Malware Analysis Report

2025-01-03 07:38

Sample ID 230501-yz12asge64
Target TT_copy.exe.bin
SHA256 f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2
Tags
blustealer collection stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f266e9833cf991a972db594ad7afad2332dfccdd2b7454e49455b759f406bcd2

Threat Level: Known bad

The file TT_copy.exe.bin was found to be: Known bad.

Malicious Activity Summary

blustealer collection stealer spyware

BluStealer

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Script User-Agent

Uses Volume Shadow Copy WMI provider

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

outlook_office_path

Checks processor information in registry

Uses Volume Shadow Copy service COM API

outlook_win_path

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 20:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 20:14

Reported

2023-05-01 20:18

Platform

win7-20230220-en

Max time kernel

153s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

Signatures

BluStealer

stealer blustealer

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\83af8a8a7693df14.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1672 set thread context of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 296 set thread context of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{31F2EDA3-5D76-4E0A-80A4-3082DD5C174A}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{31F2EDA3-5D76-4E0A-80A4-3082DD5C174A}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1672 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 296 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1244 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1732 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 364 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 364 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 364 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 364 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2204 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2600 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2784 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2896 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 108 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1244 wrote to memory of 2304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 250 -NGENProcess 258 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 260 -NGENProcess 240 -Pipe 25c -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1e0 -NGENProcess 244 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 248 -NGENProcess 264 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 260 -NGENProcess 270 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1ac -NGENProcess 240 -Pipe 264 -Comment "NGen Worker Process"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 244 -NGENProcess 23c -Pipe 180 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 260 -NGENProcess 274 -Pipe 1ac -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 260 -NGENProcess 250 -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 258 -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1f0 -NGENProcess 250 -Pipe 26c -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 280 -NGENProcess 248 -Pipe 274 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1672-54-0x0000000000E90000-0x000000000103C000-memory.dmp

memory/1672-55-0x00000000007B0000-0x00000000007C2000-memory.dmp

memory/1672-56-0x00000000044F0000-0x0000000004530000-memory.dmp

memory/1672-57-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

memory/1672-58-0x0000000005D10000-0x0000000005E48000-memory.dmp

memory/1672-59-0x0000000005E50000-0x0000000006000000-memory.dmp

memory/296-60-0x0000000000400000-0x0000000000654000-memory.dmp

memory/296-61-0x0000000000400000-0x0000000000654000-memory.dmp

memory/296-62-0x0000000000400000-0x0000000000654000-memory.dmp

memory/296-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/296-65-0x0000000000400000-0x0000000000654000-memory.dmp

memory/296-67-0x0000000000400000-0x0000000000654000-memory.dmp

memory/296-68-0x0000000000360000-0x00000000003C6000-memory.dmp

memory/296-73-0x0000000000360000-0x00000000003C6000-memory.dmp

\Windows\System32\alg.exe

MD5 3dd9c90146fed231d29ca9d1dabf4efb
SHA1 e0ffd43cc11b5686e31bff8ed2fbd0b09532d88e
SHA256 4a41da6ff397453dd878c2a24af8e5d070e855b16be3a7a01f09c8bb8d5634a4
SHA512 af625c463c92a070fefdcec05cfd75a08ea8584e4f4afab0657a0cc9f122fc68e179368c4ab76504ad4ee442434237ca0dcdc16736dd96f752c66cb88f353102

C:\Windows\System32\alg.exe

MD5 3dd9c90146fed231d29ca9d1dabf4efb
SHA1 e0ffd43cc11b5686e31bff8ed2fbd0b09532d88e
SHA256 4a41da6ff397453dd878c2a24af8e5d070e855b16be3a7a01f09c8bb8d5634a4
SHA512 af625c463c92a070fefdcec05cfd75a08ea8584e4f4afab0657a0cc9f122fc68e179368c4ab76504ad4ee442434237ca0dcdc16736dd96f752c66cb88f353102

memory/1904-81-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/1904-87-0x0000000000870000-0x00000000008D0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 2f56b463909056836fe3f9ee41af7b28
SHA1 aa37ed4b0873370eb5230323f81b1e3293ec549a
SHA256 5faf80352a06a7cfb7b3234a5e278dc436e6ce68b0ea14ec1e02a93c3496019d
SHA512 f4eee5136b4cdeb1d8df04ecf6c690048f84c4dc3a391f9b49bfcf236f15975bd38bc5e20fbf286cd7cc5f8b968ff32641c84d9f3fc235113271e12317640273

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 2f56b463909056836fe3f9ee41af7b28
SHA1 aa37ed4b0873370eb5230323f81b1e3293ec549a
SHA256 5faf80352a06a7cfb7b3234a5e278dc436e6ce68b0ea14ec1e02a93c3496019d
SHA512 f4eee5136b4cdeb1d8df04ecf6c690048f84c4dc3a391f9b49bfcf236f15975bd38bc5e20fbf286cd7cc5f8b968ff32641c84d9f3fc235113271e12317640273

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 8fe03a2c237486eca6b51ac86a3debd3
SHA1 d02b784a63a6fb7b9a3189f0fb33e85bc2a74a67
SHA256 da678472cee138643082b7172528aade1d386bb201bb030c10672ca6e813dd3c
SHA512 aabf2aab2a6dad95affa528b18a5be06f71effc23441faceee0d4add8f9813f7cd84d12767683e6d606f92e8555a2ae8cd4c267b04b164f1452fc0f48d83f52c

memory/296-95-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1904-96-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/1584-98-0x0000000140000000-0x00000001401F4000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 45bc1156d4274fce161a0a6a156d6c22
SHA1 d6d973741b25f20956af73e773f175d73e3fd171
SHA256 9069a0ccebb2f6dc69dd0274b5955edb9dbd7a4680edc0b7c5540fee74464405
SHA512 3a57ad6e5e6cc15f121c70a54ba8397c83bdc1ea945eaa32dc23f1aa4c6681e18f7c1e837833957f73c4c63083b8468beb7e9d65675c8effa6d94ae5457d0681

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 45bc1156d4274fce161a0a6a156d6c22
SHA1 d6d973741b25f20956af73e773f175d73e3fd171
SHA256 9069a0ccebb2f6dc69dd0274b5955edb9dbd7a4680edc0b7c5540fee74464405
SHA512 3a57ad6e5e6cc15f121c70a54ba8397c83bdc1ea945eaa32dc23f1aa4c6681e18f7c1e837833957f73c4c63083b8468beb7e9d65675c8effa6d94ae5457d0681

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 8fe03a2c237486eca6b51ac86a3debd3
SHA1 d02b784a63a6fb7b9a3189f0fb33e85bc2a74a67
SHA256 da678472cee138643082b7172528aade1d386bb201bb030c10672ca6e813dd3c
SHA512 aabf2aab2a6dad95affa528b18a5be06f71effc23441faceee0d4add8f9813f7cd84d12767683e6d606f92e8555a2ae8cd4c267b04b164f1452fc0f48d83f52c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 45bc1156d4274fce161a0a6a156d6c22
SHA1 d6d973741b25f20956af73e773f175d73e3fd171
SHA256 9069a0ccebb2f6dc69dd0274b5955edb9dbd7a4680edc0b7c5540fee74464405
SHA512 3a57ad6e5e6cc15f121c70a54ba8397c83bdc1ea945eaa32dc23f1aa4c6681e18f7c1e837833957f73c4c63083b8468beb7e9d65675c8effa6d94ae5457d0681

memory/1948-112-0x00000000000D0000-0x0000000000136000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 abac1c35c3e80b83822654ae05901165
SHA1 13ee184dc368e55ecb7a0ed92c60a4eb55e0edf4
SHA256 45f53760a484d4147dcb36ea8b67048580721315bddfe8621286397434394b08
SHA512 3604f58dc0ddc6fb0644219dbfc502f0263c80744620e0ec65b0495416a6d2ee3e13274be446dd8044e5cd4e7cca915bc07d342540342f38cc9009e75407cf91

memory/1948-114-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1948-115-0x00000000000D0000-0x0000000000136000-memory.dmp

memory/1948-117-0x00000000000D0000-0x0000000000136000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 3fe51f8206d45b73aeb44bf907418919
SHA1 613eab2f6f1a8a5ebbd7a2faeee5f29aafde9d35
SHA256 42e26a3d337888bca949fb106202d33b5090766126910a0aad087242c1be598a
SHA512 e4bd0dda9f925a9e71f300362a62b855262579a0cbf1cb1d306a512dea395f97adceba28469bce38c0c044f8c8b8162d3babb25c91d6a609a645cb4fb65d7e4a

memory/1948-120-0x00000000000D0000-0x0000000000136000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/1244-122-0x00000000007E0000-0x0000000000846000-memory.dmp

memory/1948-127-0x00000000023D0000-0x000000000248C000-memory.dmp

memory/1244-128-0x00000000007E0000-0x0000000000846000-memory.dmp

memory/1796-131-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1592-132-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1244-134-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1948-137-0x0000000004D50000-0x0000000004D90000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 aac2b4aac38d031a8de1ffaf5f42a147
SHA1 2a07a2b6f1e99120cb24242b1027ef25a1bb61e2
SHA256 48b4e9ea22911b50686fef09256da576ed79150bbd8de17e0d4e2f928883f385
SHA512 67b331618194d6eaad90e4c96d836b8b185d9f9e1675a7ef280e6fd34e0f6b09deeee7c31a466603ae0cc49a8373364258de7ecf367b77a37cd910cf7df11165

memory/820-139-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/296-145-0x0000000000400000-0x0000000000654000-memory.dmp

\Windows\System32\dllhost.exe

MD5 a3ad0db3dc6845645e4d4352d0fc655b
SHA1 7c2a2344b08b55974156638b6cb5c82463d08955
SHA256 41b3da9bdfa820935daf8139bb291d302bb354d0a4a12d169ab9a9310a8ff4db
SHA512 36641a441b8b13aa43fcda1b6ff88a0c912eec293902779304a00e6e92b2f9fe404eb7a81540628a3be47c698fccfd1e2b472bc49311851b075d54454afccef9

C:\Windows\System32\dllhost.exe

MD5 a3ad0db3dc6845645e4d4352d0fc655b
SHA1 7c2a2344b08b55974156638b6cb5c82463d08955
SHA256 41b3da9bdfa820935daf8139bb291d302bb354d0a4a12d169ab9a9310a8ff4db
SHA512 36641a441b8b13aa43fcda1b6ff88a0c912eec293902779304a00e6e92b2f9fe404eb7a81540628a3be47c698fccfd1e2b472bc49311851b075d54454afccef9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 aac2b4aac38d031a8de1ffaf5f42a147
SHA1 2a07a2b6f1e99120cb24242b1027ef25a1bb61e2
SHA256 48b4e9ea22911b50686fef09256da576ed79150bbd8de17e0d4e2f928883f385
SHA512 67b331618194d6eaad90e4c96d836b8b185d9f9e1675a7ef280e6fd34e0f6b09deeee7c31a466603ae0cc49a8373364258de7ecf367b77a37cd910cf7df11165

memory/1744-152-0x0000000100000000-0x00000001001EC000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 b46fc4c4f0715325f6e534c627d2c537
SHA1 c1d252a055391878e87a0305fa9bc0d5b6adf7d0
SHA256 218f3d455de18dc8de8718cb637d914bf70e2db240702678458c6d465d8d4064
SHA512 dd9bb926d484aa14f4e485c6e02f45168d745669488182d95df219b2f118da8d9e380826ab51ab30bd1369bc036a18f682c855d702fa3c4b9675f048b5236a9d

C:\Windows\ehome\ehrecvr.exe

MD5 b46fc4c4f0715325f6e534c627d2c537
SHA1 c1d252a055391878e87a0305fa9bc0d5b6adf7d0
SHA256 218f3d455de18dc8de8718cb637d914bf70e2db240702678458c6d465d8d4064
SHA512 dd9bb926d484aa14f4e485c6e02f45168d745669488182d95df219b2f118da8d9e380826ab51ab30bd1369bc036a18f682c855d702fa3c4b9675f048b5236a9d

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/1732-156-0x0000000000730000-0x0000000000796000-memory.dmp

memory/1288-158-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1288-167-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1732-168-0x0000000000730000-0x0000000000796000-memory.dmp

memory/1288-172-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1732-173-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/364-176-0x0000000000240000-0x00000000002A6000-memory.dmp

memory/364-182-0x0000000000240000-0x00000000002A6000-memory.dmp

memory/1732-184-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 17222838641648803267e9814947a95a
SHA1 ac83562be67e570d1f817cdca523fb224d54e84b
SHA256 02acb753ee49213bcb5a85763b73890be2cd642bcb2bd0e597ebebc90babb57d
SHA512 9ad1c01245c337b31b784ac03073e5a4431db78ba89a7bf52613947da5d56053bcd079fdf3b2c5d04136b971bd6f30ef24afec30415947f850eed89e0201b15d

C:\Windows\ehome\ehsched.exe

MD5 17222838641648803267e9814947a95a
SHA1 ac83562be67e570d1f817cdca523fb224d54e84b
SHA256 02acb753ee49213bcb5a85763b73890be2cd642bcb2bd0e597ebebc90babb57d
SHA512 9ad1c01245c337b31b784ac03073e5a4431db78ba89a7bf52613947da5d56053bcd079fdf3b2c5d04136b971bd6f30ef24afec30415947f850eed89e0201b15d

memory/1620-187-0x00000000001B0000-0x0000000000210000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/1620-201-0x0000000140000000-0x0000000140209000-memory.dmp

memory/364-203-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1940-205-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d737c1d1797fe4f73c1ac778a1bced07
SHA1 3dbe94e8d84a8279c6bec37f0694f34beb80fe9c
SHA256 094fd13ecc710e2e281886d9f7c114f2f64b1822f802cee53a12881b6853cc91
SHA512 1de7bc2173c5e04f5f5228296880bb481d04e9f082f29154bf41bd51bed9eb2656653453bde5e7d6a37bb4aed553410ca9fdd2377979f7c870cee0e6048b3db6

memory/1288-221-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1132-222-0x0000000140000000-0x0000000140237000-memory.dmp

memory/468-223-0x0000000000D80000-0x0000000000E00000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 c326c8e6f34183e4b2342608b61600eb
SHA1 7e33f7b887d2941ff4a9813b47be29919e98c410
SHA256 d9019c65d14ee6503abb81b7aa35ba5cd08d91958fd51d3937094778e19a28c7
SHA512 4b9be8b6b5298f3d3a1790cf19ea12c709498950823a23c3278e2e233771fc1c1e771ef72a20f0156628c1289fa5ede535c4a5688bf786edfc34815de11e9b11

C:\Windows\System32\ieetwcollector.exe

MD5 c326c8e6f34183e4b2342608b61600eb
SHA1 7e33f7b887d2941ff4a9813b47be29919e98c410
SHA256 d9019c65d14ee6503abb81b7aa35ba5cd08d91958fd51d3937094778e19a28c7
SHA512 4b9be8b6b5298f3d3a1790cf19ea12c709498950823a23c3278e2e233771fc1c1e771ef72a20f0156628c1289fa5ede535c4a5688bf786edfc34815de11e9b11

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/1940-245-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2108-256-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2204-257-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/964-258-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1288-260-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1620-261-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1132-262-0x0000000140000000-0x0000000140237000-memory.dmp

memory/468-263-0x0000000000D80000-0x0000000000E00000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 eca068f13299139c1323b794edab8d33
SHA1 5b854fdd81ecf65340240e82143ef7389753e8fc
SHA256 0ac6f52abdfec924c03d2968cb2b6af6f9f29b41cd2f25e30ca3e96a4f6484c4
SHA512 999e6cdec080e04a35daf3e6ee9a64811d24c0d7f47a4e1713e0146704f65798d7b885163c88cc2163f6420ec96893adf3e643aa1902e1b98732b44d763af2f1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2204-268-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2328-277-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2356-278-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/468-287-0x0000000000D80000-0x0000000000E00000-memory.dmp

memory/2328-288-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2356-299-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 16c4b9c7239c6768400a7e9e35ac37e2
SHA1 a25b84f488326480793053a8f981705c50008b43
SHA256 03f53cb2a8666f99042464e0100ec53645239d5728f6bd59d73efde810a8c428
SHA512 94621779834a0837f2b4384d23a063991d2760fe3a0caf65def34b0300eb936474013da254f5a47e8d72e7f9b00670dba14671cd7d74edd1f60aae685ec61576

memory/964-312-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2600-323-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2784-324-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2696-325-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2784-335-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msdtc.exe

MD5 4f0e07bb600ff849917bbf82c571c1dc
SHA1 621b4c143724fbfcd35b638d84b9f9d22d2ad47c
SHA256 5579ec365e7d39351bed2a5d06f15fe17c60098bf6b0e6aef6db0de7df0589de
SHA512 65b8c016cfe7d08c2d329105e43493896b1e2031c27955db87ee9d5b61fed706ff59f9fae6220bf5ee003b4889320df03125ae39a3b57c0704de11a73721d217

C:\Windows\System32\msdtc.exe

MD5 4f0e07bb600ff849917bbf82c571c1dc
SHA1 621b4c143724fbfcd35b638d84b9f9d22d2ad47c
SHA256 5579ec365e7d39351bed2a5d06f15fe17c60098bf6b0e6aef6db0de7df0589de
SHA512 65b8c016cfe7d08c2d329105e43493896b1e2031c27955db87ee9d5b61fed706ff59f9fae6220bf5ee003b4889320df03125ae39a3b57c0704de11a73721d217

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2896-350-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2696-361-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2960-363-0x0000000140000000-0x000000014020D000-memory.dmp

memory/468-364-0x0000000000D80000-0x0000000000E00000-memory.dmp

memory/3004-365-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/3004-376-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msiexec.exe

MD5 20e38f885b712c3fc8f798125e7fbff4
SHA1 00e97811560b1bb224772809a3e8b325e19e0de5
SHA256 e4d36c088a823a150711b23bc6dfc53ace6cac9d82f28ef55a800b73467655f8
SHA512 875a17411d67c79f3c0e1b0d84a560c303b7ba87f57c41284e89c0af42971a13cf92dfdc5a331b5735b5881487baacc0099ca5043e5e022cf096027c65849859

C:\Windows\System32\msiexec.exe

MD5 20e38f885b712c3fc8f798125e7fbff4
SHA1 00e97811560b1bb224772809a3e8b325e19e0de5
SHA256 e4d36c088a823a150711b23bc6dfc53ace6cac9d82f28ef55a800b73467655f8
SHA512 875a17411d67c79f3c0e1b0d84a560c303b7ba87f57c41284e89c0af42971a13cf92dfdc5a331b5735b5881487baacc0099ca5043e5e022cf096027c65849859

C:\Windows\system32\msiexec.exe

MD5 20e38f885b712c3fc8f798125e7fbff4
SHA1 00e97811560b1bb224772809a3e8b325e19e0de5
SHA256 e4d36c088a823a150711b23bc6dfc53ace6cac9d82f28ef55a800b73467655f8
SHA512 875a17411d67c79f3c0e1b0d84a560c303b7ba87f57c41284e89c0af42971a13cf92dfdc5a331b5735b5881487baacc0099ca5043e5e022cf096027c65849859

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/108-390-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2184-391-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2304-392-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msiexec.exe

MD5 20e38f885b712c3fc8f798125e7fbff4
SHA1 00e97811560b1bb224772809a3e8b325e19e0de5
SHA256 e4d36c088a823a150711b23bc6dfc53ace6cac9d82f28ef55a800b73467655f8
SHA512 875a17411d67c79f3c0e1b0d84a560c303b7ba87f57c41284e89c0af42971a13cf92dfdc5a331b5735b5881487baacc0099ca5043e5e022cf096027c65849859

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 4ed94ec5e9e4569ba3f5b262c61afba2
SHA1 1271bfcad845be634f8fd886b206acdbe4f28ffd
SHA256 ab64a0af004fbe683862ff5cf531cfff5183d625f48c233d94a8b8c09a9c5607
SHA512 023d1c6e3cc68fc86a20b18ca7f2252893d996640a215b39ea553b91aebc5c63a4f03e6686ceb3854dd48585ed56ad8c908ee38610a1641c0a1fc927090cc7db

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 4ee015632eb72b3abd675c581a684ec1
SHA1 3c654be09e20dca1aa336b75ce06e5c45deb2e2f
SHA256 8c6a8c1c87445554e3e72e331bee496342745aed9db8295ed30ff08ea303c037
SHA512 1338b5592c0b25e408fa42b267ca94cae9c4c590d76d56052927f49974fc5fcd2d231116c6e5d661986802c320fd3ab5c8a27eefb93e4a84c50954966202239e

memory/2304-411-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2184-413-0x0000000000550000-0x0000000000759000-memory.dmp

memory/1228-420-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2616-421-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/468-422-0x0000000000D80000-0x0000000000E00000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 20:14

Reported

2023-05-01 20:17

Platform

win10v2004-20230220-en

Max time kernel

160s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

Signatures

BluStealer

stealer blustealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e9c866adc0346ca3.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 984 set thread context of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1892 set thread context of 4676 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c03a81fc697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dd710f7697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6a38bfb697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad02dfd3697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf9b45fc697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005379fdf9697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a99c26fc697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd2930fc697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c01ccfb697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcdbc4fb697cd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 984 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Users\Admin\AppData\Local\Temp\TT_copy.exe
PID 1892 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1892 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1892 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1892 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1892 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\TT_copy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3932 wrote to memory of 2812 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3932 wrote to memory of 2812 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3932 wrote to memory of 4432 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3932 wrote to memory of 4432 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Users\Admin\AppData\Local\Temp\TT_copy.exe

"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 73.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 50.4.107.13.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 cvgrf.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 przvgke.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 36.249.124.192.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 131.253.33.203:80 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 vcddkls.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 fwiwk.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 107.6.74.76:80 jpskm.biz tcp
US 8.8.8.8:53 udp
US 165.160.13.20:80 tcp
US 8.8.8.8:53 udp
N/A 169.50.13.61:80 tcp
US 8.8.8.8:53 udp

Files

memory/984-133-0x0000000000A60000-0x0000000000C0C000-memory.dmp

memory/984-134-0x0000000005BA0000-0x0000000006144000-memory.dmp

memory/984-135-0x00000000055F0000-0x0000000005682000-memory.dmp

memory/984-136-0x0000000006170000-0x000000000617A000-memory.dmp

memory/984-137-0x0000000005810000-0x0000000005820000-memory.dmp

memory/984-138-0x0000000005810000-0x0000000005820000-memory.dmp

memory/984-139-0x0000000007B30000-0x0000000007BCC000-memory.dmp

memory/1892-140-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1892-143-0x0000000000400000-0x0000000000654000-memory.dmp

memory/1892-144-0x0000000003010000-0x0000000003076000-memory.dmp

memory/1892-149-0x0000000003010000-0x0000000003076000-memory.dmp

memory/1892-154-0x0000000000400000-0x0000000000654000-memory.dmp

C:\Windows\System32\alg.exe

MD5 e2a5fd25ecaccc8ebce3da23a5e9f227
SHA1 0df3ad478723580b9bf93071be1e72d957ed7255
SHA256 5ce7be3d2f97b0cdeed4cf07886f7fbce077ac34d6d6cdf4e84375a19d69268a
SHA512 dc752d7ac7909ef6920d1e16500fae09cbd9f7a58e4e61a108e5559ea47dc0af6b8724dcc69d276828591f273f4a33ab2df7c235c45a32cca8a3b7b89f3300a7

memory/952-157-0x00000000004A0000-0x0000000000500000-memory.dmp

memory/952-163-0x00000000004A0000-0x0000000000500000-memory.dmp

memory/952-165-0x0000000140000000-0x0000000140201000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 2b6785b2a1481512f603643cef277ef8
SHA1 a390dcc98607745883ae4fb692350f1d3edfc3bc
SHA256 d60b00fcc99adcce5815eea36a268a875834e187c8bb978f09f28500666cdc8a
SHA512 90c0431007de2011fde94473fededee9a9fa2cf640b81a6f3de6dc4702e3dd96a483d8d88977b6158878a7c2be9aa7ed8b8e24aff24a5d23cc10769bbbecfbfb

memory/1512-170-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/1512-176-0x0000000000680000-0x00000000006E0000-memory.dmp

memory/1512-179-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 b8cff0cd570661ee67e77b780a1a782a
SHA1 41cd169ff406780ee43a4b172f0f22c42750d344
SHA256 a4b16abbfec0d077b0045d3c8bd6bd0af4dcb51fbe34afc8dad229d41ccc1a31
SHA512 c23cbe653a78d8f439905c75ed38632b067b78a146260d84700920cf08f2f1f6a000955b02e906d58f83e386357f32ae3dbfa4d9658f5270a0828e8611b11f39

memory/3268-181-0x0000000000E60000-0x0000000000EC0000-memory.dmp

memory/3268-187-0x0000000000E60000-0x0000000000EC0000-memory.dmp

memory/3268-190-0x0000000000E60000-0x0000000000EC0000-memory.dmp

memory/3268-192-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 bc3250227cac239bb0c3c4bf057cda08
SHA1 a0ed873877ca19b27f573fbc3f3a13ce5298769b
SHA256 32e0eb75c166de6e0b694b0517c668fd870e87a2183abd723148d195d2ff980e
SHA512 9e85393b065bcfe6de9c5aa96f7f083f35a654fe227a117f065ec2a644e80d8086940266dd187716dd4a8406757ab0ab694c2a680e86860d077dff697610ef1e

memory/1908-194-0x0000000000400000-0x0000000000460000-memory.dmp

memory/1908-200-0x0000000000400000-0x0000000000460000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 b953ef003ec22ea1cfd5ffde11e94afb
SHA1 962c5c3f630ee03e2277ad168ce9a3efad26f0e3
SHA256 5957648b05cbfe0c7f932e0c4d0ae7b37d8e8f7b7c085b1964309b0211e19c61
SHA512 0cb5612cfdb6c90cbeb4bdde041f043d148a179c182fc5f3250985c192ce03264cee7a03fd081109820ac073676d60d7be74cb86611e794b1bb2f4b01fac65f6

memory/4000-204-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/4000-210-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1908-212-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4000-213-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 6f78135fa79c8cfff401f443581c89fc
SHA1 59cd9a544114e047887e41fa2fe923099783116e
SHA256 22fd3e0bffe892f3f971d9f347205bfb846df33a02b7a8d3fab0db3354abf505
SHA512 9f7b974020a16a34855466d6ae51f96b941f1592bffb5dd70a01ca01954a287e34b9c324748e967ee7ab6c659bed3526d1764c0f878db87654b7affacfc7dec6

memory/5040-216-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/5040-222-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/5040-225-0x0000000001A60000-0x0000000001AC0000-memory.dmp

memory/5040-228-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 a6c39b696859397e7c9079c23e5afa80
SHA1 9bb8e811ca1eacaa80e7607a80d71b62bb0ae345
SHA256 1331657eec09765d589b52284fbfde5b741ec0acd6a294dad11df37529610fd2
SHA512 f8b0203a395b5833ec932b62f93815420eba68bf40e4e2dfee5fdf72a0492cc946572f4c77dbb0bf5b709c10051f9d78d309a49af70378036b946d080da8f2ee

memory/5116-230-0x0000000140000000-0x0000000140210000-memory.dmp

memory/5116-231-0x00000000007A0000-0x0000000000800000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 7feeb68b033fd768af17362878dfd4a9
SHA1 cad536b46748205de91d95770cf36008a2bdbb43
SHA256 a392eb2fd9452aaec70eb3a4ce1373e20e6054220300f9785a41bbe2877ee83d
SHA512 2d8b3a1446ee228295d44ca10f6893c1b9612d54094ba3f425f89b5296e7c0b8bb03ceb999e6e7f7fc2deeff0138e02ef73f775aaf946e003d067f19c3ac3e1b

memory/4932-245-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 90023a2842153cac0c83fd9cc5adce79
SHA1 a8d7fab7af6b13994075cff25670f2eb7a63dc15
SHA256 28fff1b1e892382626563c1be0f058f8d8a3b2c8f5d9e9efec6796d27dca258b
SHA512 2da72b0d7c33131a1a1389b2817936e2c610e9764bc46411fb7c094578a97b0c29749468feb2ff4543399e882e77e1f07c1cea86f71bfffe8fa6e2cd934890ca

memory/3436-264-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 82a08c66646f061143e0054c7737f1bb
SHA1 7d1fcfa11f993c34d0db91e01c3ef5e616dc46d3
SHA256 9cd9b4d5ddbbe46088251e41d3dadd5845670af9bf8e17d0de49e700089f4e0d
SHA512 5c79c5f82de60c14542e71b69dc434b532c2c67c27b135eb512acc96a0a3caee357907e40952fda0fc18600973f92dc759d9dcbc4ca17ea5282cc30371718d68

C:\Windows\System32\Locator.exe

MD5 d18f3dab16d5cbf282196e36ee9d6b1e
SHA1 8641e397584e9f431140c3c6a44877d7b8a3b28f
SHA256 55fafc86baa88ea746bf40255c3a25923e454ab808a82dfad6a5ae1b894f1cfd
SHA512 1f2e4bb74e4ba43a9a4181ee178faa9ebc6b9e75221b24bb5b6a48e7f67528a79f62265d03831c5f08e3f1c47cc737ff5b5c7721d05761040d7492bc6a81cd97

memory/1916-277-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/3856-280-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 4497dd1499e538b660d84a5faf172869
SHA1 5ddba3b4d2524c860c61103bd49e9e930044bf6f
SHA256 9c88b27fa853789f2778e3aebf753c33128bc74d911ba26ca45e3398b1eb6cfc
SHA512 b58f46dbe4f1ce8d21871ff38050c07b18337ab4aa0a1743d6e1b9f0747c7b271df3ae8ceb4e9fe0398c7e4bba4ed97279ef9cf242a314488ea4de8d182b4d19

memory/1892-296-0x0000000000400000-0x0000000000654000-memory.dmp

memory/4556-299-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 0dde5b450d5fb7afcf85b5d20e13d0f7
SHA1 cc4c057d0f859e14b1ae48551d215075a04e1a90
SHA256 b97df4197c62caad8de642cf46bb5f1ae66a8e75a60ddf0e2ae1681a09ff2330
SHA512 1bbeb480abe5bda0b964d6d645ccbfcecfe8dbf454e28fcc90ab4d469f66e0bb62912af3dcfd6badcbd499b28b196ef8281f09f01f84fe3eda904e7db0d611ec

C:\Windows\System32\Spectrum.exe

MD5 af8bfe6e3311859e7243ae2dee829809
SHA1 4f0223cbd4bf13cdefdf4480dc56daa19d274f3f
SHA256 805137ef510e9ad1319a40cde9977614432529e09f0135ba8b0f3fd87b820cef
SHA512 e9da07008e9710b4cd5d938185f57d9b93bc6895215cd6a65ae7be37f8cb05787c25a569a44bf863de2bf8315a7c5df8a2273e2c00dd2cfd38d75528ff59181a

memory/952-318-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2172-320-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1096-321-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 41c1f938cacddeec12610298aa7cc1e0
SHA1 3bb9190836d9421a3486763d3bde1a0d280598b5
SHA256 beab4594b3dce20da5124f5855bb8eaacd48da21c2a35c03fdc08887b99bf242
SHA512 1cfec62a68a3a87edf5388193dfde03acad39e8ec9aacd3fc9619c717b62f3fa957f9d4f7fbe52854aa6eaa071d8593c468f89d6275b3ae23515cea073af25d0

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 41c1f938cacddeec12610298aa7cc1e0
SHA1 3bb9190836d9421a3486763d3bde1a0d280598b5
SHA256 beab4594b3dce20da5124f5855bb8eaacd48da21c2a35c03fdc08887b99bf242
SHA512 1cfec62a68a3a87edf5388193dfde03acad39e8ec9aacd3fc9619c717b62f3fa957f9d4f7fbe52854aa6eaa071d8593c468f89d6275b3ae23515cea073af25d0

C:\Windows\System32\TieringEngineService.exe

MD5 85a0b99302e7b2259b832ca99f8d4a8f
SHA1 c69d8cb8b2ce5e4c65494a316a123ef1bdd13542
SHA256 daf172787031a5626a6274f3e6ff906bb36c27cc72b68808a3cb7a7626d2861c
SHA512 e2a65cf026d3b88fe801da8f2b77979abc08e7f76b8d4bc67ffb9cfd545f8d4b6deedfaddeb38a817f2f7ad92ea0da22dd25e4c4d72f1ae57df9374ae0bfef60

memory/3268-341-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3020-344-0x0000000140000000-0x0000000140259000-memory.dmp

memory/4388-345-0x0000000140000000-0x0000000140239000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 efeea8bbf9b7e1ccf7245cd60a4ecd64
SHA1 c58c627e80ad16f3411cc8498a9cb13a4174c08d
SHA256 e91d795853158b8a8962ee3f03d247ebac292ffc8cac02f96898aa01f946bd4a
SHA512 7f5a04d40e5c45386aa1c7efa19077c6e4d1306d5f84be503df5a0c0c4035328974a55dfc7138d4da2353133e10509bcdcd26d307c5d9984750a0a1f2641aac3

memory/228-356-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/228-360-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 b0291a90d9c87f71e960214b9c9e39c7
SHA1 25b7bc8ce47f8fc4bf41e41e45d5f432172c951b
SHA256 694283820a28e050e540351779c328f67008de6eb0b401c7238858f099b451cd
SHA512 b41f5861e9875b04bdfb71933156f049b85b8654d35151974c878a517bd99586b57b93da269dca736a6d0fb132029ba3dd40047982aa2a4c093308769862d414

memory/1908-371-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4000-372-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1516-373-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 ef5dcab966d0716d79c22bc69abfb1fb
SHA1 90a1eb42afbd75e2bd9ea0d789727f50d176a3da
SHA256 912d723991d4efd5f913ea70f2e05d86583e49480569f16c23bfed3f2b831559
SHA512 3a58a63e8ba5ed3c60c494ce50c2b6415fdb2e5a9bcd1b6f3bc347a36ac539e21db875df64ae52d1d49c2c480b0d785810f9d0284d63dcbb3aa2566c113dcd5c

memory/5116-384-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 233a120ec3e74087e2814f36079a2d09
SHA1 dbb31b12274d17017acaafc2745fa23dc9e3dd6e
SHA256 ac8178082fcd5a1c19cf4e34afc083e7e738ea22dcd8aca16d8e74571f31f2f2
SHA512 77a86fd6dcbbbf85541385aa5c067ed87cce8e12a873966a9aeb3b271f2956aaa7b1082150d1fbcec2b1eba078aa121d0bb676021c35ae810fa82505e1afde0c

memory/3192-387-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7fc138a2b6251f384d0229d56fd1075c
SHA1 2adccb0c2921528501246801a653ef3088d54fb3
SHA256 e9da682fb3dcf29eac62dbb44c3499f305cb994f1a90ca018fa1cfae27180db7
SHA512 ea3e6b157ce59c38bc19d0a2c70ab1b674992331e6bd483606ad6da8a861811cf69ed5bc92ce4f5158649b2f7e3dcb149f464471a21ced940ade324bd01fb4aa

memory/4880-406-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1360-408-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 c185c3a09ad85ff2597b22e82350a87c
SHA1 28eb402e0177962640ad75e7cf50d771d89dc2ea
SHA256 c3c44abb26a61ef09864ee0ed29630c3f0c8eaf25c9862f6b0628fb61688c1dc
SHA512 a3ced4a5d2aee604be0ea5c6aa069ad27d76cb5384148e57d6cc3bed8b4581bbc3e83bc656dfaed462f04955f257bccf1f711abfcecf819da3620522d3eb9b3f

memory/4676-420-0x0000000001230000-0x0000000001296000-memory.dmp

memory/4932-421-0x0000000140000000-0x0000000140226000-memory.dmp

memory/3932-424-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4556-476-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3856-498-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/1096-550-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4388-571-0x0000000140000000-0x0000000140239000-memory.dmp

memory/1516-585-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3192-607-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1360-611-0x0000000140000000-0x000000014021D000-memory.dmp

memory/3932-612-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4432-656-0x000002A1FA9C0000-0x000002A1FA9D0000-memory.dmp

memory/4432-657-0x000002A1FA9D0000-0x000002A1FA9E0000-memory.dmp

memory/4432-658-0x000002A1FA9E0000-0x000002A1FA9F0000-memory.dmp

memory/4432-659-0x000002A1FA9E0000-0x000002A1FA9F0000-memory.dmp