProcess 24c -Pipe 1f8 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 184 -NGENProcess 254 -Pipe 168 -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 26c -NGENProcess 1b0 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1e8 -NGENProcess 274 -Pipe 184 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 278 -NGENProcess 1b0 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 254 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 27c -NGENProcess 1f0 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 1b0 -Pipe 24c -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
RU 193.3.19.154:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp

Files

memory/688-54-0x00000000006B0000-0x0000000000716000-memory.dmp

memory/688-59-0x00000000006B0000-0x0000000000716000-memory.dmp

memory/688-64-0x0000000000400000-0x00000000005A8000-memory.dmp

\Windows\System32\alg.exe

MD5 69604d8d7877573f1894c9f8c6aee742
SHA1 54d461345df9ae1852b0509375556d3e828fe8c4
SHA256 3054e97b6f733c8257d3a9f1af0ac50cacac84990331b43320cee39c6cceba69
SHA512 05f4da55d610786fb6c08974baa890666980f5d5fcff0a8dcef0700e4d50ab26e85169ef3b53bf2c0a00f7a05630f7b5ff6e2e7fdf49fd7866f60591dd9f2495

C:\Windows\System32\alg.exe

MD5 69604d8d7877573f1894c9f8c6aee742
SHA1 54d461345df9ae1852b0509375556d3e828fe8c4
SHA256 3054e97b6f733c8257d3a9f1af0ac50cacac84990331b43320cee39c6cceba69
SHA512 05f4da55d610786fb6c08974baa890666980f5d5fcff0a8dcef0700e4d50ab26e85169ef3b53bf2c0a00f7a05630f7b5ff6e2e7fdf49fd7866f60591dd9f2495

memory/1416-68-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1416-74-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1416-78-0x0000000100000000-0x00000001001FB000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 f36ba59aa327e604078addd81a3b86b7
SHA1 79a77e7b1499f52a484323e4a258fabb9121e765
SHA256 a3dac94ad3fd75b6137b177576595bd6a8b87b1f1c57656a409ffdea3a13bf4c
SHA512 4c19afea9e65ecb7b406d739847d57e00a12b7ddb9cd0fa48ff1f7b7bbb1ec0f86ea19aebdd5151efca970e2443e595f0dee0227c5ffb196b8e0440c15dda601

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 f36ba59aa327e604078addd81a3b86b7
SHA1 79a77e7b1499f52a484323e4a258fabb9121e765
SHA256 a3dac94ad3fd75b6137b177576595bd6a8b87b1f1c57656a409ffdea3a13bf4c
SHA512 4c19afea9e65ecb7b406d739847d57e00a12b7ddb9cd0fa48ff1f7b7bbb1ec0f86ea19aebdd5151efca970e2443e595f0dee0227c5ffb196b8e0440c15dda601

memory/1540-82-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1540-83-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 ce94e2b68dc0254d550cdbd324c8b3a0
SHA1 f62957619bfb935e42d3cbaff77af5736038a7df
SHA256 da5fe3d72bfae2cdba8874332a6de7e353a22df2ea096479943bd1e51b4372ff
SHA512 e2ff1b36a934920f402d504f957957b0f45c20fb52640cb17249ea449481bf771961b32afb26c35c12bcf62cf6d2e817f001fd68a1451c06a5ce42cce01acafd

memory/684-85-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/836-90-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/836-91-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/836-92-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/836-94-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/836-96-0x0000000000090000-0x00000000000F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 ce94e2b68dc0254d550cdbd324c8b3a0
SHA1 f62957619bfb935e42d3cbaff77af5736038a7df
SHA256 da5fe3d72bfae2cdba8874332a6de7e353a22df2ea096479943bd1e51b4372ff
SHA512 e2ff1b36a934920f402d504f957957b0f45c20fb52640cb17249ea449481bf771961b32afb26c35c12bcf62cf6d2e817f001fd68a1451c06a5ce42cce01acafd

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 70fb48ae201ab4205732c8169d192e07
SHA1 02107468a947ec419beaf957e7b9218cae488693
SHA256 6879fb29244786d4d3518042df7eca64a950587b24ace7fb597fa3226cc44793
SHA512 7f2188f81b8b04a5b8c0c3b5179ab3889c21f1840cb493c794f18ca430cad630d1c3e31f0edefbe7d36227fe6763a6f12f4e81fa5d1b796f63765c02d3b9c28e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 70fb48ae201ab4205732c8169d192e07
SHA1 02107468a947ec419beaf957e7b9218cae488693
SHA256 6879fb29244786d4d3518042df7eca64a950587b24ace7fb597fa3226cc44793
SHA512 7f2188f81b8b04a5b8c0c3b5179ab3889c21f1840cb493c794f18ca430cad630d1c3e31f0edefbe7d36227fe6763a6f12f4e81fa5d1b796f63765c02d3b9c28e

memory/1184-101-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 ee45d72e2165503b4020fd768a1ec3fd
SHA1 88131848c2283c0e9ae520abcd70b48544a5ea47
SHA256 cc9bf1010cc7aed26022679cbd4813aa38e0990878ee391fd78a79374cb06b2c
SHA512 6a356817e5a6c09a5cd0d5802c2f8e5628f2e3f8564422dddc5421dcfc36da7299860abd851e244bd1ecef484bf0832cd7cf2ed2df8c067ecfdc3a8002799507

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 70fb48ae201ab4205732c8169d192e07
SHA1 02107468a947ec419beaf957e7b9218cae488693
SHA256 6879fb29244786d4d3518042df7eca64a950587b24ace7fb597fa3226cc44793
SHA512 7f2188f81b8b04a5b8c0c3b5179ab3889c21f1840cb493c794f18ca430cad630d1c3e31f0edefbe7d36227fe6763a6f12f4e81fa5d1b796f63765c02d3b9c28e

memory/684-108-0x0000000010000000-0x00000000101F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 28e823d014666971b8af6225513d8868
SHA1 61acd4ce51ccec02d4abb6458ecde1564614936f
SHA256 dc8972f96c5ed9af7f7d9585e54109842508ca599e18b6f6423b22e09f25fadc
SHA512 707775f324a260f804ba4a4ec93899d1bdeca35f1f3e1ef66d97a0064f7faebff49bb57956ae1db1a85ac6b3a78db928e4cde1632cbb4c2b4e65b7688b3acd1e

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1056-112-0x0000000000380000-0x00000000003E6000-memory.dmp

memory/1056-117-0x0000000000380000-0x00000000003E6000-memory.dmp

memory/1056-120-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/836-119-0x0000000004B20000-0x0000000004BDC000-memory.dmp

memory/836-121-0x0000000004C70000-0x0000000004CB0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 33526e671dbd611e503994b828d2f95e
SHA1 ca41836826eb3bc75b5970395d8f0f92c2a30658
SHA256 f36965d4ac787cfb8b608ebdba40ebbd5e4ac5f811635f376cb072f8342697a3
SHA512 0eac1a1dace372a7b91ed56efccd3b1dbcb20a10125193a87444840c3597b124a77d5e7f829df1206263f108420ae1e0390bcc73a6844efb7b7bde7a25cc3497

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1824-132-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 c989d91bccc19d246bc7df6b46138e6c
SHA1 617e4aaa252627ea4f1dff997134ac5baceac1af
SHA256 85d57f2cc1bf0bb03792bbf4d7d5d6d6bca3b704f3df513b9ae574035f5e803d
SHA512 ff6c0e96368c4dc60a3e38601ae8d52539ea34e9cf1ede68652d51ee911e85728c0675e6cb8ee10de22545c1198bc5453a99e2d05db6f259bce86bfdb4c9cff0

\Windows\System32\dllhost.exe

MD5 c989d91bccc19d246bc7df6b46138e6c
SHA1 617e4aaa252627ea4f1dff997134ac5baceac1af
SHA256 85d57f2cc1bf0bb03792bbf4d7d5d6d6bca3b704f3df513b9ae574035f5e803d
SHA512 ff6c0e96368c4dc60a3e38601ae8d52539ea34e9cf1ede68652d51ee911e85728c0675e6cb8ee10de22545c1198bc5453a99e2d05db6f259bce86bfdb4c9cff0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 33526e671dbd611e503994b828d2f95e
SHA1 ca41836826eb3bc75b5970395d8f0f92c2a30658
SHA256 f36965d4ac787cfb8b608ebdba40ebbd5e4ac5f811635f376cb072f8342697a3
SHA512 0eac1a1dace372a7b91ed56efccd3b1dbcb20a10125193a87444840c3597b124a77d5e7f829df1206263f108420ae1e0390bcc73a6844efb7b7bde7a25cc3497

memory/592-139-0x0000000100000000-0x00000001001EC000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 16b4819ea74a541e7e15151c7b97496d
SHA1 3fc98f552da23e8c9d1920b0cb033e03c96a3a36
SHA256 f9a4a4753b30f6ff1e0c4d5265bd990ab1b3cc1458d017b70f5eab5dfea4abca
SHA512 85136f5f5c74b05f23ea7c54ffe89caebaaa52556ad3de759aba7d095b462038e1ff7c1e57fd5c49105736ef5ffa7555dd36ac6eb64238fda668da79714aa746

C:\Windows\ehome\ehrecvr.exe

MD5 16b4819ea74a541e7e15151c7b97496d
SHA1 3fc98f552da23e8c9d1920b0cb033e03c96a3a36
SHA256 f9a4a4753b30f6ff1e0c4d5265bd990ab1b3cc1458d017b70f5eab5dfea4abca
SHA512 85136f5f5c74b05f23ea7c54ffe89caebaaa52556ad3de759aba7d095b462038e1ff7c1e57fd5c49105736ef5ffa7555dd36ac6eb64238fda668da79714aa746

memory/1624-142-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/1624-148-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/1624-151-0x0000000140000000-0x000000014013C000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 568e391a4dc2f8ca7b1aef8948feaf63
SHA1 58a5bbe08d8daba81d1e2f38d52a1b2553e3f9b0
SHA256 7e579dd131fe227896258505c3e7c81e145f7af4b9ea1d307cfa961f10c4739f
SHA512 867b2b3ef8eab2d86e5190ce4f10f3131b585ce1097bf9ea41a95475e18ecf6d41e2d29717b6d6b16452ac6b89b8f666342430d90286c69ed2568a83305f6c43

C:\Windows\ehome\ehsched.exe

MD5 568e391a4dc2f8ca7b1aef8948feaf63
SHA1 58a5bbe08d8daba81d1e2f38d52a1b2553e3f9b0
SHA256 7e579dd131fe227896258505c3e7c81e145f7af4b9ea1d307cfa961f10c4739f
SHA512 867b2b3ef8eab2d86e5190ce4f10f3131b585ce1097bf9ea41a95475e18ecf6d41e2d29717b6d6b16452ac6b89b8f666342430d90286c69ed2568a83305f6c43

memory/844-154-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/1776-161-0x00000000006C0000-0x0000000000726000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1776-166-0x00000000006C0000-0x0000000000726000-memory.dmp

memory/844-168-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1776-169-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1624-159-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1624-170-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/844-172-0x0000000000890000-0x00000000008F0000-memory.dmp

memory/1624-175-0x0000000001430000-0x0000000001431000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1776-179-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/868-180-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/868-181-0x0000000000670000-0x00000000006D6000-memory.dmp

memory/868-186-0x0000000000670000-0x00000000006D6000-memory.dmp

memory/1624-188-0x0000000140000000-0x000000014013C000-memory.dmp

memory/844-189-0x0000000140000000-0x0000000140209000-memory.dmp

memory/840-191-0x0000000000280000-0x00000000002E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/868-200-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1760-202-0x0000000000AD0000-0x0000000000B50000-memory.dmp

memory/840-203-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 530e730bf7f185bc7adc1fe7ab3315eb
SHA1 d7a9e4917cdb0c04433d3adc16eb896bef9928c1
SHA256 a9ae6c8f103f1d5b070b051323209eb5d90427a7496ec39b0fa7a54c92f3ec27
SHA512 550c4fa9bb80860b21a6121dcf155118c2751b2e2d322c8abeb9b9e5d59dce10a56673036e28c02965ea349436bc3eaa6001ee22dd331889c583047dbfc1a880

\Windows\System32\ieetwcollector.exe

MD5 97713b24d4578e3243bb3b2f3bdb3126
SHA1 7d6390459fdd308b412b74daa49afad7d0e1b909
SHA256 db2ca90f6f411decd7e1c11e6ebec50d6e389f4a541693afec297c8e4b9a5350
SHA512 9a47441d39103342669af21f20296bb5c956155fec00f688fcdccf2b18ba34ea356e8287bc86a86b84dec54b1a1211b9a1724cf24b5148dcbb7fc3d4dbe2f72c

C:\Windows\System32\ieetwcollector.exe

MD5 97713b24d4578e3243bb3b2f3bdb3126
SHA1 7d6390459fdd308b412b74daa49afad7d0e1b909
SHA256 db2ca90f6f411decd7e1c11e6ebec50d6e389f4a541693afec297c8e4b9a5350
SHA512 9a47441d39103342669af21f20296bb5c956155fec00f688fcdccf2b18ba34ea356e8287bc86a86b84dec54b1a1211b9a1724cf24b5148dcbb7fc3d4dbe2f72c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1776-230-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1040-235-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1728-237-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/840-236-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1728-249-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 a2416345ad36fa2bac9e05179f09e54e
SHA1 d74de18bd7dd91f98d35e814ed233c09cdd4b438
SHA256 01653b8d0dc0d3b3d069bc33beba81df5e645f8468156919ca8ee0ec3cb627dd
SHA512 34d15603e2a339732be59cbf1885224f3540f48549965cfaded9eb62e891e9e39b2231ed2eecb8561064ce844dbdaab025bb23ebab5d593f67d58875484d7d92

memory/1448-260-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/684-261-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 aaaa001f07a11f6a0b1f6c4d81002ee6
SHA1 42fe8212ad72544af9a6e9b40d984c4efaa657a6
SHA256 2d4d8746e690fd444f0dcdf3fba4c21b678152591a52eab776f0d08bb31e1060
SHA512 f878524ac29b030a4f1742a0cf55a9d0e3b8da19140b8dacc8d7f45ab6b49fa1ef8e03bb93b13771ef2563f5466a37f90845024b54ee822cdd1dca624a603dc3

memory/1760-270-0x0000000000AD0000-0x0000000000B50000-memory.dmp

memory/2056-272-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/684-277-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 8c0b871e8510485c20a75c3357b8b580
SHA1 541f2217f6aab186c698da62276a1c1d9ed63948
SHA256 5ede32e852e2a639a766dbe7d9ee086a673bedb0c7537496734ad2fe69ced97f
SHA512 716708921b39abbced746afc4f757e572230221893adb4ad6bd3ea62328c85318b6292ae5cad5e1d78255acd38639697e61640a3cf34a81a452b4aff609572f9

\Windows\System32\msdtc.exe

MD5 8c0b871e8510485c20a75c3357b8b580
SHA1 541f2217f6aab186c698da62276a1c1d9ed63948
SHA256 5ede32e852e2a639a766dbe7d9ee086a673bedb0c7537496734ad2fe69ced97f
SHA512 716708921b39abbced746afc4f757e572230221893adb4ad6bd3ea62328c85318b6292ae5cad5e1d78255acd38639697e61640a3cf34a81a452b4aff609572f9

memory/2236-290-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2156-292-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2056-301-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

C:\Windows\system32\msiexec.exe

MD5 acd0e6c693b4907fdf2383951f471902
SHA1 cda6756197994b9e5420e94193df2a65772efc3a
SHA256 d2d89b9cf8bb8fbfa2f5a63f1c9d096fcad633e8487b5f10fb7ca0a76f64814f
SHA512 81878aa01e7a99338e9c608caa1214de7d70926209386e35b06a689008852663721886a4dbabe038e539b820d94a414ae331e3267f63fa05fee9bfb3c821d27b

C:\Windows\System32\msiexec.exe

MD5 acd0e6c693b4907fdf2383951f471902
SHA1 cda6756197994b9e5420e94193df2a65772efc3a
SHA256 d2d89b9cf8bb8fbfa2f5a63f1c9d096fcad633e8487b5f10fb7ca0a76f64814f
SHA512 81878aa01e7a99338e9c608caa1214de7d70926209386e35b06a689008852663721886a4dbabe038e539b820d94a414ae331e3267f63fa05fee9bfb3c821d27b

\Windows\System32\msiexec.exe

MD5 acd0e6c693b4907fdf2383951f471902
SHA1 cda6756197994b9e5420e94193df2a65772efc3a
SHA256 d2d89b9cf8bb8fbfa2f5a63f1c9d096fcad633e8487b5f10fb7ca0a76f64814f
SHA512 81878aa01e7a99338e9c608caa1214de7d70926209386e35b06a689008852663721886a4dbabe038e539b820d94a414ae331e3267f63fa05fee9bfb3c821d27b

\Windows\System32\msiexec.exe

MD5 acd0e6c693b4907fdf2383951f471902
SHA1 cda6756197994b9e5420e94193df2a65772efc3a
SHA256 d2d89b9cf8bb8fbfa2f5a63f1c9d096fcad633e8487b5f10fb7ca0a76f64814f
SHA512 81878aa01e7a99338e9c608caa1214de7d70926209386e35b06a689008852663721886a4dbabe038e539b820d94a414ae331e3267f63fa05fee9bfb3c821d27b

memory/2156-326-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2372-327-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2404-329-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2404-330-0x00000000005C0000-0x00000000007C9000-memory.dmp

memory/1760-331-0x0000000000AD0000-0x0000000000B50000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/2372-342-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/2584-350-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2680-362-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/2768-365-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/1760-374-0x0000000000AD0000-0x0000000000B50000-memory.dmp

memory/1776-375-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/1448-383-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2768-387-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/3016-388-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 ad3c22d5178210777244036322227eb9
SHA1 a6ec3a884075d14c7c2451dee42127112db40f93
SHA256 982003ed8a4d8376fee24a6101f5f5312f32289bc3261ce5070660b7b08523ab
SHA512 7b8379a892cb9d280b1313600b1ff060f9e3e5283ba8c0c5e91c7356ee3b25aa91da29862eeb4a708f328974854b1cb9aa5585632629d36d8019013644cbfed2

memory/3016-399-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1760-400-0x0000000000AD0000-0x0000000000B50000-memory.dmp

memory/2108-401-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2236-402-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2404-403-0x0000000100000000-0x0000000100209000-memory.dmp

memory/1760-405-0x0000000000AD0000-0x0000000000B50000-memory.dmp

memory/2404-404-0x00000000005C0000-0x00000000007C9000-memory.dmp

memory/688-406-0x0000000000400000-0x00000000005A8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 16:07

Reported

2023-05-01 16:26

Platform

win10v2004-20230220-en

Max time kernel

151s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3c46cc2fc0346ca3.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4788 set thread context of 4256 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{12B41477-B896-4CE0-B721-49B4FD6AD28D}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000699c6194497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9b4f893497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a264c94497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064040a96497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040780096497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001c46894497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054c2c76f497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000edcb390497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd97be94497cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4788 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4788 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4788 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4788 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1912 wrote to memory of 624 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1912 wrote to memory of 624 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1912 wrote to memory of 1092 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1912 wrote to memory of 1092 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe

"C:\Users\Admin\AppData\Local\Temp\35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 63.251.106.25:80 npukfztj.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 131.17.126.40.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 52.152.108.96:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 24.249.124.192.in-addr.arpa udp
US 209.197.3.8:80 tcp
NL 8.238.177.126:80 tcp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
NL 173.223.113.164:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 76.74.6.107.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
DE 169.50.13.61:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 61.13.50.169.in-addr.arpa udp
DE 169.50.13.61:80 lrxdmhrr.biz tcp

Files

memory/4788-133-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/4788-134-0x0000000002410000-0x0000000002476000-memory.dmp

memory/4788-139-0x0000000002410000-0x0000000002476000-memory.dmp

C:\Windows\System32\alg.exe

MD5 23a06aa49496fb152e49ef11a4a12f81
SHA1 c187ffc769e6781f729a27e82f3bc7b7cf029c2e
SHA256 b136b5427455479a16e595da256f38c7258d7ce631360c7f1b821507da3deca3
SHA512 23da7fb26ceb78d6854bf4d4310c0edc6720417204fbe5c5dab2d7b9d2bdd76ce54674060e9b593e9003fdb99f05e14ac90d36bbfb9bb8e8ee6981bed8de2a1d

memory/640-146-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/640-149-0x0000000140000000-0x0000000140201000-memory.dmp

memory/640-153-0x0000000000680000-0x00000000006E0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 1fad8e29c7f02510eb67c53eaff95137
SHA1 0f09767f760f6f1abb339d1a79f982de7f7399cf
SHA256 33fb5729490dba7b968e9008dd33bc22f719f16c29a28e00d4d12aa1ed00eac3
SHA512 ff471e323874a77917065baf431b330a4d830e52e64ba70c547a09856b9186b5e9b8f7c0643975cb858216f9859a74949bc1df40ddcdea32cc7d6b19c9779828

memory/4232-159-0x0000000000490000-0x00000000004F0000-memory.dmp

memory/4232-163-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4232-166-0x0000000000490000-0x00000000004F0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 7dc3a85a769ec85be54e1e2b79982fa6
SHA1 559d16c6895eaaa9bb5ac0fc4e752176b30c3025
SHA256 47e30d491565af49f5cbf8441c92604027d6a6478cf088985accfc489cbea9d7
SHA512 5c635312f9921f40914631747f3659cd2fdd74ebbbf0609ed3476826793b201f37cd0531f17eba2dce54d5272faa13f6996895440394f4917bb56dd9a06a6b90

memory/4432-170-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/4432-176-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/532-180-0x00000000004D0000-0x0000000000530000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 627f5ec336ec7d360e2bb297ecf2c919
SHA1 41c0dcbc31785cb13915af445eb53e3eeb6df95c
SHA256 bcd9fbf93547f315450058b6c5e7bfeab627e151263fad18609c7ca84f6d0c7a
SHA512 1508c0f986f47a823fe257bffa853303d70770a5820294af64c61f2fe46682eb1d8d7d5e5fc273252bf47de1d853689d78861579d6f255e560f81a9905146662

memory/4432-181-0x0000000140000000-0x0000000140135000-memory.dmp

memory/532-184-0x0000000140000000-0x0000000140237000-memory.dmp

memory/532-188-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/4432-190-0x0000000000E20000-0x0000000000E80000-memory.dmp

memory/4432-193-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 b5c0638ea57f87715d87c164f6ac32e7
SHA1 24819fc2c237ce5c6cc9f8990c5cde7241893def
SHA256 a0e43c7bf228d11738398b13ec6c822b4c2b0a0f3d7118b9a32608ff32735693
SHA512 aa40b5794dc50cb404b8a06ccb61fd766a830235422501d0dbd30f7091ed2b5457fc7414315fd5a50320f8ef1f64d5fd88941dafb213bb70d73b73875635fff0

memory/1892-195-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1892-201-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1892-204-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d61b0e8f9957f7aeaf22fef32c6edc69
SHA1 3a40949f9975c85370ea112886719ad65f28b572
SHA256 cce2f13be4cdd3dcc956776ddc30bdaa401badd1f5654bcf9732dd6743038a3b
SHA512 27886ce08f0207113dab579f33cbee357eb3cf9dd1b4603e8d968783915e0eba2c09d6db27f9a891e425a21dd2f14493d1b41672f267263ec80f41865ee7d797

memory/1780-206-0x0000000000CF0000-0x0000000000D50000-memory.dmp

memory/1780-212-0x0000000000CF0000-0x0000000000D50000-memory.dmp

memory/1780-215-0x0000000000CF0000-0x0000000000D50000-memory.dmp

memory/1780-218-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 75d151327af9c5aca1d093afd9a95b70
SHA1 07dd4a420eb2fac08fea1bf2ef58adc0531dd43d
SHA256 9a7226a2702a27a848ac14a7756e6fed751a9f4840164da85b0aaae49ef9c5c0
SHA512 b0950b6ec732c4e3ce978b21cb29a406f191517cf8f4d720eb451613c4828135df274af2c4ce7827f3b3bc2fa4eec82028c7af58c324bf5d5d4ccd62370f16bf

memory/452-220-0x0000000140000000-0x0000000140210000-memory.dmp

memory/452-221-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 07962f0e3538b9df82394fb344158156
SHA1 9349d15f2730807df99a79ad157f988fdc49ea0a
SHA256 4d0f2668e4d5d315cad9573d9673b4b9897f7b23362c0ac95d81147a96ddf131
SHA512 3dcd939efd7d150bd7a19f7b39b3498cc28db113a9edfc8f35409edb4e4a167659609666068e98c77b153a3702b2c0c4c7c5df13cefe5539bc49e87a7991704c

memory/4280-233-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 56e29ce9bd500691099bbdbfddd264fe
SHA1 6e00d814800c9eff2d98bf4d2a8351ccb3084b4e
SHA256 84f20b80e1f6b7a800510af2c7ad897036b7787d44d128bfcaa5f3778d0f09d4
SHA512 d2c4501ae2370bc6a7c760eb35817c529b76169e364c245951e667b0833b2df8848351a1216c5769a1bad7f27613658b21a45b77cf1667a6b6967454b4581577

C:\Windows\SysWOW64\perfhost.exe

MD5 046ac11c95e53a4ad2d62aa1ecdcb1bb
SHA1 9f05e8a2a7cc0ee358da7fd2e43a9b9d9b4138bc
SHA256 1991441beaf35a7926f041c86da7d69108c295ae3f645d4a26dfbcf989f480b3
SHA512 10ce159696a4ff667df036e77cc455d21add0edfdd082efca4fc068b19324e05b02037aa2f792ede56c94f3abeebe8e845f463c67cdbfdb3c687ac35b6d2959a

memory/4744-256-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 77154e5cd605560f197e71ae786e2d19
SHA1 87843528b2c036e1d161d88a1f42d9cb91073c43
SHA256 3e3af6cb387cacf00502f0140c948de76d797b328296a97987ef690014f1298c
SHA512 5f2cdd84f52cbf045a1f3f53b937d3191241244b3b213b896bc499c70596c5a70c1ef99203d6ef5e173c7dc9d7514f7f524dd851775c020c83ff6e02612ee425

memory/1748-275-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4296-274-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 099fbcdd01da1085438da3fa2728c3a7
SHA1 68a606d3d9ba59949aac0bd4d2481441afba71ca
SHA256 60c87f57a7bd52c0883919b4ebcb2d1229c28ad1c8080df7895cac1b40c5e93c
SHA512 0d7e96be3cb3f1f6bb52c64ca07d92fb24a8eaa4c187401cbdfb5400cd0dd78dcf2eeda05f311cee088611901f75a305f26b2c83112f85fa73d0f96e391e3075

C:\Windows\System32\snmptrap.exe

MD5 27e8912eb0474065e243f3e7fa055750
SHA1 4085bdbc3ad8a71ff9fb484fc576fd030086a177
SHA256 6b3e4733976ffe4a73edae5e38dd54007d6138b194113b098101940f86738881
SHA512 ef121f7a662ef9e3876ac01740fcde5f8e3cf12bb6a0402e788a8383a038911660c6ca4ee4aa0f5982075882a2bbcb7bee70b19a5bc161ad145b3d63e92c3a5a

memory/3028-290-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3912-292-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 e44c4cb08c70a4864466ad98aea0eade
SHA1 b75b65715f817a8a015a3a720c0bd403defa0af4
SHA256 69da7abb0f2e6e615501cde5a3f7ef7ee0babf21e21d02e2a1eb3d9782776b8b
SHA512 c41d913c7e549805b39ea156904175688c21aa41622aa842d46d5e86d829e69da85e99dbbc966ea5031e56a81f38c2f03b2b0361a9e5d707efb14e9c1b5fdb72

memory/3800-303-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 7802d864670d0b83fb702a574915874c
SHA1 cc1b4e29b50403a4dcf1d1208b019d449570b629
SHA256 f5aed43c0f79d69a45b6c76d3f45e603d7a74f6f9df3a73a595d9d9fc7f1f6ba
SHA512 af9163873dfa5a78b7031fa7b6eaacfd7768b35a318685890662ca7a23d079fc251c689ad4a2770f5226d0de0ef95255757b50ba35a46b2f60a7d6c1883ffb46

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 7802d864670d0b83fb702a574915874c
SHA1 cc1b4e29b50403a4dcf1d1208b019d449570b629
SHA256 f5aed43c0f79d69a45b6c76d3f45e603d7a74f6f9df3a73a595d9d9fc7f1f6ba
SHA512 af9163873dfa5a78b7031fa7b6eaacfd7768b35a318685890662ca7a23d079fc251c689ad4a2770f5226d0de0ef95255757b50ba35a46b2f60a7d6c1883ffb46

memory/640-321-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2612-323-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 53b36a08d7947d491db494788ec79263
SHA1 7adb91ce39c21da3743516cb09a0c42e732b46da
SHA256 6318bf7f38fe7bd58e314a36245f29f2b5689471c7ee7235fca68294a96f7a9a
SHA512 8744c787a518b12829d4d4d652dbfee02d41ce12bc7b0d6fec19e0053940125a883505d8e77916879a67faefb224fb605a29938e49b6bfdf46dfacf41766eb30

C:\Windows\System32\AgentService.exe

MD5 0c9418748f94521ecec3ed773a17feea
SHA1 6a229e546140bb91f5eb43d72140df7f985227de
SHA256 cd2673b7888209ad7967584c0a709d00b025ec3812619f7aa5ae6967aa8d8c31
SHA512 997a1aecd8f3a8feda8768f201a178536c413c6c64c4aea682211a9afdfef539111fe488da9fc8b092c3f1ed1a8dbae3ad7f9449b377fce315afe90155a7a90c

memory/3744-340-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4232-338-0x0000000140000000-0x0000000140200000-memory.dmp

memory/1544-342-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/1544-349-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 31297f5e3dd4747c64ace3799738b991
SHA1 e009d0be5666d67365f0ff989d55d4a9c3293096
SHA256 f478af1285b3dcd292a3c3540926ba054194db6a2419cf4d33e24bd02c1de4f7
SHA512 3e8ac54ceb9903d84d2589ac7b8ee298abd7f74d75b1d990cc4f958017d94db300c8872f72b62e20616724e62969a21f6eaf4e44a782e3b670ab9a9c440ee167

memory/532-359-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1892-360-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1400-362-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 18175c0f2d7ad5041f2b9438b56bbb5e
SHA1 6ff93763be696f472c1a399da6d90daa54884247
SHA256 e3d1fc5792c49e5af73017131117f2cff42a0a73c99794181dd1f2de44094325
SHA512 156e88d2d74118adb67b3272d614b489c93c78fd1334eb336b3e9b7e1f30135b7c9272d1328c84e7b0144c2a9c1454fce1eabf76aa8d864b12a20d0108495519

C:\Windows\System32\wbengine.exe

MD5 49fcc31ee87934873f82005c6a33629f
SHA1 44bd6ef73bc2521024ee6929529afdde19f94d55
SHA256 a686ca56ffed7e0b1ec3d456b75b818c2f6a0c34f336b351d887bb63a7872bca
SHA512 a06587782d8a2e1b96d9ef0110d3bf069968d9fa9c2aa567765421f911f73e79101f5849aec8f2720181c37a6c68c44ebc4f643583888fba60f8ac8920549b47

memory/384-378-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2644-380-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 427ea1aa839fe6d0a3823b4ffaeb2018
SHA1 a28d3dd1d5141c409b116504c5ab663a35c01990
SHA256 4ba7ee1b47452848634bd99fef0f0919672b714da0db7794ef0935f0b01e5aad
SHA512 a2b2269c64811499ced3533cf74e8a09671882bc6c67b34493b94d0d17d09a1bc23c628294a48b1c4e78c67b7d4f982a21a7d663889b26c691ff811188f4613d

C:\Windows\System32\SearchIndexer.exe

MD5 aa85a694911c6dbfc3557808bd2183bd
SHA1 146df580c2aa7fae4aa45026b8dc22661aa340cd
SHA256 038ab97aadec1c21685fcc671c848523f55c7aba4631f070234535898d1f1e69
SHA512 6ef8570bb957168bb1c47ccd3ce63d20d327bdf71e9308eefecad1eaa8a7efb6f212198f4c51dfb82631b84ff3dc8bd23ef47125799aff14541c9101a9267e19

memory/452-399-0x0000000140000000-0x0000000140210000-memory.dmp

memory/948-400-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1912-401-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4280-419-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3028-437-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4256-495-0x0000000000B50000-0x0000000000BB6000-memory.dmp

memory/3912-504-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3800-516-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4256-538-0x0000000005130000-0x0000000005140000-memory.dmp

memory/4256-540-0x00000000051E0000-0x000000000527C000-memory.dmp

memory/1400-554-0x0000000140000000-0x0000000140147000-memory.dmp

memory/384-576-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2644-577-0x0000000140000000-0x0000000140216000-memory.dmp

memory/948-579-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1912-581-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4788-631-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/1092-664-0x0000029C61000000-0x0000029C61010000-memory.dmp

memory/1092-665-0x0000029C61060000-0x0000029C61061000-memory.dmp

memory/1092-666-0x0000029C61080000-0x0000029C61090000-memory.dmp

memory/1092-667-0x0000029C61080000-0x0000029C610B1000-memory.dmp

memory/1092-668-0x0000029C61110000-0x0000029C61120000-memory.dmp

memory/1092-702-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-703-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-704-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-705-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-706-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-707-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-708-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-709-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-711-0x0000029C61060000-0x0000029C61061000-memory.dmp

memory/1092-712-0x0000029C61110000-0x0000029C61120000-memory.dmp

memory/1092-714-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-715-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-716-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-717-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-718-0x0000029C61150000-0x0000029C61350000-memory.dmp

memory/1092-719-0x0000029C61150000-0x0000029C61350000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 1a81bb489619403fceac2ce23695523c
SHA1 11d25228910e112787c22815874366796d3fcd80
SHA256 cf620f6d30b7a5c773003e8356fb19af4569e0a75c55abdc22834d0f706e24ba
SHA512 63e4e4c98acd249e6b1c3b3e85aa2e10fea3a51f6b0caf3bd5f6ea6d0bbae2e9219617a33f2fdbe1690a1aaf3f6be612b4cb1cb81d6931af4079f200117b45f0

C:\Windows\system32\fxssvc.exe

MD5 7dc3a85a769ec85be54e1e2b79982fa6
SHA1 559d16c6895eaaa9bb5ac0fc4e752176b30c3025
SHA256 47e30d491565af49f5cbf8441c92604027d6a6478cf088985accfc489cbea9d7
SHA512 5c635312f9921f40914631747f3659cd2fdd74ebbbf0609ed3476826793b201f37cd0531f17eba2dce54d5272faa13f6996895440394f4917bb56dd9a06a6b90

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d61b0e8f9957f7aeaf22fef32c6edc69
SHA1 3a40949f9975c85370ea112886719ad65f28b572
SHA256 cce2f13be4cdd3dcc956776ddc30bdaa401badd1f5654bcf9732dd6743038a3b
SHA512 27886ce08f0207113dab579f33cbee357eb3cf9dd1b4603e8d968783915e0eba2c09d6db27f9a891e425a21dd2f14493d1b41672f267263ec80f41865ee7d797

C:\Windows\system32\msiexec.exe

MD5 59bfe90749fe115f84dbade8f877043d
SHA1 a8df54b55cafdacbbf37d6b8383d515a44e8f689
SHA256 395cdba2fa37389217303732fbf992916793340d612447077241661e26fdb35b
SHA512 91542100c2dd1d8dfc1afed914edbb38ee7225fd30fe43663fe45fda5e429ec44802851748f329d7a5b9918080b93be1a59c131a9876a4d192d6e8eef659421e

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 e43c3c87e90544fb2743a034f7ab166b
SHA1 2eb1fc4fb697343be154ca858cfb2687bcbec5f6
SHA256 0fb28d0ed14c72f97951aaef4482d0b224a08cb2e1398a761a602fe5bbb17ca5
SHA512 4f6685ce00b1ed6de12a45700ca83faba4896b34f07751594dbad3db2944c75d59893790353695d9ffc580552c62fe046130976fc7da9e4c6554c0338d6e280e

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 0cdb2c68a954091c48dee70c8fb87687
SHA1 e1f84178c3426d066dc8da48261be37975445c76
SHA256 50e4b2a16ff44cdd44a4011cf5c7bf1b7d7739958a64d97c0892897d2d6b0414
SHA512 1675d249a0092626407df566f940166123a94fd69f991c23d2181e4942fca4166e3ec43b6f538353f68732384dee675ac979bee27f35bca29dafde9cbfeff791

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 8fef02870660f118e06f5fb3520cc08b
SHA1 ddde703e7bcb46ce03c74c2e45f6e40814742766
SHA256 e51040daecb3ecb46da691670bb8321be30ff9f63fbcdd8fafa94caab7a189c5
SHA512 c2cd8cbb17d34303d3832d13f650ef41ae074e2137862bbc94f7691dbcdc360307fb5245b45399fb1108b84935236236418f1f5f075f9548ca4a186884d4ed92

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 25eac17988eea597328998f66ef2938d
SHA1 8b5eb52e2667f0ed7d97c603049f8f1ac4517a18
SHA256 1fdd1de7792c2fa10146073b98b378b566742a80b07c70357c43708a501c0d40
SHA512 06d2f5c779cd0931ea484664f7480df3cb66fe131bde9d5e4189574b898774269c0a97401dc1efd0f941d08c800a5b166b45006a14fec786d5c8a13328858644

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 211cc2a3ec01c856c7f401d28e7f377b
SHA1 39d6428860ba9f00f114fcc4b1c35ee557a7dfed
SHA256 fb80766a1f2ca9032d70b47b89c4a8572f75203a70ab1da8762ace1371c92178
SHA512 c5f48f10e5d2196c9a07fc486defc774328c7178bbc5844c4795053616f48a8b4025c194fc40bc9516cbf17ed56d1be46320d6c85ba4e6b9cdc07eaf1a55f3cd

C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

MD5 708b3158a55172ddca62f4690d3b1c33
SHA1 86ce050f5007e4bc70b656f4d9ee42458cc4684c
SHA256 e1c57fb1cd49b90d49779b3635a1e5d6847cb05d5c1d99b19582010784f84ab2
SHA512 e6dd9807b496955a5b9129221d8a7222a572c8c3bcc172311e1037ba1d258d2f2c3ea862ccd6f818baafa043f95fc155c2a76ebded8e83ce8bdc11a5316681a3

C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

MD5 03c9ed6b31c9dea256dc2831e8204888
SHA1 bf861df06499a22d5ef0f792b07a98b5946b2fd8
SHA256 453b49a08ba3aeb1562ac8d111bfcdb5a1cb4e8df8a6cfd3a104e5330c6b861d
SHA512 96d844f8fcf69500efb7b5c22f30ba14a78650de2e0a53518fed7eccedfa0c9bc03b2ffe3be7bbaeda460c1a56646996238bb8fce4afafb12530ffabe687667b

C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

MD5 0f9dbe4bcbf39845884c76d7c15876c5
SHA1 c8a6aafca320235b52d10b25ba979b8c58ea0ef3
SHA256 88e404959fddcfc56cbf6feab5945406aa6035b5be792da02c2f8e325e6f3d22
SHA512 8ec9c364b30bc51a24b1279935ee045c981370fe6d55a109fdaf939c952205e25cfb9645b85bcea0cd2207aeea9acb8e119527ef58b3a38a7bcf2bb58c623e9e

C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

MD5 7a2bf9dc6baf52fba4aad1910504b820
SHA1 112734a4baccc1961320b76c267b138331b6b13e
SHA256 fca401071087ddf8eedb6e6622cac41e81890336bb2073a1917eb53bfcd6504f
SHA512 9dccf908af455bd63e032e2e9965404902654729bde820833a3f48e4f3c7b034c89af2b85ebbd77e75614a936258dd20cf5149ea304c680a1dc9dc7be66ead6e

C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

MD5 57c4b51b08df910ab27a0006bae0acd0
SHA1 3317e8193fad92dcd7e5e52b6b7569f280660662
SHA256 abe64f0d04efa2b3fed7f162687d0711955a297f117038cf8107207ba5ce802d
SHA512 6d8605814587552683d24653ab7ac190e0d0ed24f495e17abd75a3b0d73474307499e509f23cd60b1b5700e8d604969c6dd09beffe76edcb9d936cc8b03822bd

C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

MD5 e15cc29c4ec83b0921ca0559dee49c9f
SHA1 efcd551988cc5c9d57931d2ddf8b99e5ce611bda
SHA256 fa95539c8954c70660777f56a47401d83d9a7c480ea1224efbe2526b06347002
SHA512 7847c0c67f29604a6bd44deee733a610045fde70d314b45133f7f6bddb07ec0c4ad085fc21fbb97084d5430ae0932a0e93c0228d0288de78cdb0b630fd571dd3

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 35657b07044e792798c03bd32a5c6be9
SHA1 e7f96e59f59a6669e2582ac43e0d6dd15edada38
SHA256 4922a04f412ea256204b392f19cf26072fa2c37276cccd3aa1f2dbee3fcd8ac7
SHA512 f095d8339889c592ffe628d98abdcc7698b26ad2f9f5c89f23a8697659e1b18a878bf662614ea4ce7420c795c2660423862010e8bcf7323c4d8d5c57ad56a1b1

C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

MD5 fd09266b242862d5c6642794ef51b437
SHA1 ceeb8264fe53ec728542aaeeba8812e35adfc592
SHA256 c19a1f25cc2ad61aed0089bfad672f71f165f4586dc5e376c278bc567c761f02
SHA512 c183b8a9d4443aa6673993fef686e5fc6e2980c656bf9d2afdc650be883bf1e594d22d9fc5c008875203c8587c62e561711fffbf511e42697df9ba139ec21af0

C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

MD5 1546477ae998f0959c8857593a7fdcdb
SHA1 7743e46bd008dd8d25c55f3833482288c87debf3
SHA256 35f6f676e5bef937edcc960a57b5cb053de8f8247992a4fbd629679bca289661
SHA512 ddcf7ff4f5d8e4f4685646e89a3be66d3644d919285f8c81bf8734613eb94ba52318e29e17265ae2da9f9564be5da11a42c7aa8ac857a0eafb530e3037014b42

C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

MD5 23ef31708868343863f9ac6132ce199f
SHA1 23929745e1e5f75740780ff4254963808715e836
SHA256 6a38d50569477e5897478bb455dbea97e6f0aa61f8ff4103760c3283176ce97a
SHA512 e40e83ba85fe457f319fce29bb8d8ca45d59164912057b2b9eda8635285b65488ec664764a8a05c2f0da633a62d8ed4b853897b81e06ae7b1c51b0702e5547b4

C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

MD5 e8142f4f43f97100bca1a68eeae3c798
SHA1 b02a76d994892da9960cb50d2bd4c5fda4ad6ada
SHA256 ea8d5a544c459e2b91fb896fab46620476bbbe7be0aa86482ed862a060bb324f
SHA512 8e6481d8bf0e362af8390037a2cff5f633b8029deb491d966ff79981dda0157df09d465e15b3b28e73ad4ba2c366fb14ef4febc2dc60a68d6bcec57958bf6ccf

C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

MD5 bcba6fda17c4edaadb10947d002b335a
SHA1 bf11c753c6756d8d81cfaa19fd95862dcb82e523
SHA256 123aade595289815a93069695758730ae2c89d3a8b18f5c299f6828c9c6792fa
SHA512 a53611e388bd61ec475b82adfb74bbdf9bd62f64fa0e383b89365867ad5dcb4b7bfc32f166978aa3a3b12ef8a609a2f2a08a0f9cb7a58612ab7d84bb992c6b3d

C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

MD5 dba02c113c247452d0ef37787f698d48
SHA1 84bdbf1264b52e7cff23af3b5c1558709c55684c
SHA256 609fdb7635b46e226a550ffe48aba7a35da840512d0377983eb4f2df3e2ba8a4
SHA512 73c50cad94a020d23855ff013242d8a80b27b09659aca266825eaf226afb171ea3a2cae3cc337d980e2505279092f840608e54104d051fc6e74c80bf5c9ab373

C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

MD5 9e4224d382caa0cae658a05561fd7215
SHA1 ff162433b3136d175513726079bc47d33281a48b
SHA256 270b443a3c4d6cb5832ad1c55d371a00457e6a10d58cf5c817ed2d7d933b8ea0
SHA512 d4f739f4265997ef8d8c2fa317b5a68b103405275f76133e74c9559d843084f1a8e51a2a98a25fdcf2cee459d59ce34bc07a45302709cbc48ea8752bd9ca9318

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a1214b21a1c20a73d9ae1ce536a43194
SHA1 1d7a8d33d5ec516e8b1f7d2a1d92eb1c8f7d05ec
SHA256 107f750180cd1254c8e2ec52dbe708b9b39946986e13034466cf20a88736c31f
SHA512 6dace64213953790af44fc74e350967701f8a2d7d8899381c9d0720141fd252924ce9cdce58a30e245d21073351ac26130f38ef2b9cd043c71c4982fbc0f2d43

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 7ac33b6388178901caa045ff406099d3
SHA1 b08cbb3d2ac7c5b4292fc47d73688ca125da7737
SHA256 5b0d7b33242d6ad7408e2a07fcf7d30df1d8b9ca7983b432697063cefbe818c6
SHA512 c5d756bb0c61db0ed6280d992452d8dac6d847932b1f9d35fe1bfbb8b2768a9546fef607a691ebbfac1eb597718aba3b2665ce242c222b7eab789bf68a2030e6

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 0bab2d3955d69700307b5567901bd59e
SHA1 e1e5972bafec2efdc9800291c9b46878a122b7b8
SHA256 ff6cbcc63e1e3569172b714b4f76bfbee740f532c5f24700f3fb69edb740d0b6
SHA512 55f9a7648930e16e1aed31647c633c0ba00d19c1094c58aeb7cceda6afab0858295b07f51f48bbd699d97824b4c77719eb1ea3b4eda97cbbd596bd1e60f5e301

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 3fb3505835de1353f277752d32b74a6b
SHA1 e07cece35626c31b7ced8a6d94e2bb49fd8a05c2
SHA256 50b4d647eb920cf46a03a9d27772a43c52850d602fe1c4c5ca5b00484c77a778
SHA512 7b4ddecd87e388bf23b3ac2a655817125daf899a39d9bf44bb3585c38d72102706a5554edd3f81c2ffb1cebb19ccf601792db6d74f9a23bd28c4b8f26a0f0694

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 487aa50f32b0e8a458561f8b07d7e9ba
SHA1 bc0fa6f9866c0a96b4289a01fa13507f6c21c342
SHA256 9fe0e48b338ddc6e363cb111977870f14b770d1ceba03497bcb0d2972efbaccc
SHA512 a2468e01891d2c03fa7733121e518be4c249a59d0090eb431ce51c452a3e2739856e5055df45c8cec40d0851d863fb9092226756ecbf76eb9318f172772ef57a

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 a68a3b2738167a55aa155b4f65587356
SHA1 270a110ce7bc7bd8991a170698af4446eec1c937
SHA256 ead01cbc9d416b90a5ef51357ec48c3dd17fd5393a254728744fe8a6b2b05482
SHA512 d9007bed9c0bcb0ffb042c759b9c79a329c83e99da3cfbcead474396d98175777d384cb32770b6b1cc30e8f614a5a983dfa0d5ee00187d73f52ba2d7ca8db2fb

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 9cac283613536814e58e2bfdb80d070d
SHA1 d24a5d7ed4b86a9fc3872ba80e56764795d1148b
SHA256 bfaeda9d09b117e03cd017065685b79fa78561348176c0e4641fc8d3bb3805ae
SHA512 2cce8abd9998a7e75255f8237280ab6b467c5293471ea45e2bd07b21131e43dd2f4699d31044a4794cc6f7881bc566fe387205703658d768c3d9da872e2e4c86

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d6e25389b4483ea5313815a9ef9d7dfc
SHA1 73e1ab24a9105efc0ea27c6592cce6db74f46da8
SHA256 936d33f6d3186df23c8295742c6fae7f87cbd2091ebd71554473c6ca8bdf942a
SHA512 d7122281296e72a240e040009823047e4fa2b78e12ef3d2c7d558de1effb73c265c3cb7b6636d86c38f5fa7717b5d7cd6d44ec82854f8eb67b88d9ffbcf06f88

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 d265985b7ea60d2eee8e60132aa2324c
SHA1 32769c19d8bd617b6d853978323f5be1900e6953
SHA256 780311ff0f3031e86b9857053f2b9af6d2090be943f9524dfcff8f63a30a5b20
SHA512 86ecfc77b3188f960d66925465521c0a4e295d9bae870447889a79e021782d960cb80e2af81080d73bf64365fe6044915aa45fdbcc4165cef1d2794612b6b535

C:\Program Files\7-Zip\Uninstall.exe

MD5 a3c2e8263348d8eb2b48e89637618c15
SHA1 9b3c297115f0fc22d804a8230593a99df2be6114
SHA256 034299e25488be99b5bc273620d14b5dcd292fc754c9f203762dadbc3bee35ef
SHA512 efae94dffda4242916922582eadf7026ecc72924f03cbd1b3d53f21b78db5a0f0ce6bb83c9fd688d71a33ff27434f99988d6da0936ee24ac4229a2ec72141e22

C:\Program Files\7-Zip\7zG.exe

MD5 56f7cc9277b63f49c80ecc3bf5cb7516
SHA1 4c53f989ecc62e433a84ca0c27d898c67f88df24
SHA256 773ae3038b6af4539f975259013c0bdaf5604b616b7ca5ee87d7e7e845165ee5
SHA512 e954da185e1ea0e0110ac6cf4f5a50185297ac51fbee9db8e427ee83489cbf830f2b3ca3dca8159de4b75c69c8af82338d6cc024f8aa568fe8602cf489d19c73

C:\Program Files\7-Zip\7zFM.exe

MD5 efab64b6bf992b882abe214bbbf3daf7
SHA1 df6677bc52b03d2aca2797972a76715c2c9b8e99
SHA256 0efcdfe2b8287dd2eca1e43db2ab24cdd07e130c668afd525801b4941fb8c365
SHA512 26bed6a95d22d087e1ac3e497d8592a241b46a7731e7c57b71051e9a24a5e6ca2e717d1b2340b89b42830ff2d2238647b985dbc9ef3a3aca4e9a0460dfd6c906

C:\Program Files\7-Zip\7z.exe

MD5 a9fb116e3335127bf12435a359606d59
SHA1 70be601d42692747ad65dea887e744f9b659a9d3
SHA256 8482ad4a99270ca80e52be7202b01f4da365523fc7049f9af7d4d912e1a0504f
SHA512 3ec7a23c04826270b8d7d0f6308f20ce3dcebb5e610bafd2abef3b2a3d88466df43a0229d2e9800736831e4ef54820a381e9249dc69719fd98ba65bfe12d393d

C:\odt\office2016setup.exe

MD5 49ebac7744250dd990a9bf7f8483b34e
SHA1 009ecf54bf18a238ea64d990fa804af6500ec552
SHA256 1ffacff576454358557ce47ad1bc735d8eae8c848042322817fe690566da9f33
SHA512 61782465deda8d62557695d6260c01625ae3e15a82b0f9b1aa2a1dd23b92a2017f250ebda4683698196c5566399a8cb057b89778c3cb3a6b68a265b627d6b626

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 b18b3247c8b612494e4f6663ced091c6
SHA1 5efa1a117d1d9f5bfff90e59e75483dc55b51a3c
SHA256 f47663a57de48e71d7714b32078f28bb1a949ef046d69e2af372806350e93294
SHA512 b2d57439304738da0ca9532e0547f3b994372822efe6bc285ebbeee0d36714e39f88aa693d5fa12ec186afee56487278c6bb9145f351760795f643fa7ce45148

C:\Windows\system32\AgentService.exe

MD5 0c9418748f94521ecec3ed773a17feea
SHA1 6a229e546140bb91f5eb43d72140df7f985227de
SHA256 cd2673b7888209ad7967584c0a709d00b025ec3812619f7aa5ae6967aa8d8c31
SHA512 997a1aecd8f3a8feda8768f201a178536c413c6c64c4aea682211a9afdfef539111fe488da9fc8b092c3f1ed1a8dbae3ad7f9449b377fce315afe90155a7a90c

C:\Windows\system32\SgrmBroker.exe

MD5 eded6b2f07c445dfdd129bc99e9d253f
SHA1 14ad306a27aaefc9f25784b3288d2d1d3cb00e49
SHA256 ccca00088ceb905666cb5de1851fe8a4149406fcb332eff5951235b1904df46c
SHA512 42f3d96a1fec271d7e822c284571425670864451769a0bd93576d6327f187246eb612742c9c454259c36dc8068eae4593c8bff1f4aa1ab353f159eabfcaee31d

C:\Windows\System32\SensorDataService.exe

MD5 099fbcdd01da1085438da3fa2728c3a7
SHA1 68a606d3d9ba59949aac0bd4d2481441afba71ca
SHA256 60c87f57a7bd52c0883919b4ebcb2d1229c28ad1c8080df7895cac1b40c5e93c
SHA512 0d7e96be3cb3f1f6bb52c64ca07d92fb24a8eaa4c187401cbdfb5400cd0dd78dcf2eeda05f311cee088611901f75a305f26b2c83112f85fa73d0f96e391e3075