Malware Analysis Report

2025-06-16 06:16

Sample ID 230504-cfzhgabe7v
Target d6d89eff8ae95f17795daf44ddc35389.bin
SHA256 a101773d8d31986b39a648482c20a3059efacb9a035aeef739ab3556cee37bd1
Tags
darkcloud stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a101773d8d31986b39a648482c20a3059efacb9a035aeef739ab3556cee37bd1

Threat Level: Known bad

The file d6d89eff8ae95f17795daf44ddc35389.bin was found to be: Known bad.

Malicious Activity Summary

darkcloud stealer spyware

DarkCloud

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Checks processor information in registry

Uses Volume Shadow Copy WMI provider

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-04 02:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-04 02:01

Reported

2023-05-04 02:04

Platform

win7-20230220-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe"

Signatures

DarkCloud

stealer darkcloud

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bbe60a4826a969e.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{91834A6D-9812-4934-B72E-D04009A0D244}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{91834A6D-9812-4934-B72E-D04009A0D244}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{F4A44E56-033A-4463-B530-ACAD03B5BA56} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{F4A44E56-033A-4463-B530-ACAD03B5BA56} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1260 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1212 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1940 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 884 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1816 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1104 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1104 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1104 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1104 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 1396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1212 wrote to memory of 2548 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2348 wrote to memory of 2800 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2348 wrote to memory of 2800 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2348 wrote to memory of 2800 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe

"C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe"

C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe

"C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 180 -InterruptEvent 16c -NGENProcess 170 -Pipe 17c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 16c -NGENProcess 170 -Pipe 180 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f0 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 23c -NGENProcess 240 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 260 -NGENProcess 1d4 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 24c -NGENProcess 248 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 264 -NGENProcess 26c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1f0 -NGENProcess 248 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 274 -NGENProcess 24c -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 274 -NGENProcess 1f0 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 268 -NGENProcess 24c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 274 -NGENProcess 280 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 268 -NGENProcess 294 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1283023626-844874658-3193756055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1283023626-844874658-3193756055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 294 -NGENProcess 268 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 294 -NGENProcess 264 -Pipe 274 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 vcddkls.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
SG 63.251.126.10:80 qaynky.biz tcp

Files

memory/1260-54-0x00000000008B0000-0x0000000000A20000-memory.dmp

memory/1260-55-0x00000000051C0000-0x0000000005200000-memory.dmp

memory/1260-56-0x00000000003B0000-0x00000000003C0000-memory.dmp

memory/1260-57-0x00000000051C0000-0x0000000005200000-memory.dmp

memory/1260-58-0x0000000000660000-0x000000000066C000-memory.dmp

memory/1260-59-0x0000000005B10000-0x0000000005C4C000-memory.dmp

memory/1260-60-0x0000000005FB0000-0x0000000006168000-memory.dmp

memory/772-61-0x0000000000400000-0x000000000065B000-memory.dmp

memory/772-62-0x0000000000400000-0x000000000065B000-memory.dmp

memory/772-63-0x0000000000400000-0x000000000065B000-memory.dmp

memory/772-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/772-66-0x0000000000400000-0x000000000065B000-memory.dmp

memory/772-68-0x0000000000400000-0x000000000065B000-memory.dmp

memory/772-69-0x0000000000330000-0x0000000000396000-memory.dmp

memory/772-74-0x0000000000330000-0x0000000000396000-memory.dmp

\Windows\System32\alg.exe

MD5 4f4156da2001bbcf6c32116587618c50
SHA1 a0f29ba0d071f1d887ec7cda34820d16bed599d4
SHA256 5dbfcf0b97c8197a00bffc2383f22c9d7f0579aecca46d4ca48c3371c9912444
SHA512 d4f1783bb3da8264806e070d803f29d9f78a379d4d99e29fd81e4fae881935c830e0b9a1c4a601644c498d696e828a774ee8aeb43d8fb20f425c0ef8d743f86a

C:\Windows\System32\alg.exe

MD5 4f4156da2001bbcf6c32116587618c50
SHA1 a0f29ba0d071f1d887ec7cda34820d16bed599d4
SHA256 5dbfcf0b97c8197a00bffc2383f22c9d7f0579aecca46d4ca48c3371c9912444
SHA512 d4f1783bb3da8264806e070d803f29d9f78a379d4d99e29fd81e4fae881935c830e0b9a1c4a601644c498d696e828a774ee8aeb43d8fb20f425c0ef8d743f86a

memory/844-82-0x0000000000430000-0x0000000000490000-memory.dmp

memory/844-88-0x0000000000430000-0x0000000000490000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 f38f19ddea367db1cad66d74e4cc8a87
SHA1 e68c473611fbd8c9407620ec88b95388aaaa791d
SHA256 309be08192eb4147ffd39aff63727d72da39027b74e4bc2040a56a2e2e4ee2c8
SHA512 2190f6d1e5996acfab1a7940782275f5c507e51462ce2bb6474aaa844437f5fd69a03ad5f3af6238e845b0e22301e38ede9f97e9acb3091546b69367d479377c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 f38f19ddea367db1cad66d74e4cc8a87
SHA1 e68c473611fbd8c9407620ec88b95388aaaa791d
SHA256 309be08192eb4147ffd39aff63727d72da39027b74e4bc2040a56a2e2e4ee2c8
SHA512 2190f6d1e5996acfab1a7940782275f5c507e51462ce2bb6474aaa844437f5fd69a03ad5f3af6238e845b0e22301e38ede9f97e9acb3091546b69367d479377c

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 fff031ce3401da76460fce598a508730
SHA1 d38539826e4603740f429556e21f23b902318cc7
SHA256 1ce7c211b414f26e3711111061feb8b38ea64677c6a337c2eea32ffc5cdf2eb1
SHA512 816b5cc10002a739b77df85d3d1d2457846fb573f55553c9ae4ce84e4db9b21171b299ea89bdab37ef6c2e325e5d100765f456e05d94022beda11ddc19f18cce

memory/772-97-0x0000000000400000-0x000000000065B000-memory.dmp

memory/844-99-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/316-102-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/1252-103-0x0000000010000000-0x00000000101F6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8dca48c21c74c673bc77409c238b421b
SHA1 1ed5b5af57d5b262af362d52ccd01d8c855765f9
SHA256 02b526812b3bca2f6fbaf7a1548dc55bb7be29ec34b1d42af25d8967bffc5ad6
SHA512 c703777ec690ba13fef6f9e9ea9aa4d417888cd03fcd6b87e7fe8b4b6dd46c9554055f0b029d0c50392119b3bc994a536b8edd9f9608cd138407000a2676d5db

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8dca48c21c74c673bc77409c238b421b
SHA1 1ed5b5af57d5b262af362d52ccd01d8c855765f9
SHA256 02b526812b3bca2f6fbaf7a1548dc55bb7be29ec34b1d42af25d8967bffc5ad6
SHA512 c703777ec690ba13fef6f9e9ea9aa4d417888cd03fcd6b87e7fe8b4b6dd46c9554055f0b029d0c50392119b3bc994a536b8edd9f9608cd138407000a2676d5db

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 fff031ce3401da76460fce598a508730
SHA1 d38539826e4603740f429556e21f23b902318cc7
SHA256 1ce7c211b414f26e3711111061feb8b38ea64677c6a337c2eea32ffc5cdf2eb1
SHA512 816b5cc10002a739b77df85d3d1d2457846fb573f55553c9ae4ce84e4db9b21171b299ea89bdab37ef6c2e325e5d100765f456e05d94022beda11ddc19f18cce

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 5c5e0f5558d8940d025738f2443bf7dd
SHA1 90c855b6d2af218dacd28334d46b00ee77eeba24
SHA256 5cb380168c3da21037187a7dc16d5d2b04eed5fd0c4877bf4b44c3889d0c440c
SHA512 3e0597b37dfc8170fccce775a948a5d3a4dbad1e747684d485b3321da6da04efb452bbc75df8c6a96ecd5a3c053c864b027a3596ae1ba0b3abe5c01805acdab7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 8dca48c21c74c673bc77409c238b421b
SHA1 1ed5b5af57d5b262af362d52ccd01d8c855765f9
SHA256 02b526812b3bca2f6fbaf7a1548dc55bb7be29ec34b1d42af25d8967bffc5ad6
SHA512 c703777ec690ba13fef6f9e9ea9aa4d417888cd03fcd6b87e7fe8b4b6dd46c9554055f0b029d0c50392119b3bc994a536b8edd9f9608cd138407000a2676d5db

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 2a6e5bd09fbf858cace12c91112ad17a
SHA1 94e2153e218af8c529abaa3ecfa0f920f8171b6d
SHA256 993b4bb7f6cb3fc484ba17b01862369a747ac7f9880dadc493c773a253f9b7a0
SHA512 e8f798e269a6f133deeb83b8fb0d998fbc8e2739234293173889eb4c0d5361c4de5b3aed334db80379ee2043d95299a9b80e82dc453364019ada9a8ced8d397a

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1212-122-0x0000000000330000-0x0000000000396000-memory.dmp

memory/472-125-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 8e40ac8dfcc594c1c0a012f49f1648ed
SHA1 3a6ddd4b34879c7afd9d62f93ea76f93646d10f0
SHA256 bf907f63d345adbe5d129bf058f8ca1e8a457687e174629025c2098695ad3c5a
SHA512 4a42ba8e784ff0bb4971f4be14e286c1a974199335a958ca2a96a6e8bb9773b195b3fbc70f3a95d4dc922ca38f66150158983998420d75ff1922d782efc5f6dc

memory/1212-130-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1092-131-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

C:\Windows\System32\dllhost.exe

MD5 5a486288084e2de8c976935a98759374
SHA1 08ae217e000128b11e54fc553041a0e05d7cc5ae
SHA256 1c705726bb9b8a8dea676b3172a88928c717652dcb6b5b78a0aa7d61afcf5b4d
SHA512 4d8629b440838f91cf88908b73720a38bca87fe363f5c49e2b2c310ba0eb1c5b9b1031926665a7154ba6389a3284dd8c516b8977218d765c220a5b7660b8b240

\Windows\System32\dllhost.exe

MD5 5a486288084e2de8c976935a98759374
SHA1 08ae217e000128b11e54fc553041a0e05d7cc5ae
SHA256 1c705726bb9b8a8dea676b3172a88928c717652dcb6b5b78a0aa7d61afcf5b4d
SHA512 4d8629b440838f91cf88908b73720a38bca87fe363f5c49e2b2c310ba0eb1c5b9b1031926665a7154ba6389a3284dd8c516b8977218d765c220a5b7660b8b240

\Windows\ehome\ehrecvr.exe

MD5 9a9a1e5e35fd1e507dcb2ca5850c3958
SHA1 9102538544a69c06a331b845fbc3f49a212be2d5
SHA256 ef83e79c8947697713640fea0c21e2fb1a9967d55d3005fc09fd054116a6d6cb
SHA512 8418d943b71bdba1913ed451f145bda410fa9372bd993cf145ecf9a46f9f8a3664debaba1ee117b71c945e4493b50ca28d17d34e89d190a99b15f819abc39139

C:\Windows\ehome\ehrecvr.exe

MD5 9a9a1e5e35fd1e507dcb2ca5850c3958
SHA1 9102538544a69c06a331b845fbc3f49a212be2d5
SHA256 ef83e79c8947697713640fea0c21e2fb1a9967d55d3005fc09fd054116a6d6cb
SHA512 8418d943b71bdba1913ed451f145bda410fa9372bd993cf145ecf9a46f9f8a3664debaba1ee117b71c945e4493b50ca28d17d34e89d190a99b15f819abc39139

memory/1700-139-0x0000000000820000-0x0000000000880000-memory.dmp

memory/1776-142-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1700-143-0x0000000140000000-0x000000014013C000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 8e40ac8dfcc594c1c0a012f49f1648ed
SHA1 3a6ddd4b34879c7afd9d62f93ea76f93646d10f0
SHA256 bf907f63d345adbe5d129bf058f8ca1e8a457687e174629025c2098695ad3c5a
SHA512 4a42ba8e784ff0bb4971f4be14e286c1a974199335a958ca2a96a6e8bb9773b195b3fbc70f3a95d4dc922ca38f66150158983998420d75ff1922d782efc5f6dc

memory/1524-145-0x00000000002F0000-0x0000000000350000-memory.dmp

memory/1524-151-0x00000000002F0000-0x0000000000350000-memory.dmp

memory/1176-154-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 8e40ac8dfcc594c1c0a012f49f1648ed
SHA1 3a6ddd4b34879c7afd9d62f93ea76f93646d10f0
SHA256 bf907f63d345adbe5d129bf058f8ca1e8a457687e174629025c2098695ad3c5a
SHA512 4a42ba8e784ff0bb4971f4be14e286c1a974199335a958ca2a96a6e8bb9773b195b3fbc70f3a95d4dc922ca38f66150158983998420d75ff1922d782efc5f6dc

memory/1176-160-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/1524-163-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1176-164-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1524-165-0x00000000002F0000-0x0000000000350000-memory.dmp

memory/1176-168-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1940-172-0x0000000000310000-0x0000000000376000-memory.dmp

memory/1940-177-0x0000000000310000-0x0000000000376000-memory.dmp

memory/1940-179-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/884-181-0x0000000000240000-0x00000000002A6000-memory.dmp

memory/1940-190-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1892-201-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/884-202-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1892-213-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/636-224-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/772-225-0x0000000000400000-0x000000000065B000-memory.dmp

memory/1596-226-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1596-237-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/884-241-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/980-243-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/884-260-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1816-268-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/944-282-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/1396-293-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 b39723407ade8ebdc516a98abd012ce7
SHA1 51bd64136120383ae92041091d2653921412ec73
SHA256 e95dabe5aa94cefe665e56eb7b34b3712ededc42dfb4b713139ff9ed3b209042
SHA512 48e6dfc658b6e3df01d49edd35a0963b1ab937d5f5ddb96c47050b3856457755ac4a9defb4736dc776687acbf242e4bcaba4fafadabf0f6fa797b64e6210c84e

C:\Windows\ehome\ehsched.exe

MD5 b39723407ade8ebdc516a98abd012ce7
SHA1 51bd64136120383ae92041091d2653921412ec73
SHA256 e95dabe5aa94cefe665e56eb7b34b3712ededc42dfb4b713139ff9ed3b209042
SHA512 48e6dfc658b6e3df01d49edd35a0963b1ab937d5f5ddb96c47050b3856457755ac4a9defb4736dc776687acbf242e4bcaba4fafadabf0f6fa797b64e6210c84e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 4892d8bf37ed59639aff75e6c5363b27
SHA1 38c79e4481d1ba6af9dae3e241dbba1997850e87
SHA256 285685b9d8126f3397c863455517cdc6ea3793bb3af649294dae2248de95de54
SHA512 fc61f4657a9d3b752dc6a6a2928f78cc16c501794d7c5715a2f9b5571e72204371b29d53967e0c42e0828529bd6f686391d97cc0c95039487ed3003950fe5b74

memory/532-309-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1596-311-0x0000000140000000-0x0000000140237000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 04caae227c79554954326ebcdb08ba59
SHA1 dc932cd112a6bf4af96590a6fc4f0af24c4de0e1
SHA256 97296d73d97eadff61a06ff244412738f8bc50dbc2d5a60ec4ad5810e1e4a887
SHA512 2030e0b9ec84fd2b73d8cb74afa4f5264bfdab3d47534da69dfd3ca88557bfb61dd3573b27e3cf8849c1efda3d679f1ac6f03c4ec49484d3a4da6374da55fae9

C:\Windows\System32\ieetwcollector.exe

MD5 04caae227c79554954326ebcdb08ba59
SHA1 dc932cd112a6bf4af96590a6fc4f0af24c4de0e1
SHA256 97296d73d97eadff61a06ff244412738f8bc50dbc2d5a60ec4ad5810e1e4a887
SHA512 2030e0b9ec84fd2b73d8cb74afa4f5264bfdab3d47534da69dfd3ca88557bfb61dd3573b27e3cf8849c1efda3d679f1ac6f03c4ec49484d3a4da6374da55fae9

memory/1104-329-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/612-330-0x0000000140000000-0x0000000140205000-memory.dmp

memory/944-331-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 a8f10a7d67f1d52dbe309680d2e65f06
SHA1 307f6d52e18d0f3b94cdff67ce67c0c36b6a03c8
SHA256 ebe2ea1cc6f5c551a363fa3e881e26a8e26d22f79f1150a49cdbe3a02c7d3a33
SHA512 5c93a39c942a270a97582474a86441313f6dcdf41a7d9757e7638af8a9349956714d1057795b67bc546bf32e7d385defec4ea60339d58f1580416af83d4c553d

memory/2000-342-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 cf4a160b51a74e199b19a6bf2df3c255
SHA1 b4ad721dda60ec737ec2bf94b5e4143b938c3232
SHA256 b6bb673e1a1f5be86a858ed9782a4272bc3ebc566ff89984fa73f74fe194ecd3
SHA512 d3cd5517d35ba34c9e5c2f50697c2fc3a2e0195b918457600831d5d2be1a927837b54baac1bedf7449ba0b1d426e874f97526b0694028b5e9058fae2c9ffc6dd

memory/1388-344-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

\Windows\System32\msdtc.exe

MD5 8bafce7bed0713affc77fd1151b7d327
SHA1 cb2ece7dd248802022beb3cfab7191d6471dbb44
SHA256 768040949f15ec681f7286d134c247f7690f72ffbd783e5a56ca2e3cab66b511
SHA512 42462a57eb7c2f7f0e4f1c28b540bbd42501db40044a94824ccdea51e2b312d176acd6d94c517952966e690f1984f9dff468a81a0e5f1ff09136251934d3a2fd

C:\Windows\System32\msdtc.exe

MD5 8bafce7bed0713affc77fd1151b7d327
SHA1 cb2ece7dd248802022beb3cfab7191d6471dbb44
SHA256 768040949f15ec681f7286d134c247f7690f72ffbd783e5a56ca2e3cab66b511
SHA512 42462a57eb7c2f7f0e4f1c28b540bbd42501db40044a94824ccdea51e2b312d176acd6d94c517952966e690f1984f9dff468a81a0e5f1ff09136251934d3a2fd

memory/2072-365-0x0000000000400000-0x00000000005FF000-memory.dmp

\Windows\System32\msiexec.exe

MD5 4584d66cb9c39947b1bc80b567c39124
SHA1 01c3dea7f8e56a79de978d46bc1631ab776031cf
SHA256 faf670bfb310398d6bd5ac64f433f0c8ad7bfe44405168a36bca3d8b05edddce
SHA512 94cc3e96562ca0b2231ee4287c66815f297f67ab692fe4e327f8a3074069b2100b0512dd1359f5ea22b598e3b70141de4b9fc0f7fed36326bd0619b5f7abdd0b

C:\Windows\system32\msiexec.exe

MD5 4584d66cb9c39947b1bc80b567c39124
SHA1 01c3dea7f8e56a79de978d46bc1631ab776031cf
SHA256 faf670bfb310398d6bd5ac64f433f0c8ad7bfe44405168a36bca3d8b05edddce
SHA512 94cc3e96562ca0b2231ee4287c66815f297f67ab692fe4e327f8a3074069b2100b0512dd1359f5ea22b598e3b70141de4b9fc0f7fed36326bd0619b5f7abdd0b

C:\Windows\System32\msiexec.exe

MD5 4584d66cb9c39947b1bc80b567c39124
SHA1 01c3dea7f8e56a79de978d46bc1631ab776031cf
SHA256 faf670bfb310398d6bd5ac64f433f0c8ad7bfe44405168a36bca3d8b05edddce
SHA512 94cc3e96562ca0b2231ee4287c66815f297f67ab692fe4e327f8a3074069b2100b0512dd1359f5ea22b598e3b70141de4b9fc0f7fed36326bd0619b5f7abdd0b

memory/1388-380-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 4584d66cb9c39947b1bc80b567c39124
SHA1 01c3dea7f8e56a79de978d46bc1631ab776031cf
SHA256 faf670bfb310398d6bd5ac64f433f0c8ad7bfe44405168a36bca3d8b05edddce
SHA512 94cc3e96562ca0b2231ee4287c66815f297f67ab692fe4e327f8a3074069b2100b0512dd1359f5ea22b598e3b70141de4b9fc0f7fed36326bd0619b5f7abdd0b

memory/2300-383-0x0000000000630000-0x0000000000839000-memory.dmp

memory/2184-386-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2300-389-0x0000000100000000-0x0000000100209000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 8c0ac33c474f7941c5505619221d9197
SHA1 35db2ad58e3add44106e82b43c118b1014b201ed
SHA256 30a8fa3b60b23555de2e2ae2e837484d4e48e05bd0ab304311c8ed5541abca7c
SHA512 366b7e59912daa94dc7c49bfec4b3c118fc9ac1814a3901ccebba7d574de3f9a851d1053e7e0106ddaf6077e62b61140e49ea9a0f45690d6a9e889cc8baf221b

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 7ffa41525ac204db71284b6c86c20895
SHA1 d5f47d2ac25b109fcda5502528c5c4f1152e30f1
SHA256 6f92c12174878c3dfec5dba9aa6384ee2de98bae744a6c1dba782483fa648da3
SHA512 ccf30e8678ae0580d5a55eaad27c16197833f9e3ed4c42abb62ad7a8c02f6cf335ac7145eec9a239512be52b025f3d1e225ae09ed3344ac13b4ba83a4625b531

memory/2432-408-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2480-409-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1396-412-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 61db0e0c6c0b7ce041358edf24a0bf63
SHA1 82eb6ac5d6b817a74d092b8bb876749069be9c77
SHA256 f0b4a09a208f2ffda6ebaeb62d036c6586b451929366b9de972370a476d61612
SHA512 08c239d8b1ed126b9746cf400c256e263dfc2b6cbbf1eccc1decb01f3278a9b01cb068a798706a40e7588d63fe2f592ab578429436c3f7cf50356225c951fdff

memory/2604-415-0x0000000001000000-0x00000000011ED000-memory.dmp

\Windows\System32\Locator.exe

MD5 864b33cba0e15a1a8fd77ec1f243b8dc
SHA1 98096dd534f8796bc75dd8508685bfae9ed3af7b
SHA256 672ca7fdb052a6f5cebdd3047f5f03568625686441353e6eb0dac934340fd16b
SHA512 24d1669c8f2d946e8b542a6a2ffb033c0b9cd7a92f428a0db1411440d7c6b13b2828613ac43cc9403544ee1b10e419f96b9d9848aa9b69bfcf670597f88e2bc9

C:\Windows\System32\Locator.exe

MD5 864b33cba0e15a1a8fd77ec1f243b8dc
SHA1 98096dd534f8796bc75dd8508685bfae9ed3af7b
SHA256 672ca7fdb052a6f5cebdd3047f5f03568625686441353e6eb0dac934340fd16b
SHA512 24d1669c8f2d946e8b542a6a2ffb033c0b9cd7a92f428a0db1411440d7c6b13b2828613ac43cc9403544ee1b10e419f96b9d9848aa9b69bfcf670597f88e2bc9

\Windows\System32\snmptrap.exe

MD5 02948b611320c81ef31c4149ec54bab2
SHA1 89f32aa40e9145cca046cc98c28a4b0e80e9be9d
SHA256 ec51f061f4ebaa92327a4471ef81df731dc8b20adf97bb7959c2554e13b0ef85
SHA512 adbf864ee6fbf743606bd0ccfb08bb600699f7ecaffc61a17d8031eea85c6ffc397a83aa220bbf345c79a59df4c6a027a0ff2f9cec7015688bcb862881da7031

C:\Windows\System32\snmptrap.exe

MD5 02948b611320c81ef31c4149ec54bab2
SHA1 89f32aa40e9145cca046cc98c28a4b0e80e9be9d
SHA256 ec51f061f4ebaa92327a4471ef81df731dc8b20adf97bb7959c2554e13b0ef85
SHA512 adbf864ee6fbf743606bd0ccfb08bb600699f7ecaffc61a17d8031eea85c6ffc397a83aa220bbf345c79a59df4c6a027a0ff2f9cec7015688bcb862881da7031

memory/532-431-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1596-433-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2572-435-0x0000000000D90000-0x0000000000E10000-memory.dmp

memory/2664-438-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2748-440-0x0000000100000000-0x00000001001ED000-memory.dmp

C:\Windows\System32\vds.exe

MD5 822b855a0d4beb73d3b0862a28aa34d9
SHA1 af18018ff0c1f3644a05afe5cb66f2f11a18dcf1
SHA256 303a2989f0ac12fd78bc9a288ee9e4d34130b2e1f83395ce6e2c11fbf4de5f40
SHA512 000c959298b9f6f67c97b7ebf638c6bfeb8c5d42594583269b0abf65b14d38d928b05b06430f770bf77e08ed2e2a75a445a3fb733578f488bf730116141db128

\Windows\System32\vds.exe

MD5 822b855a0d4beb73d3b0862a28aa34d9
SHA1 af18018ff0c1f3644a05afe5cb66f2f11a18dcf1
SHA256 303a2989f0ac12fd78bc9a288ee9e4d34130b2e1f83395ce6e2c11fbf4de5f40
SHA512 000c959298b9f6f67c97b7ebf638c6bfeb8c5d42594583269b0abf65b14d38d928b05b06430f770bf77e08ed2e2a75a445a3fb733578f488bf730116141db128

memory/612-453-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2844-455-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 a733c58e0a71307c000f52293fb8fe6b
SHA1 a6059304496bb825cf185fa0c8f9d95b5f35c33d
SHA256 7f359cda57df8f9c7ba40b0e4fc979f897f6d59a233dc47ce2674985ca3b419a
SHA512 01b7b6df4bcfaa4b3e1639d284a7d1a61bc7ffa83f46d17c0adbd48ce2c6b2d26a94dd5a9aba926d7b7de287dd25bff1492384a50f189a599e9071ac95fc51be

\Windows\System32\wbengine.exe

MD5 75612b0d221ff1aa0ed6df9060031197
SHA1 ed016719f1c3922c55621904ea7739a8c12f3fd4
SHA256 fc3f171d323ea02b609fa0502f4f0cbc88d7438979b403e9ef062a92cbeface5
SHA512 b9701c09a8845a03a5725517c93ba8b4939a0d0159c37b970f449b97e667498d8cbf399b2ed9e5191c658a665ec7f2b84c553e16058cc2dd75188805777efde7

C:\Windows\System32\wbengine.exe

MD5 75612b0d221ff1aa0ed6df9060031197
SHA1 ed016719f1c3922c55621904ea7739a8c12f3fd4
SHA256 fc3f171d323ea02b609fa0502f4f0cbc88d7438979b403e9ef062a92cbeface5
SHA512 b9701c09a8845a03a5725517c93ba8b4939a0d0159c37b970f449b97e667498d8cbf399b2ed9e5191c658a665ec7f2b84c553e16058cc2dd75188805777efde7

memory/2944-472-0x0000000100000000-0x0000000100219000-memory.dmp

memory/3028-474-0x0000000100000000-0x0000000100202000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 557e813249bab5b87b001c40b9cd0384
SHA1 5f30dd693b00c152772f6ff08f715ea8b5ce37f2
SHA256 644c5f3aac687a009d6414be4db137b1ab114a3d99455e8171ce765d3bd628fb
SHA512 1786553aaa60e0f5f5bfa351c4f6e1a333e31a530ab811e5d1a48f2721af71587a5d8aaf33db609068a93a2f9c7e67db6ec05eb2ccc1c5495452e6d9d5d6c645

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 557e813249bab5b87b001c40b9cd0384
SHA1 5f30dd693b00c152772f6ff08f715ea8b5ce37f2
SHA256 644c5f3aac687a009d6414be4db137b1ab114a3d99455e8171ce765d3bd628fb
SHA512 1786553aaa60e0f5f5bfa351c4f6e1a333e31a530ab811e5d1a48f2721af71587a5d8aaf33db609068a93a2f9c7e67db6ec05eb2ccc1c5495452e6d9d5d6c645

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 addfbcf3b74a3a0780839b517dfdef6c
SHA1 0292e57270678a9eb787fa25f11e1059646e57a3
SHA256 f73ed83d6db8f95a1fec577791543c4b932c359461eda633992a7970f74804a2
SHA512 260b9626e4b3bea4abb8df3e3fcd314b23cbc9101e8c8406e08c78c42a27521c18201a6e69090558d2d52499443d2378e45161ae77e7110f4b4584efe9553ede

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 addfbcf3b74a3a0780839b517dfdef6c
SHA1 0292e57270678a9eb787fa25f11e1059646e57a3
SHA256 f73ed83d6db8f95a1fec577791543c4b932c359461eda633992a7970f74804a2
SHA512 260b9626e4b3bea4abb8df3e3fcd314b23cbc9101e8c8406e08c78c42a27521c18201a6e69090558d2d52499443d2378e45161ae77e7110f4b4584efe9553ede

memory/2000-494-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2104-496-0x0000000100000000-0x000000010021B000-memory.dmp

memory/1060-498-0x0000000100000000-0x000000010020A000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 bff3240ee9944b98188a092d57107458
SHA1 766fb30d60ba5b3c120b66736059289b8bfbd69b
SHA256 337d93e37202614fcc19c38f8fb57aa5c0fc1a4f45d1e7beff700346d8ae33da
SHA512 58f173c7396eed2d090d4539cad08a96bc1a77574ae0f5bd00ff5d9be2ed69e77fb90629159c0f8e3cffcd1f2fb117ececef1013c94bbb5f8429d4703d49be92

memory/2348-514-0x0000000100000000-0x0000000100123000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 addfbcf3b74a3a0780839b517dfdef6c
SHA1 0292e57270678a9eb787fa25f11e1059646e57a3
SHA256 f73ed83d6db8f95a1fec577791543c4b932c359461eda633992a7970f74804a2
SHA512 260b9626e4b3bea4abb8df3e3fcd314b23cbc9101e8c8406e08c78c42a27521c18201a6e69090558d2d52499443d2378e45161ae77e7110f4b4584efe9553ede

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

memory/2072-531-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 799d113a8c86b6cbace6bcf31b44ae92
SHA1 3b65338cc2472593acd647d19a010ce29d08f31d
SHA256 fceef6857cf96621c3bde221105dc8693f33282826248d0af03be72cf4fb7624
SHA512 1aa44b19466184ee8ded91698da2bdf99d9b55b217a7b56f63e48af96e0aa932bdeaf90ec686151b312bc8def771015820d533e2bfd18a9b45d4dea4d8e6e3b9

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 0982eab248aac62441f41758d740380a
SHA1 66d5bfaa4ee7c62187bcbbf3710773644de803d8
SHA256 d64ac021eb0b053d725cdccf889012b1cbe22e329e9177c2a89b01c79374b49d
SHA512 e94c3108e91b35e834580618b18a0e911444918ff73a992d0fc936ec559f20bcf7351a11a2e5b1849b993de698159edb980dd31ea4b8e309729eeb59b23e4d5f

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-04 02:01

Reported

2023-05-04 02:04

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe"

Signatures

DarkCloud

stealer darkcloud

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a03fb1bea807a0f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{A100221D-7AEF-402B-B05F-21D404F0BFBF}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028d0805a3d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060cc61523d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005447dc513d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dc63a5b3d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006165db5a3d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cf684503d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad9c33533d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c7b72523d7ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe
PID 1944 wrote to memory of 3708 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1944 wrote to memory of 3708 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1944 wrote to memory of 4104 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1944 wrote to memory of 4104 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe

"C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe"

C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe

"C:\Users\Admin\AppData\Local\Temp\fb71b9df885463cb148e10ddad2b81ca883ce2dcc0a7739808a3e5d203f9d00b.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.242.101.226:443 tcp
US 67.24.35.254:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.242.101.226:443 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.242.101.226:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 165.160.15.20:80 myups.biz tcp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp

Files

memory/4132-133-0x0000000000AC0000-0x0000000000C30000-memory.dmp

memory/4132-134-0x0000000005C10000-0x00000000061B4000-memory.dmp

memory/4132-135-0x0000000005660000-0x00000000056F2000-memory.dmp

memory/4132-136-0x00000000055E0000-0x00000000055EA000-memory.dmp

memory/4132-137-0x00000000058C0000-0x00000000058D0000-memory.dmp

memory/4132-138-0x00000000058C0000-0x00000000058D0000-memory.dmp

memory/4132-139-0x0000000007C50000-0x0000000007CEC000-memory.dmp

memory/2400-140-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2400-143-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2400-144-0x0000000002B30000-0x0000000002B96000-memory.dmp

memory/2400-149-0x0000000002B30000-0x0000000002B96000-memory.dmp

memory/2400-152-0x0000000000400000-0x000000000065B000-memory.dmp

C:\Windows\System32\alg.exe

MD5 6d6e98d06a0522c68b8d241ca00dc6af
SHA1 e202d5a811c0eb71c116a1914702b84eb5c0c7c3
SHA256 577f406d4a755078b06d5d47408df6c234a499263df2f789a04531cfd7287b59
SHA512 0148e56821a0fec07d15ec8618e4b1e4da90b1843ec61744f67aa915cd7bb723919d0273d23374a7976c0dc836ab5f5fd7196d69d557f9541664104c28745ce9

memory/3404-157-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/3404-163-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 33253f02ad4139e8e032071f44d29394
SHA1 700ccd60a9d35655bef84e8b24b48323a2d1404a
SHA256 83500f570a810a4c2fa18b2bcd85e00fd05a2f3416ff8ad449a3757f044a67e8
SHA512 5a8a0f541f1d78e2096b95d5a50d2f99172356f083ddb5c5a68064a9f4815cb0c28ca9fc0de8ca4b6658447b21ed41eb9f67f63f0d0ec3f58fe6c774cb456290

memory/2524-169-0x0000000000650000-0x00000000006B0000-memory.dmp

memory/2524-175-0x0000000000650000-0x00000000006B0000-memory.dmp

memory/3404-178-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2524-179-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 fbec95ef08b1e195d204e4bfedf68b5a
SHA1 ae0ac62027a23ae0b9ab906c682c9e6d89a8c0c0
SHA256 d62eae19d6d2e20fbedb2ef159ccd125886a6c63b65f61801bbf9be8f937fbdb
SHA512 60615d369821ca6d4085383cb34a9bce53a290bfe95462a25041d431b439ae09213cacc76ac9525cb1db04c8805be83be3f89c1969446c010543331a547d9b1d

memory/4020-181-0x0000000000EA0000-0x0000000000F00000-memory.dmp

memory/4020-187-0x0000000000EA0000-0x0000000000F00000-memory.dmp

memory/4020-190-0x0000000000EA0000-0x0000000000F00000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 c49ac6f59fea4a11810c8d0a0dea8dba
SHA1 ca4ef3ea370e6ca63fb542dc5241a8c6999bc0d2
SHA256 da918f6ebc1efec6478397f24b0ddc4daf6231296a773acdf9ce49fea7652a10
SHA512 a97970eedb3afda0c3917b89f4d0ceaa4b173e55b08f90e4f3ad5129bfac51d239b5b5c987af5bbd6398d685677ef5550e4ed7f773bbfde524c3d6948ed6890b

memory/4020-194-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3544-193-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/3544-200-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/3544-202-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 c0c8175acc4643130e5769dfc3f61ec0
SHA1 24da58e388a58d7f68f5a08ec42aa354cfc514b4
SHA256 08afa858581707989b947531a6b38336865b7bc4d744de873a74877ae1dcfb52
SHA512 8208aac09b7386ced833842e215eb760890c6da8a295addb6d97f832fca3c0be8bc66cbf97d45fd94fed4f999f3712510fafbcae028a9797827e7cbdbd2019a3

memory/1372-205-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1372-211-0x0000000000190000-0x00000000001F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 110007252e0a85cbc854cbb723beea5a
SHA1 e2bfaf1ae94951c571cea596045f5da0c8aec3b4
SHA256 69b69d0c47bb711c14474da4024e23cee2cf98edb56cd1c11a7b81037e2c250b
SHA512 118acc06f110d3a7f9a741fa765d972d6864903ae2511aa99e8a2d6b47a5d7ea7dd1b441b02f81519fd3ec8c8e2d2fff9862583c46f2b08469d49db7d6257884

memory/1900-215-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1900-221-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1900-224-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/1900-228-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1372-227-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 86b70572cd6f5ae32cb873cce0f5a886
SHA1 f70f6a22b5e7a166315d9e7743b75c84293f564e
SHA256 3bbf1b234a76e5227aee8493a285c652f6a3f665730f80026012911a3ab4caf7
SHA512 d9e1da7e982f3ea141f7f8cc4b82b641cd6f8a8ea9f720171c14c8c749917497566120a946a5c28730049183329b7fbb33db54255364735bd016082ebcc0e7cd

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 78a6d383b6ff24d1d56d4b80eaaac6b2
SHA1 c1f54f3db8d2720a9d2a360c5d0f8d114c1996c5
SHA256 1769c2585708be756d40d3be1f34b704b1c1e4fe8c076b89d30fcfd2384b6688
SHA512 25a842927efbf1e66971540ef107769fa3c19e963c95662d55384556f2563a8374ae675419d34a033bb54d2d63963ced2589ace2e7eb163fcfc6dc3a22034368

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 2a393415ccda8d9f9584e8926eec4500
SHA1 894e8b39a6373f9b60341dbce72d9f77007410e9
SHA256 6e768baf1edcef7ab6b24304ca5aa0291c456f8e8ad7792d87c75dbd58e6a058
SHA512 eecd660a79dfa2d0c4cbb96926b70a9c302ee179105230ad8b870b91e62f6af9d4038e7b34db8aa68b7d68c9be41b2aa5fecd115197b6bd36b66f77923adf89a

memory/980-254-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4752-257-0x0000000140000000-0x0000000140226000-memory.dmp

memory/1136-259-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 fec8989bcdd04cae387d47d191de9c04
SHA1 ffb463c796cb51404dbcc75c957dd2094abedb6e
SHA256 d8c391844ace2b5091d3cee9608607ded5de27d1104d74ed1477abeb09efa40e
SHA512 642fd1c7fb9831a1a95dc6d92269c841e9a9508a689968ea9bdd02407e7a0ad24b270748ee1a0b0aac6a5f9443fb567595a572cb19c78ae35853de0b8eb7214d

C:\Windows\System32\Locator.exe

MD5 0742159e80955356510e4c2fa6569202
SHA1 029a4c62796bd95bb539801f4ed949ad30ea5325
SHA256 22357f51c457cc778014b05ad6ce932832ddfd990be2698097fd3ea84c07b45b
SHA512 a8b449be4254c079352726e9c777e909ff6c20f1f4c3e22d1d7876c512e5c5a8eb28ae23204513cdb2bf6701ddfe6debaa9cc12c1aa9373ed26a8408bb67b9cb

memory/3156-276-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/3748-279-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 51e444f469bdf6b6001ea187837b4278
SHA1 48d5e2a3c0e7012dda483c8cdb3b8f813df848ba
SHA256 856f81be4bbd670bf73d79ae6af3dc675a146cc460a06d347fbf4f5360fad41e
SHA512 2f0eca835f40d03f94e878bc52896ae9a8274cc90b6bef5c81deeb15b1d8232141b59a2b6bbbfb8e639cd2e25512008f4fcf46097d27dbee7a884a543f114698

C:\Windows\System32\snmptrap.exe

MD5 abba9002a7174eba7a7f592b96379a7c
SHA1 3c440a323b196919855a9a0f1895df892f375af1
SHA256 d0187d6f15b62deb67a2acf04c6c94607bf55da60adc39f161b35d344070cb29
SHA512 088c6ad4b000bbbcb9a0edc5070356daec674bdc86ecbba8327f1a6ba2b788fea592d06020391fd3b502e5539ea928916a8034e544b6122e1dea6ebcbc6691c0

C:\Windows\System32\Spectrum.exe

MD5 de74cd25688585fd446009fddab7061a
SHA1 22a4c1f906fd2af5048f2ecf6e10802f4a2862e2
SHA256 7697f60e89a99676a87343838e1a8cb62c0de0dfe750ca59136a4a0dca84898d
SHA512 3b24373e8ded8c6c64ba4810219c662d880d1ad814029c308a6ffba2803bf444ea734988f001d2670bcc02ff209563b2b10515b5de1df2d0da3d45c0135bcfef

memory/2772-312-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/4904-309-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3496-315-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 d61decc5f84096bf5698f0eb4bee0698
SHA1 8e3e1bff2ff3b32df738b4c81e7baf413e0ad9a3
SHA256 9b110fce71149fd9a5d5e7bd06e53e824d4dd5ed1d8a5ea4d60d51ac51a4e082
SHA512 2efa9e316c686289fd519c970cf0b1ac8332a35b776224987aac660aecfb9325a1602b4b291fc2d9f155c189e90bc013fe2edf6507688794e048d7d4ff30da7e

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 d61decc5f84096bf5698f0eb4bee0698
SHA1 8e3e1bff2ff3b32df738b4c81e7baf413e0ad9a3
SHA256 9b110fce71149fd9a5d5e7bd06e53e824d4dd5ed1d8a5ea4d60d51ac51a4e082
SHA512 2efa9e316c686289fd519c970cf0b1ac8332a35b776224987aac660aecfb9325a1602b4b291fc2d9f155c189e90bc013fe2edf6507688794e048d7d4ff30da7e

memory/4144-332-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 21a27e8980905d0520340a371b9d08b7
SHA1 6de9afae4a8ae1ce11f070d06b26fcf3f3618393
SHA256 9707ee6e2f6e2b5d21497f84e9a4f14a51c182992914bc0f338401a18a5344ff
SHA512 66c395fed46b536547433b1c2003ef4165b98af7bc0b99e6479ab5d2849ea614600266e51c658a838abb2440b57f71dc32f9a30a2ecbe987002fd17cf16172a5

C:\Windows\System32\AgentService.exe

MD5 2f7fb887849b03c8d18036b9055d0bfc
SHA1 5859fee50e09dbf8f72fa31f7317aef5b1e1d07d
SHA256 a12190bc6f1ff4a5be7976f890a89f9023b004083993e8402b90b55df8789720
SHA512 725565f5c81dbe9282ec656acbacb97411b9174364b4ec6d3b8ab5959e90b227b617fec3f6a0f819c8daa31f7f124daabf868cec570a541a24cc2d09ddb9585d

memory/2752-355-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 70bdbc7f0f7ce2421f0044ed2e1f39f2
SHA1 683eb3a01cb34102769afe260c11ebae43c2b388
SHA256 742c5ddd1cce1996ba68e87675b1ff02d330ea9d7e5b4b6497eb4f0d45b495cd
SHA512 33b3aaf01aa7e8d08c9b6dad2a2617b3f83aae21ce90185671d9ef63b178dacaf5a4e52260c079d8085556aa09b5528bcdb1ed08dc607dc03cf4ea8f2d097fed

memory/3040-358-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4516-360-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 b9651570d44e1411997ee693f9f425fc
SHA1 3533716b620f6d64927324f054641aea2116c6fd
SHA256 e174055dea24831562525834a80d548a0f3f2e4bc516882acafa46ad0d2723f9
SHA512 a68f1544d134bcfd4906bd17c35e86d56020cd71a53ab034bd42ff7ac1c17ac9af2740e559d02974d2cc8e690196313f0d9a403ec5588f704b779019de81d85a

C:\Windows\System32\wbengine.exe

MD5 8710a5dc0550fce4aa1f43d6d2b6363a
SHA1 7dae2ffefdfd723254d459663d1db1f27c829844
SHA256 f258d179b7e6ffe85e089ceb97775bbedf918c0c0f447ed7fb8d15e0498a9703
SHA512 369c1ae39fbb2bcced8159c639d9336bd0671d5cee32e4cb6b35b3403cd1603f58d43a5d50426e1739638797ccaac302fa79b99390dcfd7021dd8a94ac0abe0a

memory/3024-388-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 b981a24cd0d870259045213f345e97e6
SHA1 0b2275f2dc40eab85e8fcd0e407f6d1454a33ab5
SHA256 6673fdfbd24b8158851ab3a746456d261594e09fe5ebb7f4f5caef79e9e78b5b
SHA512 cad9d1f814cd10362ddb4bd956569dc2c17f3bbce4e85be4b13d639601e913b9b511f13f658f452a67d33ac541f5cb1bacffcd7b2c9827e009fb19866835dd10

memory/2440-390-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 a51981d7af4b1a4ff444e8cd13496949
SHA1 3f9d0fa9773f6d71063eb14c81660112d12c9154
SHA256 f063339e1aa36b52478be3e13aad0455167f126a5d640fef9f66cd8f0afc9f64
SHA512 2bfeab540f28e59743bca75b72b037f80a98c047628a27ce56ebb285fc34de54a8ee1a8ff26cfc987038e1dc867f6ec56ae574efcfcf361d84bf625c47298eca

memory/2400-425-0x0000000000400000-0x000000000065B000-memory.dmp

memory/4572-430-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1944-433-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3544-510-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1372-537-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1136-553-0x0000000140000000-0x0000000140202000-memory.dmp

memory/4904-560-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3748-573-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/3496-579-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4104-590-0x000001395EED0000-0x000001395EEE0000-memory.dmp

memory/4516-611-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2440-612-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4104-613-0x000001395EEF0000-0x000001395EEF1000-memory.dmp

memory/4104-614-0x000001395EF10000-0x000001395F010000-memory.dmp

memory/4104-615-0x000001395EF10000-0x000001395F010000-memory.dmp

memory/4572-645-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1944-646-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4104-647-0x000001395F290000-0x000001395F2A0000-memory.dmp

memory/4104-648-0x000001395F290000-0x000001395F2A0000-memory.dmp

memory/4104-658-0x000001395EEF0000-0x000001395EEF1000-memory.dmp

memory/4104-659-0x000001395EF10000-0x000001395F010000-memory.dmp

memory/4104-660-0x000001395EF10000-0x000001395F010000-memory.dmp

memory/4104-661-0x000001395F290000-0x000001395F2A0000-memory.dmp

memory/4104-662-0x000001395F290000-0x000001395F2A0000-memory.dmp

memory/4104-679-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-680-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-681-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-698-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-699-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-700-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-703-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-704-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-705-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-706-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-707-0x000001395F330000-0x000001395F340000-memory.dmp

memory/4104-708-0x000001395F330000-0x000001395F340000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 68e8f50081422f0ea26f86a56ec5186a
SHA1 44079a8108f2af6cfc0461ea9562010ecea4dd58
SHA256 09f62a7cd924891d7d633c71582665ffb408707ed4560b8c151201b47dc12889
SHA512 d1d257b3564dcea220a2b6f6a1235d53a917431fef8094e3ceab99ea3d91696e44a2cd421fc341046777844750a88976b536eae92c6d9846952bf53e7ed8c8c7

C:\Windows\system32\msiexec.exe

MD5 231bdf04f4b6c395dc5119341dfb96b5
SHA1 c2543c5458b4b0df0fb02e271462666f4f46f4cd
SHA256 4c52e6e350d8b5385acce3c431167d78daa91a5626fbe98fc1505f637db2c940
SHA512 a7588caba4221b7242030de0612920a6d316e84d85e1c1612760de37d00bfc5eab832f4e9dbb42de2de2f7682f65094e3bc8bdae7e9ba2e612d881d64ec9d2a0

C:\Windows\System32\SensorDataService.exe

MD5 51e444f469bdf6b6001ea187837b4278
SHA1 48d5e2a3c0e7012dda483c8cdb3b8f813df848ba
SHA256 856f81be4bbd670bf73d79ae6af3dc675a146cc460a06d347fbf4f5360fad41e
SHA512 2f0eca835f40d03f94e878bc52896ae9a8274cc90b6bef5c81deeb15b1d8232141b59a2b6bbbfb8e639cd2e25512008f4fcf46097d27dbee7a884a543f114698

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 110007252e0a85cbc854cbb723beea5a
SHA1 e2bfaf1ae94951c571cea596045f5da0c8aec3b4
SHA256 69b69d0c47bb711c14474da4024e23cee2cf98edb56cd1c11a7b81037e2c250b
SHA512 118acc06f110d3a7f9a741fa765d972d6864903ae2511aa99e8a2d6b47a5d7ea7dd1b441b02f81519fd3ec8c8e2d2fff9862583c46f2b08469d49db7d6257884

C:\Windows\system32\fxssvc.exe

MD5 fbec95ef08b1e195d204e4bfedf68b5a
SHA1 ae0ac62027a23ae0b9ab906c682c9e6d89a8c0c0
SHA256 d62eae19d6d2e20fbedb2ef159ccd125886a6c63b65f61801bbf9be8f937fbdb
SHA512 60615d369821ca6d4085383cb34a9bce53a290bfe95462a25041d431b439ae09213cacc76ac9525cb1db04c8805be83be3f89c1969446c010543331a547d9b1d

C:\Windows\system32\AgentService.exe

MD5 2f7fb887849b03c8d18036b9055d0bfc
SHA1 5859fee50e09dbf8f72fa31f7317aef5b1e1d07d
SHA256 a12190bc6f1ff4a5be7976f890a89f9023b004083993e8402b90b55df8789720
SHA512 725565f5c81dbe9282ec656acbacb97411b9174364b4ec6d3b8ab5959e90b227b617fec3f6a0f819c8daa31f7f124daabf868cec570a541a24cc2d09ddb9585d

C:\Windows\system32\SgrmBroker.exe

MD5 f1e6d84868e4aea27f5da7d270c0362f
SHA1 a4111b4399f42d38224d5525b6a79df4807e4955
SHA256 c52cb1a23b1e44410de2e24a28560d5b611eb268e93164a2733edd6ea68c763d
SHA512 5d78d77b53e8e354839912a9d418a55ee257c327449e3bee793b57342e6d50e1d52b2b9fd78960c69ceb72060691ac3481d66f7269431acdf1ef1256f24edad9

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 be9bf1e43ef89a082c02bcd3f0c206c8
SHA1 703485da8294a1e9c9bab2663ec33f8b579d08b9
SHA256 bcdbc17793534a9c284c03c3628f4621c449ab87c80b7f5f25d41eec20830b23
SHA512 e72645d889ffded0953d8e48792f34ed9322d193bc967f4c526e1d89e104d330d5181f57eb565252474479399762d85c3e7971690220e05884ebefee33a0f658

C:\Program Files\7-Zip\7zG.exe

MD5 9b642207a0f29c4c65c60bf652509a7c
SHA1 1feeeba02df4b132857f25db7636f013f9c56cda
SHA256 ec91244ec367f08450fddbd6bea77edf474969b68abb581ed3c78facc64b897c
SHA512 69c7c3b8442adb66df3a7ff08b348a0a1d3a875b55259dafd40547c6505748dc41993d15c09d5498df7c05fd1bf478660d255a3c86ec16d517f950d01fd7bdb8

C:\Program Files\7-Zip\7zFM.exe

MD5 cab60fb7cd648be9f92e1799baffd1d7
SHA1 d9e98bacfd5e7ce9270a6c911a593a1631a926bf
SHA256 ed7f9d3294358d84fcd9134fc887610a9c0fd96baa26405a451c9cb3a0b44144
SHA512 2394bcbbb6d50e806696663d88962b074ec17a9b93bcf67d18af0d63fc0299448b97379fe71d926224cb04ec6bc6884488b39eaf95890752b6f82280a2bf0f27

C:\Program Files\7-Zip\7z.exe

MD5 30b06ccaeb15d70df990eeea2fc7e697
SHA1 7dd337a98fb9426051303237c4959428e8edf371
SHA256 aee2fc1e6fbdf6684048e60d5e19a4c648ed56748b7b3311df6252adab2770f8
SHA512 fbbb3e9806e6a20245e9e3466c9cb9eb91bb7c66af805c2a4fc458c06b42bca52008c7fc0c2a94ec313014819ae4002810c1a04867e4a04cadb95726136487cd

C:\odt\office2016setup.exe

MD5 a000d794641913f8f5e19369954b7f56
SHA1 5acbf42199f1d39aec1e43237cd4a878b8edcfa9
SHA256 958188161cc8280971577383b8d838f012da3d1400326430ad7b925b60565289
SHA512 7e9fd27dadd0cfc24fd5b894bf82b8ca23b51595a1d2572dea2ef4f1e34f656a05727687fdf87f54bbc47bea6b60bb6e5fc7adf74abd569a7e6a50c0526299b1

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 d0bbf2405e35e0413afb89333e3e0989
SHA1 eca1a00664586c784425c5653f74c969df76840c
SHA256 552b1f3f2c70ff520a8d0266c0c0d51cfbd4494265f1eba0318394d314cc7009
SHA512 6dae008b1873d96b107c2bbe4d71b923dc78f961b89e09bf7c6a57d2c35f07b3913ef600f4a412394d8cc1fe4fd73929a9b1f93af23b70ddb772af57cd7cdc9a

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 339abb06c24a589349cac6fc844812d1
SHA1 6dd354c8ea6ab62309b6d584084b9bfb0e02b391
SHA256 cfa1260c8da9df36b6c6a567bd927af3bc77fdd9a55875ea3e040e655a7c7d42
SHA512 8c5bfb96c892afd9e88c0b9994f93fe3afb0d7634fd13732d32940255ba8b892b40ffc3f4fe6b8343fd0b31142e5b673220177aeda9af0632d33c647b311b28d

C:\Program Files\7-Zip\Uninstall.exe

MD5 5b9788343474a11a06eec9671a7d0ba6
SHA1 a85915de3a34eaa31a03f5de194a7e96c90c5588
SHA256 f773cac14bfafcff95740046d02dc592e0709b1950f54d9b65e81dc21ef84645
SHA512 0cd409fd316eecb38b880d7849fc73bf8e90b1e114aee19719ad92621f6d8bb982a2995f0a686fcf0df18e006d6ee1e187ba0648893f0214ac365d4f05dfe0c5

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 411acac59481d95e7208adece02adc20
SHA1 fd272b511a5e40eabb15dcfd2a0c1bf0cc2b885e
SHA256 96620b864601bfe9cdee3ee1f5eaf8faa839550a9a139f4066fb4bdc1a9623b4
SHA512 a5cc53ee28b566c0bfcab0e782ae4dd3c6dbb211d83833f19ab7fb636df92ac84f3b70ead63fcbe8dbe71aa6debbcaf8b4847265e30052f0c344c3ec04d1fd58

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 b2e0bb0ee89ac1cfbf0f7a826d08c38f
SHA1 a4f4950d0812adddc597f9b5ae824d2937a808b6
SHA256 89c513d67e19b648c515987dddc14a9837cab0bff0e2a397ba6c83a9ee472cbc
SHA512 3a1b67b0b25e2b9d834d2e0aca9576b2fc6047b0493e00f81dbe492ec9b5ec0d42d6d182040c38c913a4d49141262a86e349f7495dce97331fb496b5bd46c51e

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 350e9f29803fa69c78a321b8c14ef3de
SHA1 92715b9350a5c0984430da97f8f2bfc683149b5f
SHA256 56d93a340a2685b0c4e5647a08b25f1f3c1093ca6eca81a214ebe18bb1006496
SHA512 54aa3842b80099b8a359986f1aeb95d9fae680409064563f59de9b57a9bfe201900f501afb1fc266bc38a3aa6f7ca41ebad5ecea3f740b0e5223afa597c22b95