Malware Analysis Report

2025-01-03 08:00

Sample ID 230501-ywk6nsgd22
Target PO_39100.exe.bin
SHA256 6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c
Tags
blustealer collection stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c

Threat Level: Known bad

The file PO_39100.exe.bin was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer

BluStealer

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Checks processor information in registry

Suspicious use of WriteProcessMemory

outlook_win_path

Checks SCSI registry key(s)

Uses Volume Shadow Copy service COM API

outlook_office_path

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Script User-Agent

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 20:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 20:08

Reported

2023-05-01 20:13

Platform

win7-20230220-en

Max time kernel

183s

Max time network

246s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a0a3a2b8826a969e.bin C:\Windows\System32\alg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1716 set thread context of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 2044 set thread context of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1716 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2044 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp

Files

memory/1716-54-0x00000000009F0000-0x0000000000B78000-memory.dmp

memory/1716-55-0x0000000004ED0000-0x0000000004F10000-memory.dmp

memory/1716-56-0x0000000000250000-0x0000000000262000-memory.dmp

memory/1716-57-0x0000000004ED0000-0x0000000004F10000-memory.dmp

memory/1716-58-0x0000000000560000-0x000000000056C000-memory.dmp

memory/1716-59-0x0000000005C30000-0x0000000005D68000-memory.dmp

memory/1716-60-0x000000000A3F0000-0x000000000A5A0000-memory.dmp

memory/2044-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2044-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2044-63-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2044-66-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2044-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2044-68-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2044-69-0x0000000000190000-0x00000000001F6000-memory.dmp

memory/2044-74-0x0000000000190000-0x00000000001F6000-memory.dmp

memory/2044-80-0x0000000000400000-0x0000000000654000-memory.dmp

memory/2044-81-0x0000000000400000-0x0000000000654000-memory.dmp

\Windows\System32\alg.exe

MD5 bcf320105a5dcace76eff1aa996e0689
SHA1 a9594047dffc285379276f2b28514468aeb530c7
SHA256 7f72217e47e1a864e45059a9145c2d361fbbb4d3e2f5d7a71ff2f2c3aea8db7b
SHA512 e74f02f15d9e081ef42d711f06514cc138c54443e82f32f971488effe906ab965c356aacdeff00556881d1ae00a72b7ba93631777d11d09496e76b13ff72c06d

C:\Windows\System32\alg.exe

MD5 bcf320105a5dcace76eff1aa996e0689
SHA1 a9594047dffc285379276f2b28514468aeb530c7
SHA256 7f72217e47e1a864e45059a9145c2d361fbbb4d3e2f5d7a71ff2f2c3aea8db7b
SHA512 e74f02f15d9e081ef42d711f06514cc138c54443e82f32f971488effe906ab965c356aacdeff00556881d1ae00a72b7ba93631777d11d09496e76b13ff72c06d

memory/1960-84-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/1960-85-0x0000000000780000-0x00000000007E0000-memory.dmp

memory/1960-91-0x0000000000780000-0x00000000007E0000-memory.dmp

memory/1760-95-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1760-96-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1760-97-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1760-99-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1760-101-0x0000000000090000-0x00000000000F6000-memory.dmp

memory/1760-102-0x0000000004CA0000-0x0000000004D5C000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 53b6bea93d5e4e1a93c4dfe4a5706d8f
SHA1 80d6e91242f3e91f3b78497d7f56652547d0e4c3
SHA256 b9e60140cdbdab0acae26c9859ab141e729213682655c36ff522b8714760828a
SHA512 8999725cff43f3a31c2c3d2473c182d4ee3e491379cae30d81fabd2d5993f28447961bddf117a061486237d2a57a91aac34441e4af68a7cf8651c529b7e1d4bf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 53b6bea93d5e4e1a93c4dfe4a5706d8f
SHA1 80d6e91242f3e91f3b78497d7f56652547d0e4c3
SHA256 b9e60140cdbdab0acae26c9859ab141e729213682655c36ff522b8714760828a
SHA512 8999725cff43f3a31c2c3d2473c182d4ee3e491379cae30d81fabd2d5993f28447961bddf117a061486237d2a57a91aac34441e4af68a7cf8651c529b7e1d4bf

memory/912-105-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1960-107-0x0000000100000000-0x00000001001FB000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 224b1c38a76359c2fa803d076a53e46d
SHA1 a6a7665ae9ddcbbf5b0b71129d7e0e071b6a5c8b
SHA256 609e41aeafc844f8f837f3de903f06e5377d11fb87c2187538d87e2eac720527
SHA512 f8827f732594bfb347339c32a90b5a31159ca493558affd4375a3240faa82fa125d48f09ff349ec969b5a9de6c950d78e53ac578ef6247242a81781fa471fec7

memory/1400-109-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/912-114-0x0000000140000000-0x00000001401F4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 20:08

Reported

2023-05-01 20:12

Platform

win10v2004-20230220-en

Max time kernel

153s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

Signatures

BluStealer

stealer blustealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b3c9ec0fc94b1c77.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4732 set thread context of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1040 set thread context of 2376 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 4732 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Users\Admin\AppData\Local\Temp\PO_39100.exe
PID 1040 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1040 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1040 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1040 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1040 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\PO_39100.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 888 wrote to memory of 1928 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 888 wrote to memory of 1928 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 888 wrote to memory of 5028 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 888 wrote to memory of 5028 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Users\Admin\AppData\Local\Temp\PO_39100.exe

"C:\Users\Admin\AppData\Local\Temp\PO_39100.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.232.18.117.in-addr.arpa udp
US 20.44.10.123:443 tcp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 141.145.190.20.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 117.18.232.240:80 tcp
US 8.8.8.8:53 240.232.229.192.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/4732-133-0x0000000000350000-0x00000000004D8000-memory.dmp

memory/4732-134-0x00000000053D0000-0x0000000005974000-memory.dmp

memory/4732-135-0x0000000004EC0000-0x0000000004F52000-memory.dmp

memory/4732-136-0x0000000005100000-0x0000000005110000-memory.dmp

memory/4732-137-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

memory/4732-138-0x0000000005100000-0x0000000005110000-memory.dmp

memory/4732-139-0x00000000071E0000-0x000000000727C000-memory.dmp

memory/1040-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1040-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1040-144-0x00000000030E0000-0x0000000003146000-memory.dmp

memory/1040-146-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1040-150-0x00000000030E0000-0x0000000003146000-memory.dmp

C:\Windows\System32\alg.exe

MD5 659fec0891adb348d6b244fa969c342b
SHA1 294faf494639d2b66c57980899e04310f77a7fae
SHA256 a3cf741e1fe0d26c1187b4ab7d3a544fd0c014476dac812779029718b0a6b2ff
SHA512 b6ba8c53e41082bec0a976a50c060c5c88ec8f0bdcc9a093d565613006cd66f0111566bf7f220c91acbb381d0e05fcac1c3764c173f93ce85ce8a20d57366ad1

memory/4268-157-0x0000000000560000-0x00000000005C0000-memory.dmp

memory/4268-162-0x0000000140000000-0x0000000140201000-memory.dmp

memory/4268-164-0x0000000000560000-0x00000000005C0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 bbe46f8b78fa3fe7148490f6df265ece
SHA1 58d2d96f284f886f45775b425b3f6a4a8891f196
SHA256 9bc7c818695a74844a545fcd69dfa9d0e62e99b0088484c7f6ec3e483ae06e61
SHA512 88f1d5f11e46658298cb1a72ff5fb4ef02b0c8b20cd79b393e16481f2b420745dacb3ba57c9dff2e6f8c2a66f38e01c7f7e371964873034d7c65fc06271d24d0

memory/2548-170-0x0000000000660000-0x00000000006C0000-memory.dmp

memory/2548-176-0x0000000000660000-0x00000000006C0000-memory.dmp

memory/2376-179-0x0000000000900000-0x0000000000966000-memory.dmp

memory/1040-183-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 02da41c04372d042ab400c82b5603bc1
SHA1 889d63bfdb73a3f988e37833b9e6fecc34c1ff9e
SHA256 2a47e42b700964acb1b82cca0358486c1b88815560e92ef8bb69c3c63ceed2a6
SHA512 757453920f459dd0f632e91a1451423c703a04f2a185865a17e33c0ea47907a4019d42aa34a630645f90cc9531405950883b2ceaa64547d01c693ce8d50958f0

memory/2548-185-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4344-186-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4344-192-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4344-194-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2376-195-0x0000000004E90000-0x0000000004EA0000-memory.dmp

memory/4344-196-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4344-198-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 3d963e3729ced151be523321cc4101af
SHA1 32a5f5681787d6ec211b18ad245a782b37cf581c
SHA256 6f10e31bfcb1eb901765e96526edb3815189c9a29db4449e86c2112dedb6f0fb
SHA512 fde5e0bf145c236096a4ce9abc8dc1269bdf6d57ac09207d6559e02e3f7ffcf112ad613bc0675108dd20c3b670579398e5a319ff2a078b1245172f15453e1c2e

memory/2320-201-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/2320-208-0x00000000007C0000-0x0000000000820000-memory.dmp

memory/2320-211-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 9f9a849256ecc2f43865a1302eb824da
SHA1 feefc7db7593c226857219096ec986ce20492323
SHA256 6eeee7d2a01487916ec82ebcb4654e607856804c895cb4acff29a928677ddace
SHA512 c1072e997b43e5c4090f1bbbd6776a463e5e92c6723608c83b6de94c83160af9eeeaa5efa9362a9c01eae1f8868a06e1588511563872171f5ebf270bc8f76542

memory/4196-213-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4196-219-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4196-222-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a3db1c7498750cb2f3ff38bac8393ef5
SHA1 4e122ffc8474599807065d5f7a7009863d3f1aa1
SHA256 e6210d77b3e0a5410a30600b4c0cd748aac28e61fc968168babbeb0b7b390ce3
SHA512 f8a77db6c65eb99f95a08720345ca0d6ec676a4af13fbfb42e687e61483c044a305b931ac81a90d0f2003ffd5f47fdb6b0ec58054cfb3e4c0a8f2d6dd44e8c7c

memory/500-224-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/500-230-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/500-233-0x0000000002270000-0x00000000022D0000-memory.dmp

memory/500-235-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 af1b3255e90a778edab70a3b046db0a4
SHA1 d71bc9926d06643f6466b7be647fe4d0277e8296
SHA256 4c909e372d270f3107a5ad2527ba90dd554c02880b1d56fa59fd56211c0d7813
SHA512 810d67f8df2bcc8771510580029248728391ab5d5d74a96ad8505945aa02eebc58d3d413f3867695834e90107b97995e1a95b2522f6e9202f7cb561e0ab153b3

memory/4236-238-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4236-239-0x0000000000D40000-0x0000000000DA0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 43384ed646a27d0e71c20c831e6cf33a
SHA1 029acc612c2c69b37bab1c14cc5759342cc30522
SHA256 338434951faab787a4e4220a0f88be0e85e3d9cf112fbe18ee3407cd6962c262
SHA512 586908677d5cd28a397f30f139be9a96b0fee18b9b6167088af0f495e2d0b6b1af00a1e3309741bbaff5984e54869202a55e7b120e62358bb72f4c40147590df

memory/4268-259-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2604-260-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 bf9f0c13d09825c1977b0c92a48870b6
SHA1 19e8446189cf21627ed1d947f205667fdbc342d4
SHA256 e7cda41b22a1f124c6f594ac7ba900978d4055d64fde44d678146ac0a3501ccd
SHA512 9aa93f452c7cd39726299d2e90c311dad4f3e0a10f6cf00727477f9c3929c703153bcabd6d1c1940a0265994f0ddb8e0c4c6aeda3196caac6812d9435fbc6e25

memory/2180-269-0x0000000140000000-0x0000000140202000-memory.dmp

memory/2320-276-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4196-277-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4236-278-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 85b4b90e6f675c54de529192f48cda49
SHA1 671e91da9cc00dfd19e02ca7269327f1c9dc3f49
SHA256 ca24eaa7f160172d0b31f70a77c127c78eb0eec2c115a053c41ca9ea29da8b2b
SHA512 d47f64d1fb394e625cda4af677139b5fbfe6d970877e2bccb6af5989381b765b5152be97e821f77f635a253fa86936addb0b742dccde29c79aee18dae96e4c8b

memory/5096-286-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 317f1ce1ddc6bcdd4a59aae5da3975f1
SHA1 601b5256cacabfb33db5ad1b8fe3dfe27ee2b880
SHA256 122d327c347a83f7d51839a3f1f053d65302265d7fd85d25614fdacdf5a4676b
SHA512 2373d73f586051d8ca00c83214efa65adcbc159c364cc73e0935d30e30f9b6a77e1d78793014c090e2ed49b82258ca2b9b0b35e0f4e416df9ceb146ac55672e6

C:\Windows\System32\SensorDataService.exe

MD5 23cdca343ae80b91e66a75b4a734c4e4
SHA1 e6d0ef0ba4a52ce1f36ab53313a99b64a066c4fc
SHA256 5470917e7c70b0840bfc28e23e0bf8de3726e1e4cb7f68304f1f93a19c3e2353
SHA512 497c1a8f3a211844206c6f40bec39c4ec1a902bc5813518ebbb66a6e1c264b58e4ad3fba85af99d620166fcfb9e9e83b4ca4ac4761293c086d5dee1ed29800ab

memory/4448-303-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/4996-304-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 1a4aafd49d5a2c0b9e2e71558ee18667
SHA1 819fd1c37a2087e26e9a5e199cbf14441960c073
SHA256 174d75bc3c3ad9bc0448d456221ebb8d1d5534f9522d7ef27363f4725a0ef414
SHA512 7d2836d9d15ce9ecbbd125236ce3620283d165e1bfaa22f4e8eb8099bc5e873422724e4219278caa28cfa3bef797d8841320e8190e54093624bd6651a53fe5f7

memory/4060-323-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 4f18cbc652948bb7ad7f886d5fd84575
SHA1 e218c314c4dfe308310a01f36ad7266990e6ceed
SHA256 b6ab6dc4cab522411f4e65b695d3f3d37a01d8a03cdf1e99eeaa24d15a9726ca
SHA512 cb64dd4c15cec87fa4ec2307e92044888642b7f7316216a82483e06bc69810da01a9e4284e5511370b30d3fea75e7afe54eaffdbcfa487024c5caaec808b3dbd

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 6626bccd1b54003374394c3d211e4f06
SHA1 eace0d4b81f90ca9debcbf30c3100e703d588777
SHA256 1e7af66a907c183b056d7497bde7c3032afa72b7898e50f9b93a8b2b8cc56ba4
SHA512 512f2b773b393ad9978216dd566c0d535aba8fdebee5005b9eb721d95b956f251a72caf5a7e504b2aaaf082b17a81af83d187e48fef4da5b60be43f2277eae38

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 6626bccd1b54003374394c3d211e4f06
SHA1 eace0d4b81f90ca9debcbf30c3100e703d588777
SHA256 1e7af66a907c183b056d7497bde7c3032afa72b7898e50f9b93a8b2b8cc56ba4
SHA512 512f2b773b393ad9978216dd566c0d535aba8fdebee5005b9eb721d95b956f251a72caf5a7e504b2aaaf082b17a81af83d187e48fef4da5b60be43f2277eae38

memory/3256-340-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3756-343-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 fcdd1e90a20effbc47fdf58904aa0012
SHA1 64f1abc17aad168d2a505c0652d5396868997343
SHA256 60b4533362a608153f409a5e81473f67e6e7a5990cc992906f4d367e7f9568ab
SHA512 58d4fc27e4634a7a04af87306a6e177fa054ef9f54d8d278aa73c697c3e592283fdc360bdbbb40716d8932b1bf1eee3cfa72881b9f552aff7e0ab7272771662a

C:\Windows\System32\AgentService.exe

MD5 5a2e14055353001645ab1abc014c6eda
SHA1 2c43d1320daac7cb3c4142ec71360bee729377d0
SHA256 e697c6c591097c54bee14bc63421cca250728aa4e5abdf01257d0ee7063dc3de
SHA512 d8284d72ebb4b9d8c2d7688152daf56f1524403ac1c7a44060a581b153a8a7d5c56e255eff2879321a427d2665f14c86bbe11a4b37432e27e00883233140ba4a

memory/4852-362-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4016-365-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4016-371-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 ea3f78b3c51641842bd97d7edb7ff360
SHA1 710b339e830df68500ed1e86eca49332a08e1272
SHA256 82d97a704fff7545f37a14cd95308c1ba0aea1840d84bcca403efd6f2baa2071
SHA512 9ec432877e63f38bad20402a0d85b02585a41782a5a953c177f0bbd31c86feebd358fbf6960523b0271cbbe7c51f1e67fe31aaffd66de879bfb039e9ea171b46

memory/2688-382-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 d7e09aab3bd0bfa83cb78ff63ba7a361
SHA1 bf22b229565039bbcc8ba91e963b9302274b689e
SHA256 b2c0e3bfa8c1904bb1277e6e829f95dd0a5ac0afe4b48a75c8cc0d835a8355a4
SHA512 3cbe6fc8427802ba92aff875c3cfe01860748642ff557d38a2cdb1e61e7507681d2545cfc3bf3e1232ff770b3d931ba47b5182e77e7fde56f600e23bb8917e5e

memory/2624-388-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 e13abb26b658a5c18743a5af287b91ca
SHA1 eedc320f4d7a2c5046874add2370ea639163cee0
SHA256 116bb63008161d6786cb1e293297dd91f9bfff0fbfb1d68005d0c0186818efa0
SHA512 6483fca1b91a325101b81d1bc48407bf17874a28dc17977828686149cc7b57f3430ae5fc13ba9de1da78bc97ec95cd6138ffca0e410449b9a5793244a2b99c7f

memory/4240-395-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 4967755ec14d204a4b041e54aef355d9
SHA1 f1f04965585e6e961d26c0ec03dbcab7ca6839c9
SHA256 7d58d1b50e2af692284297713f83d072c812643e4bd162dd0eff0d8ab84387f3
SHA512 705ee07f11fb811d337ba055759a577d6150ac27d4fa042786243543297ab55f2ef52a97e7fb0b3269dcf79102efa76bb143d85a9107bfe67f239ee8f6f34c4e

memory/428-414-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 fd0c43c517009f144c7293319e215ccd
SHA1 580cb8f3fa9b0c8bd40d5361502560e8392f0126
SHA256 5834fd204c1432cc9b278ac9c237d3b7411176aed7529272d69a203d7321f940
SHA512 ed998e817ef1b0dc3efcfb332266c31c159da0481562fba6ec839e3481efba5f9e3d6ea1f862e6354d2b5028115799562b6bfbbd5788523b16fd8b6c0f941211

memory/888-418-0x0000000140000000-0x0000000140179000-memory.dmp

memory/5096-454-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/4996-463-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3256-480-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3756-481-0x0000000140000000-0x0000000140259000-memory.dmp

memory/2688-499-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2624-500-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4240-502-0x0000000140000000-0x0000000140216000-memory.dmp

memory/428-524-0x0000000140000000-0x000000014021D000-memory.dmp