Malware Analysis Report

2025-06-16 06:17

Sample ID 230504-n3e8wsdh71
Target Purchase Order 202319876.exe
SHA256 df2a21acbf5abb55445a48a442b6245205ec80e36bb861aadd47ee18e4d132f2
Tags
darkcloud spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df2a21acbf5abb55445a48a442b6245205ec80e36bb861aadd47ee18e4d132f2

Threat Level: Known bad

The file Purchase Order 202319876.exe was found to be: Known bad.

Malicious Activity Summary

darkcloud spyware stealer

DarkCloud

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

Uses Volume Shadow Copy WMI provider

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-04 11:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-04 11:55

Reported

2023-05-04 11:57

Platform

win7-20230220-en

Max time kernel

151s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

Signatures

DarkCloud

stealer darkcloud

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e3ecdac2826a969e.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1716 set thread context of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{BA39C67A-7951-457E-8A76-D8B730240007}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{BA39C67A-7951-457E-8A76-D8B730240007}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{5D435D63-3BF6-4F20-BCA2-1ECF10C68AD6} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{5D435D63-3BF6-4F20-BCA2-1ECF10C68AD6} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1716 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 1460 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1460 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1460 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1460 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1460 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1460 wrote to memory of 2152 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 3004 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1964 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 1ec -NGENProcess 1cc -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 184 -NGENProcess 1b0 -Pipe 1f4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 264 -NGENProcess 1b0 -Pipe 248 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1716-54-0x00000000013B0000-0x000000000152C000-memory.dmp

memory/1716-55-0x0000000001310000-0x0000000001350000-memory.dmp

memory/1716-56-0x00000000002C0000-0x00000000002D6000-memory.dmp

memory/1716-57-0x00000000002F0000-0x00000000002FC000-memory.dmp

memory/1716-58-0x000000000A990000-0x000000000AACC000-memory.dmp

memory/1716-59-0x000000000DAD0000-0x000000000DC88000-memory.dmp

memory/920-61-0x0000000000400000-0x000000000065B000-memory.dmp

memory/920-60-0x0000000000400000-0x000000000065B000-memory.dmp

memory/920-62-0x0000000000400000-0x000000000065B000-memory.dmp

memory/920-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/920-65-0x0000000000400000-0x000000000065B000-memory.dmp

memory/920-67-0x0000000000400000-0x000000000065B000-memory.dmp

memory/920-68-0x0000000000100000-0x0000000000166000-memory.dmp

memory/920-73-0x0000000000100000-0x0000000000166000-memory.dmp

memory/920-79-0x0000000000400000-0x000000000065B000-memory.dmp

\Windows\System32\alg.exe

MD5 bc86840d880394add8dbd5d382819109
SHA1 40dc7b1d83aaa943f575ef8efbf42d8e906d94a5
SHA256 297b5213932a56d215e4dfd26f9e6de2fde3cf0c822b2e82ce2133b0f6f27fd4
SHA512 579481d08fe3175a9f58bbbe4149326de356362a716b841da1836e0735b15687fc6eedd568bc03b72215801e9eeb01352f09f858db8bc3960398b17ade6b37f2

C:\Windows\System32\alg.exe

MD5 bc86840d880394add8dbd5d382819109
SHA1 40dc7b1d83aaa943f575ef8efbf42d8e906d94a5
SHA256 297b5213932a56d215e4dfd26f9e6de2fde3cf0c822b2e82ce2133b0f6f27fd4
SHA512 579481d08fe3175a9f58bbbe4149326de356362a716b841da1836e0735b15687fc6eedd568bc03b72215801e9eeb01352f09f858db8bc3960398b17ade6b37f2

memory/1848-82-0x00000000008B0000-0x0000000000910000-memory.dmp

memory/1848-88-0x00000000008B0000-0x0000000000910000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 53691ba15c94f286713c2e3f5622421e
SHA1 115d20aed6b3f9eb719919dc0416a2ee6eaa20d0
SHA256 d2ae4ade3fe23c490adb3943aa36fbca644ef2266b5bedaadf6151ad4fa6f6dc
SHA512 6735fa5b067ff667f3eb93e92a8e0d0d41149b5125800779fb817700f34b1f0708c6162b0bb57452aff243390b4130e6b23e0906675a54dc93648623b467fb32

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 53691ba15c94f286713c2e3f5622421e
SHA1 115d20aed6b3f9eb719919dc0416a2ee6eaa20d0
SHA256 d2ae4ade3fe23c490adb3943aa36fbca644ef2266b5bedaadf6151ad4fa6f6dc
SHA512 6735fa5b067ff667f3eb93e92a8e0d0d41149b5125800779fb817700f34b1f0708c6162b0bb57452aff243390b4130e6b23e0906675a54dc93648623b467fb32

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 822ceaef695b0b7660e8ebfa2042dbad
SHA1 a77df9c35f8587c76ed16c1591e0e04b47908a32
SHA256 1367a16bcce1fa149ad1219904deb7e0c63ca0452bbc968bada55509a88dc76a
SHA512 8da4010ccaf1aeb76bc6045a5023008845e6da630f069fc9bbcb091dbaab2b2d9e593c4a934cea7d45fe5d8ec26005db8566e8d9f11c9d35259a88673cc9ccdc

memory/1848-100-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/820-101-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 822ceaef695b0b7660e8ebfa2042dbad
SHA1 a77df9c35f8587c76ed16c1591e0e04b47908a32
SHA256 1367a16bcce1fa149ad1219904deb7e0c63ca0452bbc968bada55509a88dc76a
SHA512 8da4010ccaf1aeb76bc6045a5023008845e6da630f069fc9bbcb091dbaab2b2d9e593c4a934cea7d45fe5d8ec26005db8566e8d9f11c9d35259a88673cc9ccdc

memory/968-104-0x0000000010000000-0x00000000101F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 0369a4f9e8adfd1f6f8e6c38b609d524
SHA1 f1b2a5d060d7411b90b150675dd07f490fea9f78
SHA256 e808eae38750114252f64dd9077cac1015d55bfd5847c8c6ad9672ca3304d5d8
SHA512 7e66bdb15214573be9f85af90dc111d92b7d9dd24318279282fbc5612d57fc0dc1d31c167abd7dc3ddd9c30a58879200cc3af298ec534b71d1f761a6c4dcbcef

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 0369a4f9e8adfd1f6f8e6c38b609d524
SHA1 f1b2a5d060d7411b90b150675dd07f490fea9f78
SHA256 e808eae38750114252f64dd9077cac1015d55bfd5847c8c6ad9672ca3304d5d8
SHA512 7e66bdb15214573be9f85af90dc111d92b7d9dd24318279282fbc5612d57fc0dc1d31c167abd7dc3ddd9c30a58879200cc3af298ec534b71d1f761a6c4dcbcef

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 50b325e4a89091a924380dd1e5b121c1
SHA1 5684a1eea217c5895020cc1553891768be277cfb
SHA256 6d6da2255d0ee12044778469548f3292ccfa67627c80e51c0a7677a5a0c27b8c
SHA512 435ca83a80532f89a1df1dc9fb30034a94914f8bcebb6a2237fa4ddd0d1db40f4318d80c8fcd4fe7d25a1689b79a9c6aacd2924a452c72d93fa69a4aaaf5f0f9

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 6b4ee5bf44e795f3e895872b1751c79b
SHA1 d71405f09ba8923f888d5ed18ff875babade6d1e
SHA256 34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95
SHA512 a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

memory/1964-113-0x0000000000C30000-0x0000000000C96000-memory.dmp

memory/1964-118-0x0000000000C30000-0x0000000000C96000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 0369a4f9e8adfd1f6f8e6c38b609d524
SHA1 f1b2a5d060d7411b90b150675dd07f490fea9f78
SHA256 e808eae38750114252f64dd9077cac1015d55bfd5847c8c6ad9672ca3304d5d8
SHA512 7e66bdb15214573be9f85af90dc111d92b7d9dd24318279282fbc5612d57fc0dc1d31c167abd7dc3ddd9c30a58879200cc3af298ec534b71d1f761a6c4dcbcef

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 e24a09532d6ae2ec0bd503eb33e2463b
SHA1 66e98f03e376c8bcc23c5d654296e62ae7e3429a
SHA256 91fe5b486a7f514bfad992e18312836fbd31edbed6d80a579ee857ef4970766c
SHA512 f1bc1ba7bb178ce9153b590139a4cdbe0be0ef31a0336f65108909cba2e1339ef9f819ab011f43f8a84cab8237e26cf5afa19152ee23cc7ae141a348f7e29f7d

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 6b4ee5bf44e795f3e895872b1751c79b
SHA1 d71405f09ba8923f888d5ed18ff875babade6d1e
SHA256 34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95
SHA512 a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

memory/1432-128-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 b979d1a3c92da9a981ce919a1e5388e8
SHA1 3df5678279741d46b237660302d90ec766d6229f
SHA256 8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d
SHA512 4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

memory/1964-130-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\System32\dllhost.exe

MD5 62d2af6a7267dcbf03195940327eefa0
SHA1 90ed6248bd95a73b3e4ea5117759de243f9ccc84
SHA256 8bbc0be656bb06ae9211c0fece9f403eafd33b558eb7656bd9a4f445e883ae58
SHA512 3b8e7aa44c8efdbd8a1310f6a119e3dce4f3f8f64eb2404cacc695ebf79d47057593098619ca35729bfdd9d7ccf4ec930f950d88747737bcbf27279b50d773a4

\Windows\System32\dllhost.exe

MD5 62d2af6a7267dcbf03195940327eefa0
SHA1 90ed6248bd95a73b3e4ea5117759de243f9ccc84
SHA256 8bbc0be656bb06ae9211c0fece9f403eafd33b558eb7656bd9a4f445e883ae58
SHA512 3b8e7aa44c8efdbd8a1310f6a119e3dce4f3f8f64eb2404cacc695ebf79d47057593098619ca35729bfdd9d7ccf4ec930f950d88747737bcbf27279b50d773a4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 b979d1a3c92da9a981ce919a1e5388e8
SHA1 3df5678279741d46b237660302d90ec766d6229f
SHA256 8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d
SHA512 4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

\Windows\ehome\ehrecvr.exe

MD5 1901b53af0d23c209122a68d28214803
SHA1 d91cecd84b4ee1ebdd85cdb107a5f36edd998836
SHA256 ae6cf08ed4a317d620cbc501e2ad0a9548bb4c46426d5104c1b61e67582d9c5d
SHA512 2f01c05c6d152b489420885919fee87f9033386d4e544a8be434c2469b0ef88de571d907e081f1052b3a28b5ca1cd6bb60e455fed8687e21de0eb7b94545b9c5

C:\Windows\ehome\ehrecvr.exe

MD5 1901b53af0d23c209122a68d28214803
SHA1 d91cecd84b4ee1ebdd85cdb107a5f36edd998836
SHA256 ae6cf08ed4a317d620cbc501e2ad0a9548bb4c46426d5104c1b61e67582d9c5d
SHA512 2f01c05c6d152b489420885919fee87f9033386d4e544a8be434c2469b0ef88de571d907e081f1052b3a28b5ca1cd6bb60e455fed8687e21de0eb7b94545b9c5

memory/1396-141-0x0000000000880000-0x00000000008E0000-memory.dmp

memory/1396-147-0x0000000000880000-0x00000000008E0000-memory.dmp

memory/1460-149-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1680-150-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1396-152-0x0000000140000000-0x000000014013C000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 04197581c3da0794b289eb5af86b3cad
SHA1 768240a96c11ee998b786a3837bce29f9b286f51
SHA256 f6bbc636ceb4a1a3cb9550ad85be3c861cc2740d384138285848a02b1c7abac2
SHA512 75206ffa3c55783f92a0be2c206b1f7c8fc08c5f55e80d2cf4c5deb5ce9610d7f45959b685c327c25ee61a737ad7ef580975e4989aa3a2b5932ffc13d9040adf

memory/2008-155-0x0000000000850000-0x00000000008B0000-memory.dmp

memory/1396-156-0x0000000001380000-0x0000000001390000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 04197581c3da0794b289eb5af86b3cad
SHA1 768240a96c11ee998b786a3837bce29f9b286f51
SHA256 f6bbc636ceb4a1a3cb9550ad85be3c861cc2740d384138285848a02b1c7abac2
SHA512 75206ffa3c55783f92a0be2c206b1f7c8fc08c5f55e80d2cf4c5deb5ce9610d7f45959b685c327c25ee61a737ad7ef580975e4989aa3a2b5932ffc13d9040adf

memory/2008-157-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1396-158-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/2008-164-0x0000000000850000-0x00000000008B0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 b979d1a3c92da9a981ce919a1e5388e8
SHA1 3df5678279741d46b237660302d90ec766d6229f
SHA256 8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d
SHA512 4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

memory/1732-173-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2012-171-0x00000000001F0000-0x0000000000250000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 010f93f5aab50b646c3ca66713142fce
SHA1 f863f8319e115d455f937f02ca8916614c7c0f6d
SHA256 982b05bfae9cca3f174ff8f1ca3f0e6e117878ee6f1f943d87cb50fad8ecde25
SHA512 44ad807b14d75193218d2abb267bf34815896b9a9ba5326b6f262cd357810173074abd6eba9c6d1dfc32a6142d9983c81ca6733608f9f5e0b904de257a23eeac

memory/1396-183-0x0000000001430000-0x0000000001431000-memory.dmp

memory/2012-186-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1732-187-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2012-185-0x00000000001F0000-0x0000000000250000-memory.dmp

memory/1732-189-0x0000000140000000-0x0000000140237000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 2c3a2f3e9d460757e85a6910214cf51b
SHA1 3ef0d033186b2ea387b48ae9053925ffc84c0d99
SHA256 64f592b1116faceac85b78cca0485229d6625e7e5107fb6a5f10f58124123d48
SHA512 60cfd5e3f49ce660a3df983651adc8952f6dddb3a79a3b9d6e9407cbcef57ad0db7ccdd19fd5a079cd2e58cf849ba61e5241bdd8f3083d884ef50cb6038b05b1

C:\Windows\System32\ieetwcollector.exe

MD5 2c3a2f3e9d460757e85a6910214cf51b
SHA1 3ef0d033186b2ea387b48ae9053925ffc84c0d99
SHA256 64f592b1116faceac85b78cca0485229d6625e7e5107fb6a5f10f58124123d48
SHA512 60cfd5e3f49ce660a3df983651adc8952f6dddb3a79a3b9d6e9407cbcef57ad0db7ccdd19fd5a079cd2e58cf849ba61e5241bdd8f3083d884ef50cb6038b05b1

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 9c3dbb3827767a0fd124f59f986314d8
SHA1 25c45e513fd42e2d5f3ec04d4a3b4646c20926d7
SHA256 06b2e2ccc03d1cb383c2fbb47f0d8f31d27bed55ea3f22284782cf0122bb2821
SHA512 47771186230711862a085b730fe601b1f9bb47ffff8ddd88666cbacf9d0df05f36654b32e70c7f2bf51b16d8b315b6b01c0cec48bba4e271616cc183656d397b

memory/920-211-0x0000000000400000-0x000000000065B000-memory.dmp

memory/1552-213-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1812-214-0x0000000000B30000-0x0000000000BB0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 b96d694fda3082a2c421f1490d0acfd9
SHA1 f8323e417bb91fdfa4bf23759813796956f660d3
SHA256 de74f877b07f198b5716b1ed55613a986e7a9eb1b4413a7ea5df5dd2539a98a0
SHA512 3591fe51129bd404a1d5aca1e78416bdb0eed82b44160911dad422e3b1c8fd36f834bca2b4fd80dc5539be4a7d9e5984d5532fa3b1c1ff773856bc420730f26e

memory/1712-218-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 b979d1a3c92da9a981ce919a1e5388e8
SHA1 3df5678279741d46b237660302d90ec766d6229f
SHA256 8f97fe40f1486af5e60897289624b71e88c0742f98db1e4537fd12592fbeff3d
SHA512 4bcdbdce7a8832d8743769a1a67ea9dd9224c3daf60085c2411bd9b6dd1e849f688c642f3db83bc8be530bf9327379b8e4dd1d8ed5f179122b2ede25ee379ebb

\Windows\System32\msdtc.exe

MD5 5c1f7c40e3ed031def394df76c8ddfb0
SHA1 bbafb03de0daa551c858ffc5407eb098f36bd82d
SHA256 38f76f103b0bfa8a2e8e767a78de8ab3378c9d91f4d8022f16747cdda628dc36
SHA512 2312e5bdc0beabf927d4aeb754c8656d6d4309fb1c1a11034d86c874a31523c68a88c95137bbedc881d76094ceddf03ef542bb4d42d0c2c3f729da21d758415e

C:\Windows\System32\msdtc.exe

MD5 5c1f7c40e3ed031def394df76c8ddfb0
SHA1 bbafb03de0daa551c858ffc5407eb098f36bd82d
SHA256 38f76f103b0bfa8a2e8e767a78de8ab3378c9d91f4d8022f16747cdda628dc36
SHA512 2312e5bdc0beabf927d4aeb754c8656d6d4309fb1c1a11034d86c874a31523c68a88c95137bbedc881d76094ceddf03ef542bb4d42d0c2c3f729da21d758415e

C:\Windows\System32\msiexec.exe

MD5 b7ef069b42be911556fa0fdc4f425bce
SHA1 2608109532dda8cc87afd81ebb62137731c68715
SHA256 0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5
SHA512 66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

C:\Windows\system32\msiexec.exe

MD5 b7ef069b42be911556fa0fdc4f425bce
SHA1 2608109532dda8cc87afd81ebb62137731c68715
SHA256 0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5
SHA512 66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

memory/2152-257-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2368-256-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2212-258-0x0000000140000000-0x000000014020D000-memory.dmp

memory/2012-255-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2096-251-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 b7ef069b42be911556fa0fdc4f425bce
SHA1 2608109532dda8cc87afd81ebb62137731c68715
SHA256 0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5
SHA512 66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

\Windows\System32\msiexec.exe

MD5 b7ef069b42be911556fa0fdc4f425bce
SHA1 2608109532dda8cc87afd81ebb62137731c68715
SHA256 0c05b26c63e510a41b13db8f385e6877d2f22e2d52585af34ed4f838382256e5
SHA512 66a254cbb7281b583fa635fe46eb19e2f09a2bade32c42f35e37a792b0ace518de6ab08bc65aa8fbddaae0086a43c19489f48fbe3621c8e13e87e694856a769c

memory/2368-273-0x00000000006E0000-0x00000000008E9000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 a056e08f179f5f3c37a7c0aa7c721f00
SHA1 940afc444d8f40bbd730aa034f6fcbe86ca640de
SHA256 838389c4bc4a74ec3fbf927fc6abc7b6e14fbb7f7d4b675e66acfc7cf2f537b4
SHA512 9664bc5d7d922af779e6990521f22f50b6ffaea7fed4ed6f612ad7458175770cbda0226b81a4fc43de61b99c5f5d94996ccebdcd2becd8d857d5267323b8c56d

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 e8adfc62085749b88db0443003592d84
SHA1 bdd25f668a1b7938b2aa7b0bb7d069f434f309ab
SHA256 e777e1a2aaea9a52b438fd3775a151c68b9f15c55580e2423b04c62e92b46c30
SHA512 073937ac5d0d9ad2e1a19292ff21904acbcf89c2402bff3c430894a5c559ef84bb96ec4806d469979beef8463f8d41381c7eb682ef4cd9e57c43f6ca278c238b

memory/1396-289-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2548-290-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2584-292-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 6feb0f281f9262a1e1870e79949b291b
SHA1 febe34516421fbc61c9750698e19cc046e3b7bce
SHA256 2f7f98293516ef0bca03fffa96846a6e5d1206e97e8b0d0223e9a16c130cf166
SHA512 2bad548d52fdff68a26f9278516562884d72462b0978233b39caad38e4e7978fb7c986e0d80ceef3a3a01ace7f5be40d2c6a705e63b6819ddd02f6ffa061cb6f

C:\Windows\System32\Locator.exe

MD5 b27a205e688b6d57eeea0829c96bb9b2
SHA1 0a72c163ebe7cdf898706e7160297adea5ce1774
SHA256 1a93ec40a2d28d6a3727a2d9b32e239622453d96e6d75bb4261b07df5f2ca977
SHA512 60eb8ebc23ea1a056c40cbd80c5450202c19ebad88998884c8bfeb140f4e6993f71ab05ce16b5b2ea6186907a10295fb8f9b838b8700db18dd1a9b488160da6a

\Windows\System32\Locator.exe

MD5 b27a205e688b6d57eeea0829c96bb9b2
SHA1 0a72c163ebe7cdf898706e7160297adea5ce1774
SHA256 1a93ec40a2d28d6a3727a2d9b32e239622453d96e6d75bb4261b07df5f2ca977
SHA512 60eb8ebc23ea1a056c40cbd80c5450202c19ebad88998884c8bfeb140f4e6993f71ab05ce16b5b2ea6186907a10295fb8f9b838b8700db18dd1a9b488160da6a

\Windows\System32\snmptrap.exe

MD5 7a37e7cab456ea1a5746518401a62421
SHA1 3ff6a431b636bb575f6f9ba4ff9cebd73de90b84
SHA256 30022d08135fc937cf2cdac9f9f3e7b68242da388515d98b5f21b916b4b6ad78
SHA512 4cb8e71407a72aaa8dbe3f3c98dba95e9c4f2e3f0ee139d671345eb7f64622be296c67910f90e249c3d5b47953172ef78e6ca39a8e7b7b8dd1b790259ebea11e

C:\Windows\System32\snmptrap.exe

MD5 7a37e7cab456ea1a5746518401a62421
SHA1 3ff6a431b636bb575f6f9ba4ff9cebd73de90b84
SHA256 30022d08135fc937cf2cdac9f9f3e7b68242da388515d98b5f21b916b4b6ad78
SHA512 4cb8e71407a72aaa8dbe3f3c98dba95e9c4f2e3f0ee139d671345eb7f64622be296c67910f90e249c3d5b47953172ef78e6ca39a8e7b7b8dd1b790259ebea11e

memory/2008-312-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2680-315-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2708-318-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1812-320-0x0000000000B30000-0x0000000000BB0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 8678d3498696adf8705f9d20676667fd
SHA1 6341dfa26aa299deb4702eeb81df208ffb15aab5
SHA256 d13c1b2613910e084bfae2f3cca503dcbc58b232ee6deda99dccf953e3e2e46a
SHA512 faa8f630a615a62cacfa47a3dc4422f6a7006b36947a6889f48a659e97593a5f10e61c8e484ad0cbb1ea6a50a772bc408753f63e7e3f29344f4142ca2d560826

memory/2800-321-0x0000000100000000-0x00000001001ED000-memory.dmp

\Windows\System32\vds.exe

MD5 8678d3498696adf8705f9d20676667fd
SHA1 6341dfa26aa299deb4702eeb81df208ffb15aab5
SHA256 d13c1b2613910e084bfae2f3cca503dcbc58b232ee6deda99dccf953e3e2e46a
SHA512 faa8f630a615a62cacfa47a3dc4422f6a7006b36947a6889f48a659e97593a5f10e61c8e484ad0cbb1ea6a50a772bc408753f63e7e3f29344f4142ca2d560826

C:\Windows\System32\VSSVC.exe

MD5 2cf5415720bc602481a5b01864ed3749
SHA1 6edae9b947a11d22713c8181f7aa00c0d446fd63
SHA256 d348d9b441664aa2192ee601d96cec2f11280f3a3351fdc8e012a05ae7780986
SHA512 ede7e60130b006c00a136e3d3dac4ea3bb825448cc81285c122beb2eab85a16aca0c340d970e78724839bfa74574bdae631950401e523bb10ab566eca28c761b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 6b4ee5bf44e795f3e895872b1751c79b
SHA1 d71405f09ba8923f888d5ed18ff875babade6d1e
SHA256 34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95
SHA512 a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

C:\Windows\System32\wbengine.exe

MD5 3ca5409e353e9b24a1b9a8ff6bfc69e4
SHA1 5789c3c4ce4eda9970615bd46267d93bd4a758e2
SHA256 1e9cbaebb6173d1e50354de8e97d693565692535d70feb98ce80259845ba7858
SHA512 82889ad803c1e1f01561969869019ef6b70c1af4bd06d226bd55f799056e5184359d8cfee5be18903b32a4d56feb639d7512737476db2f1cf5a1cceb421b261f

\Windows\System32\wbengine.exe

MD5 3ca5409e353e9b24a1b9a8ff6bfc69e4
SHA1 5789c3c4ce4eda9970615bd46267d93bd4a758e2
SHA256 1e9cbaebb6173d1e50354de8e97d693565692535d70feb98ce80259845ba7858
SHA512 82889ad803c1e1f01561969869019ef6b70c1af4bd06d226bd55f799056e5184359d8cfee5be18903b32a4d56feb639d7512737476db2f1cf5a1cceb421b261f

memory/2908-356-0x0000000100000000-0x000000010026B000-memory.dmp

memory/2984-358-0x0000000100000000-0x0000000100219000-memory.dmp

memory/3016-360-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2120-362-0x0000000100000000-0x0000000100202000-memory.dmp

\Windows\System32\wbem\WmiApSrv.exe

MD5 b2caaa9380afc519a92cce028415e8b1
SHA1 12f27ccce29a251b2e9ce53e8c0d7f5022d0c085
SHA256 95409632c6fd58b1861421a9d68f243edf3362e207df71ecda2b4d2ba4b7416c
SHA512 e30958e598b3f04aca10617ead80c0d2a3c651acf0c2d4412674acaa68d3c7995aacb2a22af9aaa33842071af14920f6df862f45c4ed6c5a647723194438bbbf

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 b2caaa9380afc519a92cce028415e8b1
SHA1 12f27ccce29a251b2e9ce53e8c0d7f5022d0c085
SHA256 95409632c6fd58b1861421a9d68f243edf3362e207df71ecda2b4d2ba4b7416c
SHA512 e30958e598b3f04aca10617ead80c0d2a3c651acf0c2d4412674acaa68d3c7995aacb2a22af9aaa33842071af14920f6df862f45c4ed6c5a647723194438bbbf

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 e559b478dec21c1ae0c42e043622e1db
SHA1 add8d9f1af8b090addf15899ce7e9d9a64f62dfa
SHA256 cc71155a37b2919956edfada333c7d6ea942f0263afea632802338eb3dd01e27
SHA512 b5aa9d343f18dbef84b0378649c12c36737452cd1cefc3b3de582b4df162680ffa04ee548a7a9580e1315e77a98b135489ff005bef9a9ce19847d0064abc4507

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 e559b478dec21c1ae0c42e043622e1db
SHA1 add8d9f1af8b090addf15899ce7e9d9a64f62dfa
SHA256 cc71155a37b2919956edfada333c7d6ea942f0263afea632802338eb3dd01e27
SHA512 b5aa9d343f18dbef84b0378649c12c36737452cd1cefc3b3de582b4df162680ffa04ee548a7a9580e1315e77a98b135489ff005bef9a9ce19847d0064abc4507

memory/2168-386-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2500-388-0x0000000100000000-0x000000010020A000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 31efce3db60fcdb8a10391b563434ae3
SHA1 91ff7aa5c20314e92c4719b70be8db70cbc7a7c3
SHA256 b0d7c30e4d1b14990074215f6f04baa292ac0ea9d4ceb1dd32dadada8ba7e1d3
SHA512 7b7ad060be470b4404c35e026e89e1901465bae3db94a02fa3345a5e410f4493f942a2a202bda208b1a122b4fb2c1d76a578c5303a384602b39d0cdb4cac83b7

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 e559b478dec21c1ae0c42e043622e1db
SHA1 add8d9f1af8b090addf15899ce7e9d9a64f62dfa
SHA256 cc71155a37b2919956edfada333c7d6ea942f0263afea632802338eb3dd01e27
SHA512 b5aa9d343f18dbef84b0378649c12c36737452cd1cefc3b3de582b4df162680ffa04ee548a7a9580e1315e77a98b135489ff005bef9a9ce19847d0064abc4507

memory/2652-424-0x0000000100000000-0x0000000100123000-memory.dmp

memory/1732-496-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1712-497-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2368-499-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2152-500-0x0000000140000000-0x0000000140205000-memory.dmp

memory/2368-501-0x00000000006E0000-0x00000000008E9000-memory.dmp

memory/2584-502-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2800-503-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2908-508-0x0000000100000000-0x000000010026B000-memory.dmp

memory/3016-510-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2984-509-0x0000000100000000-0x0000000100219000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 6b4ee5bf44e795f3e895872b1751c79b
SHA1 d71405f09ba8923f888d5ed18ff875babade6d1e
SHA256 34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95
SHA512 a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

memory/2120-513-0x0000000100000000-0x0000000100202000-memory.dmp

memory/1552-514-0x0000000140000000-0x0000000140205000-memory.dmp

memory/3004-541-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2168-542-0x0000000100000000-0x000000010021B000-memory.dmp

memory/2500-543-0x0000000100000000-0x000000010020A000-memory.dmp

memory/2008-546-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3016-558-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 6b4ee5bf44e795f3e895872b1751c79b
SHA1 d71405f09ba8923f888d5ed18ff875babade6d1e
SHA256 34a7e6634031136969668be3b3124ce7de4d1a58b80a3f89ae24119a591d4c95
SHA512 a3cb24fa7ddd70439841816801704f699cd24b30a84d37e54db4a7811ed9a5d0483684a99da42c885e826b787807d7a4e3fcc484b8733107c9b1de4d70a62635

memory/1992-606-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1396-611-0x0000000140000000-0x000000014013C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-04 11:55

Reported

2023-05-04 11:57

Platform

win10v2004-20230220-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

Signatures

DarkCloud

stealer darkcloud

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\68e665fc9a2815e1.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3304 set thread context of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fd8d833907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a2c4c33907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000232b8a33907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008496b332907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c58f632907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045a09f33907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4153c35907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9aba732907ed901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3304 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 3304 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
PID 4336 wrote to memory of 4448 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4336 wrote to memory of 4448 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4336 wrote to memory of 2720 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4336 wrote to memory of 2720 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe

"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 164.113.223.173.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 14.103.197.20.in-addr.arpa udp
US 8.8.8.8:53 42.220.44.20.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 13.89.178.27:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 52.152.110.14:443 tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 cvgrf.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 52.152.110.14:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.152.110.14:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 245.233.251.72.in-addr.arpa udp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp
US 8.8.8.8:53 81.76.21.199.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp

Files

memory/3304-133-0x0000000000950000-0x0000000000ACC000-memory.dmp

memory/3304-134-0x00000000058C0000-0x0000000005E64000-memory.dmp

memory/3304-135-0x00000000053B0000-0x0000000005442000-memory.dmp

memory/3304-136-0x0000000005350000-0x000000000535A000-memory.dmp

memory/3304-137-0x0000000005570000-0x0000000005580000-memory.dmp

memory/3304-138-0x0000000005570000-0x0000000005580000-memory.dmp

memory/3304-139-0x000000000AD30000-0x000000000ADCC000-memory.dmp

memory/2768-140-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2768-143-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2768-144-0x00000000016A0000-0x0000000001706000-memory.dmp

memory/2768-149-0x00000000016A0000-0x0000000001706000-memory.dmp

memory/2768-154-0x0000000000400000-0x000000000065B000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2560f3082cacd83143b2333a01c89d6e
SHA1 3ddda3a1972048044c7f87934c2f9351c9b2a9c1
SHA256 6a2067a3ee7d7d8653faf224f3c834340b910c57d8c1246ed2f46279168ebff5
SHA512 3c9aa4769f967e45b2cbe46583467c3b05761ac0d8084ade7f6c8538e5d74f85bad1b7e3c459772727d91c37a30392093d6844c4d9247a369f763fe184f6c238

memory/2512-157-0x0000000000640000-0x00000000006A0000-memory.dmp

memory/2512-163-0x0000000000640000-0x00000000006A0000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 6863035026b6522cef81b2349798a0ce
SHA1 3c8d97dfd6e47513213907b6c9b354b13f3de166
SHA256 89d24eb9282e9d2ffb59a40c2204febca1efa4bb38ddd2b5880d088d8ea222f1
SHA512 904a5333ad795c6ea0d2f677c236b9073fe0d0f839909381bfd05d5f2a18a8667806cedd7f98c5144d12c8d4da01862eed722668736da5d72bbb053c52ad5c9e

memory/2156-169-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/2156-175-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/2512-178-0x0000000140000000-0x0000000140201000-memory.dmp

memory/2156-179-0x0000000140000000-0x0000000140200000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 09d4036257c40bde3d30cc37461efdba
SHA1 28d14e050d1bd8bfe818fad2eadb3d61e873e139
SHA256 539fad92159cfb983e8cc56aa83b04bb7854d31fbdeb1fe85f66948a34029f25
SHA512 67906ec36ec57275cbf295bd6a8bc06a5e08e38b3011de06231adff902098ef5292dc71a75cec919b27383ea19189e9172ebed00c4bcc9f0e411bc3dc0b5fb4a

memory/672-181-0x0000000000A10000-0x0000000000A70000-memory.dmp

memory/672-187-0x0000000000A10000-0x0000000000A70000-memory.dmp

memory/672-190-0x0000000000A10000-0x0000000000A70000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 c8073bc7ad810c28bb802e39ab73915b
SHA1 bcd3345ff3c9033a3f9c7f9d732806af4d030ae4
SHA256 d3a30517c85d2c61a15273688fd15bf47f8bccd21127937bc994c68678bc7251
SHA512 5d680ab59525959180d30ca5e7ab718d88d07579eb5ca7f9682a42a29264ed4a0093ba4daa7fb03134448025e4a4c3d7020f4db401629bca4031a05ab545e61f

memory/672-193-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4392-194-0x0000000000C30000-0x0000000000C90000-memory.dmp

memory/4392-200-0x0000000000C30000-0x0000000000C90000-memory.dmp

memory/4392-203-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 9a614f1a2fc5ef7839f5becdbc6a3c1a
SHA1 029c4e42118e56b729894416b06acaeafed43115
SHA256 c4054a8a89968ec98da72ca8656ee675e0f840e92b777f66d199fbc4d2cc54aa
SHA512 51b7646910aba0095b84fee8554b19eb2892a539a86ac92adec46f2aab4f7c51298f84e21a728860741adff213508a757cee432f267c46fda09a29fe189fffc7

memory/1336-205-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1336-211-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/1336-213-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a85b5c97d5850fc5ec1657349876b548
SHA1 82d0b6c8b569300b026969ac785ba1171d69ff9a
SHA256 08ad2cd28bd8659550ec9aa484278aa5e9dd73d1cddeb1cfabc94ea995618ac1
SHA512 b2dd98c0775cace8aea5d9bbaa8cfd37973bd67bbc7721b5a260be4356b8a8d342342f228bdf53c3a2d3764c1bc8bd1a32ce88e9e08365a157cf16361238c340

memory/3488-217-0x0000000140000000-0x0000000140221000-memory.dmp

memory/3488-216-0x0000000002050000-0x00000000020B0000-memory.dmp

memory/3488-223-0x0000000002050000-0x00000000020B0000-memory.dmp

memory/3488-226-0x0000000002050000-0x00000000020B0000-memory.dmp

memory/3488-228-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 261183529dda4f83247af8c9a89aafea
SHA1 bcd7afdaf4b96049a9c095d7bd349faedf378ba5
SHA256 e99dc6f3f48981899d4b13a8a8973507a184aa4860c843cb24e8e1b22e3eb63a
SHA512 fe7fb714e10b6089b912304a250be870459cc5d7d0dd58f03d45a5cde4154b135f801812252bd239e234fe2dcd92545677bef70a6a1a5c45035bd286e7399832

memory/3448-231-0x0000000140000000-0x0000000140210000-memory.dmp

memory/3448-232-0x00000000007D0000-0x0000000000830000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 ec99b81d7d3197e4d7f8fa20f1b8c613
SHA1 0f36ae90e8ab65f4169c693f51fabafa16e1d736
SHA256 482db57bb12d4815f81a1caff91447b825be6827eced034d88ed1ae9a9584cc4
SHA512 8ec2765b212ea7d50d62f2c5df320317b44f3b7c4722245498584922aac138c71e05497c5bb27e58ad1aff01ad203fd12cb88112cdf19ac7aef39d8fe2267073

memory/4264-254-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 adf3ce14cb89bc6cbc96532d21cf2ad4
SHA1 66d4bf7cad62287ec17a38557a23daf362b8511b
SHA256 54660ab1ddd1555c79b5858001a410985c7b7915e0df596c30b8bd310c45bc93
SHA512 25d2e462f08927a5e01646e6e45fd091d29e8f3d8dd10fb3f6caabf94a61e72979dfcf95495555b869ad99593587b7beaf3b44bf0b8a73818dfdb2944aab0967

C:\Windows\SysWOW64\perfhost.exe

MD5 7d047f86a0d9ea2f34ac9451bee9010b
SHA1 b37084d9f342e70b2ba28a78bd2b3f6dba6fbb19
SHA256 1719c4babafde3747130a23aa9523e19b0ab74bff307af8e5a4a52feaef6ce1e
SHA512 3f735be0db8615e4479faf27d0662a4a0054c9d0a209e9f731652320fc7778d4bc1ea7118b3bbf0560ee6cb43601e135a5ada6d0f0784312bbb856fcdb6d8175

C:\Windows\System32\Locator.exe

MD5 e69bed59ca73faf98194a26ff951ed8f
SHA1 dbdc6de7abcefacc83c309927e87592e0ca26ea1
SHA256 2f7879f3ff71b5d349625c6b3013c1741a1250ab78d8cd553fea1f512464d119
SHA512 f8b1b771b53373460307c708f2b52d3309cb476b82dc830fac89a7fc22cd43f1a6dd6ca5d22413151dbea1a19c095beaf76ba8a9b21ba8ef924379b4cbd4f540

memory/2768-285-0x0000000000400000-0x000000000065B000-memory.dmp

memory/5020-286-0x0000000140000000-0x0000000140202000-memory.dmp

memory/2032-287-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/3792-288-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 725183e126588c1de3efe6cedfb27689
SHA1 f9e98b964ce2e08455a6c68c9f76a95d091b08d8
SHA256 f4b5fbd0a010aced5cdb8fe00c658327738affc8ae19a3eaf2a0b74db81ff2f6
SHA512 47ea6844f7dc21173f9f9d3055d7b8aec65d1be8f1b252d39466feccc2116824ee73781b27e5c62fbad131bd6222ba487eee58de4fb2c5e2b40378f90c969ec8

C:\Windows\System32\snmptrap.exe

MD5 959bfe425d6c45ce99349a3b7978af0b
SHA1 2cac49fec0a5f76b909a2782a688992d9651cd3a
SHA256 d0aac24a64dc4345bcc829ad2f2b509a56f5825ca57971995e0ef18b04812d1f
SHA512 7eeea7e9ea45aa84ac1e69e8e8b54145a15f4b341ae13a379d7c2549f7420cd5f12ad27647ecce614ea3c9dc8f10452897795fb453004d2610ad033166307952

memory/1980-309-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1772-310-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 76691b56eb59173df91eadac312f2a28
SHA1 b34c23a8e3faa7115ec23c0f904d62c0f018d75d
SHA256 11ec235c905a1c1cd078f61f40c87866f87f07ce258f9b9fd52e92fb49e43002
SHA512 d3b371b24bac31755b281d0d53f0948f3f785ea3fe84482bfc3607f7b4830a6a580916fbed86f01f6fa68b9f0da06757e7672193a611c2446a392e53f5e78b31

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 f8bbe6757c54ee3d29e4131d37c2edf4
SHA1 58ae9a360a3abbdbeaec47672ee2e2d8de7de866
SHA256 c55efa83980bd90f2c9b0f1721392a690b286c03ae26cd3a78c6680e31ce7812
SHA512 513851f28c67457642603dff61397c4aeee98d5f9ca1977868e068d1d9af67294b3b6e1173bd98b52765a32e0d6e67db0d1aeb83c77b864ba822a2db9dc38e09

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 f8bbe6757c54ee3d29e4131d37c2edf4
SHA1 58ae9a360a3abbdbeaec47672ee2e2d8de7de866
SHA256 c55efa83980bd90f2c9b0f1721392a690b286c03ae26cd3a78c6680e31ce7812
SHA512 513851f28c67457642603dff61397c4aeee98d5f9ca1977868e068d1d9af67294b3b6e1173bd98b52765a32e0d6e67db0d1aeb83c77b864ba822a2db9dc38e09

memory/3652-330-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4392-328-0x0000000140000000-0x0000000140237000-memory.dmp

memory/3756-332-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 9e3b210389c184f139c3dca846fb22f4
SHA1 1c67499f8d1020a56454a585ecbfbd250afcd07a
SHA256 77d8a165d9fbb66c22bfc485b579b7a21989e5afa964d8079ef68d2d2aadf085
SHA512 4e784801fdd38c0ec3f6b88c0db7f4e1802dac355db86664251efd2e9a3ce6af612330cd1d667489ef21f7e0fdedbcad7cec8e82baf215b257e9bcd2d13d741a

C:\Windows\System32\AgentService.exe

MD5 3b1d8b61b4d5bf4b9568c9c921b4c75d
SHA1 076e619f038c0815342338739b759a64eb4a3cd2
SHA256 9fe14d62aba56c4428f95bd83575d3b4c74d47ed501d0c3611a794fd868fa852
SHA512 f7871b46d107867f7042b44e879068759d97001c049799bc929da978b268f42c1c072d2724265cf70dee663a747a1a4365ce110be9f40334d1c771d689a4195e

memory/1336-358-0x0000000140000000-0x000000014022B000-memory.dmp

memory/5024-359-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3192-360-0x0000000140000000-0x0000000140239000-memory.dmp

C:\Windows\System32\vds.exe

MD5 15c7919d587d1b37842e2d6607035bdb
SHA1 e00ff9e8d1a8f854feb4bd1859f73e0e9aaec923
SHA256 42792d2abfbcaf74b0494bebcebad705f8370bcb9bdfb1639a40dbea9d7d8968
SHA512 aacd62b85d569b85f6d93d0f473f1622e2b7b61970585b08413c5ba91088fd8c6f7f3a57a23a2aa0ad72e39010f4bd8dd1cdd9d1a747f0659601195c09705a30

C:\Windows\System32\VSSVC.exe

MD5 cea109f394459de729501b368853167c
SHA1 b865de4f867ec3fc4fddab405c671f0ff977942c
SHA256 fdf23eca6ebb4ffe0f6389df0f7b0cbfd05a8dd5b88ce41a3c3201a1f1d0fe6e
SHA512 2ca0e4aa75b17ced54e99d91097605429c9fd6d60fda0db623dcc6233386468da4325736a06e29f1d7a4241b425a5192f4708bf64f9cd4f858a08c17fae5e892

memory/3484-372-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3592-373-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 8e96cbff95fbafa748ae27d723517be9
SHA1 078e53d2e6702a939931b628aad42bab0f8c640e
SHA256 a86391753a7cf544041915967378b7dafe2c3e84aef1dbc0441bb60b81e68403
SHA512 1aeca7561091c22feb0f6f9a7a3e540af639f5323aba6676aa3e58921f587230c405b93f5ddb7c51bc4f2b7a8c4ac57714632b5ee93f67c7c150da81ca64b3ea

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 96b5ce3ad00f3c33c978d6baa0296ddc
SHA1 60ef74a4c2f1ecf5c8fab0b466679c1350b9ab12
SHA256 16904731c8f852d69ab50fe8ad69e7aa35261019cf4e28fc31621db52fce3f18
SHA512 f067cbf47ff91a7eae5c93de78d4a87955cdf8384d3a20215c4ad51dd58fcd989bf2f3988071b3854b4476e47fbf49d3e72ac06f57b69f1b2d0661d21f408a18

memory/632-400-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1100-403-0x0000000140000000-0x000000014021D000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 8cf95c2d01377dcb931efa9218faf180
SHA1 592b808748a1f374bdc9bf29bf014e52c4870154
SHA256 7ad78b30003fa1466af8c3edc32cc161d87b6719199360ec3417e7cf8ee8d658
SHA512 9574bc6ae2e41eba20321533f05849535edbdd142321b03e5135c61a58da7f811608fdda32e340dd8bb7b814dae97d0bfa316f6722fd401cfa3bc3d9e66f1288

memory/3448-456-0x0000000140000000-0x0000000140210000-memory.dmp

memory/4336-457-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1980-553-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/1772-591-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2720-592-0x00000192552C0000-0x00000192552C1000-memory.dmp

memory/2720-594-0x00000192552E0000-0x00000192552F0000-memory.dmp

memory/3652-599-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3756-601-0x0000000140000000-0x0000000140259000-memory.dmp

memory/3592-628-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2720-629-0x0000019255520000-0x0000019255530000-memory.dmp

memory/1100-662-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2720-663-0x0000019255520000-0x0000019255530000-memory.dmp

memory/4336-706-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2720-708-0x00000192555F0000-0x0000019255600000-memory.dmp

memory/2720-707-0x00000192555F0000-0x0000019255600000-memory.dmp

memory/2720-709-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-710-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-711-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-751-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-752-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-753-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-754-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-755-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-763-0x00000192552C0000-0x00000192552C1000-memory.dmp

memory/2720-764-0x0000019255520000-0x0000019255530000-memory.dmp

memory/2720-767-0x0000019255520000-0x0000019255530000-memory.dmp

memory/2720-768-0x0000019255520000-0x0000019255530000-memory.dmp

memory/2720-788-0x00000192555F0000-0x0000019255600000-memory.dmp

memory/2720-787-0x00000192555F0000-0x0000019255600000-memory.dmp

memory/2720-790-0x0000019255670000-0x0000019255680000-memory.dmp

memory/2720-789-0x00000192555F0000-0x0000019255600000-memory.dmp