Malware Analysis Report

2025-06-16 06:16

Sample ID 230505-dz7tmaab4x
Target 8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.zip
SHA256 aea877c9675127df11c8c027d4da31c73a58c8021bd75902dcd01dd924dbf875
Tags
darkcloud stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aea877c9675127df11c8c027d4da31c73a58c8021bd75902dcd01dd924dbf875

Threat Level: Known bad

The file 8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.zip was found to be: Known bad.

Malicious Activity Summary

darkcloud stealer spyware

DarkCloud

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy WMI provider

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Checks SCSI registry key(s)

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-05 03:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-05 03:27

Reported

2023-05-05 03:29

Platform

win7-20230220-en

Max time kernel

27s

Max time network

30s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.zip

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-05 03:27

Reported

2023-05-05 03:29

Platform

win10v2004-20230220-en

Max time kernel

93s

Max time network

99s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.zip

Signatures

N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.zip

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 52.152.110.14:443 tcp
IE 13.69.239.73:443 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
NL 173.223.113.164:443 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2023-05-05 03:27

Reported

2023-05-05 03:30

Platform

win7-20230220-en

Max time kernel

126s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

Signatures

DarkCloud

stealer darkcloud

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\76fcb2eb6401d5da.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0036E6D1-708F-4482-BED1-A07F86D984BD}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{0036E6D1-708F-4482-BED1-A07F86D984BD}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1996 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1996 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 1572 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1572 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1572 wrote to memory of 1900 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1572 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1572 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1572 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2068 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2232 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2136 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2532 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2764 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2632 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2632 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2632 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2632 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 2956 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1172 wrote to memory of 3052 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 160 -NGENProcess 164 -Pipe 174 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1f0 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 254 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 250 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 24c -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 250 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 244 -NGENProcess 26c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1f4 -NGENProcess 1fc -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 264 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 274 -NGENProcess 244 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 268 -NGENProcess 27c -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 26c -NGENProcess 280 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 244 -NGENProcess 284 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1fc -NGENProcess 280 -Pipe 1f4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1dc -NGENProcess 28c -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 27c -NGENProcess 280 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 26c -NGENProcess 274 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 268 -NGENProcess 1dc -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 298 -NGENProcess 29c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 1fc -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 28c -NGENProcess 29c -Pipe 280 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2a8 -NGENProcess 284 -Pipe 2a4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 27c -NGENProcess 268 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2ac -NGENProcess 1dc -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1996-54-0x0000000000990000-0x0000000000B2A000-memory.dmp

memory/1996-55-0x00000000022E0000-0x0000000002320000-memory.dmp

memory/1996-56-0x00000000004F0000-0x0000000000502000-memory.dmp

memory/1996-57-0x00000000022E0000-0x0000000002320000-memory.dmp

memory/1996-58-0x0000000000530000-0x000000000053C000-memory.dmp

memory/1996-59-0x0000000008720000-0x0000000008872000-memory.dmp

memory/1996-60-0x000000000B010000-0x000000000B1DE000-memory.dmp

memory/2012-61-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2012-63-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2012-62-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2012-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2012-66-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2012-68-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2012-74-0x00000000002B0000-0x0000000000316000-memory.dmp

memory/2012-69-0x00000000002B0000-0x0000000000316000-memory.dmp

\Windows\System32\alg.exe

MD5 dfd216f5d6ba9e88ca4131931a7fe04b
SHA1 5ffcd0ec2394e42bbd33310fda97a6ec98c37386
SHA256 5adb2b547e49020a26e115097da41b4ef6cb93d45844468f8b2df8e28daba031
SHA512 1f59f538349c43a425515db040491e5c9e908815463b9170403b4d0fd85848e893b47aa9aece3a41289606197530cbd8a9137af35556e3be4ab3d33eba98f5ff

C:\Windows\System32\alg.exe

MD5 dfd216f5d6ba9e88ca4131931a7fe04b
SHA1 5ffcd0ec2394e42bbd33310fda97a6ec98c37386
SHA256 5adb2b547e49020a26e115097da41b4ef6cb93d45844468f8b2df8e28daba031
SHA512 1f59f538349c43a425515db040491e5c9e908815463b9170403b4d0fd85848e893b47aa9aece3a41289606197530cbd8a9137af35556e3be4ab3d33eba98f5ff

memory/1188-82-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/1188-88-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/1188-95-0x0000000100000000-0x00000001001FB000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 6ee42d8e1dce065449c2165dfc4a4a96
SHA1 da8d1b060d827e696f8b703bcc8478016219c220
SHA256 bff09423e53c35fc3e281bf0735304407bc13a2234211ededd8f33aaf49ce298
SHA512 9f10691f040d133f65803a106ed98890dd248c8984e8167b99f54fa7a3c9e0c19536cd1bbcc78520779d6c90833d0929982edf37913192e4ab783c3b79389779

memory/2012-93-0x0000000000400000-0x000000000065B000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 6ee42d8e1dce065449c2165dfc4a4a96
SHA1 da8d1b060d827e696f8b703bcc8478016219c220
SHA256 bff09423e53c35fc3e281bf0735304407bc13a2234211ededd8f33aaf49ce298
SHA512 9f10691f040d133f65803a106ed98890dd248c8984e8167b99f54fa7a3c9e0c19536cd1bbcc78520779d6c90833d0929982edf37913192e4ab783c3b79389779

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 dacac3c77b77f75b14dae511ed6b186f
SHA1 7f10a64a061d05f1e6f7b636da36781e10b0e51f
SHA256 80144d8605f5f546f1a1301ae41ba8b5bed1052d46924e5b147c7a27060bf1b4
SHA512 2e49fb4adbbe3ab179abdb9c0f9c741b46e902a7f9ef885bac27589c210a06963cc4eb525412f903abdb953b94c5a6632ed3173cd346e6d24b25b0c2f4004369

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 dacac3c77b77f75b14dae511ed6b186f
SHA1 7f10a64a061d05f1e6f7b636da36781e10b0e51f
SHA256 80144d8605f5f546f1a1301ae41ba8b5bed1052d46924e5b147c7a27060bf1b4
SHA512 2e49fb4adbbe3ab179abdb9c0f9c741b46e902a7f9ef885bac27589c210a06963cc4eb525412f903abdb953b94c5a6632ed3173cd346e6d24b25b0c2f4004369

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 ec5ea4531b686c8e04994e9c57749858
SHA1 88955aa9597fe4b0e143715e845d9427b4491c94
SHA256 ffc466dd523f3edaa25d9604a60ec2e0d7baf4acc240ecb1d1172ae3e1ab7c5b
SHA512 9056ddffae49c63ff25a9b46205f945ff04dddd05e9e13c29584d20f003f7273d74261bab70550c0c1b73efd2c611327e28d9f6b0283fdd35909661c8b8121fa

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 14efa9ac8d934019bcfa3e018541d1e6
SHA1 0331e18aa82146b7831fb712f148a94a0b815f70
SHA256 d8e3dbd01c2c465c7677eada21021357c65b7ebb8fa7181f5457ffb9e307ebf1
SHA512 27fc0deb0d000a35891380b2b6b2b15411a795e49e3149ead612bf2f9b53074496ca4c632bf99383fb10e59bc9c5d97ffec3707affe4dea1eb696fba53b956da

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 14efa9ac8d934019bcfa3e018541d1e6
SHA1 0331e18aa82146b7831fb712f148a94a0b815f70
SHA256 d8e3dbd01c2c465c7677eada21021357c65b7ebb8fa7181f5457ffb9e307ebf1
SHA512 27fc0deb0d000a35891380b2b6b2b15411a795e49e3149ead612bf2f9b53074496ca4c632bf99383fb10e59bc9c5d97ffec3707affe4dea1eb696fba53b956da

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 14efa9ac8d934019bcfa3e018541d1e6
SHA1 0331e18aa82146b7831fb712f148a94a0b815f70
SHA256 d8e3dbd01c2c465c7677eada21021357c65b7ebb8fa7181f5457ffb9e307ebf1
SHA512 27fc0deb0d000a35891380b2b6b2b15411a795e49e3149ead612bf2f9b53074496ca4c632bf99383fb10e59bc9c5d97ffec3707affe4dea1eb696fba53b956da

memory/1900-113-0x0000000010000000-0x00000000101F6000-memory.dmp

memory/1048-114-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 ee4b9401b3819cb9323aaacec4223513
SHA1 89c69cab70f12b84c2ed338780dfc13dfe677d17
SHA256 280c8b1bc1ce9dc292d9f5bd1cade6225af0ba20901c01e690d394c417c21fb4
SHA512 604bc93eafaeb7cf4c2e4066795ffa1f4e8b1d7d357350273fd157678205939bed7b6728a4654667cfa68175d2f9a452fe8b4e3a2d758cefa94574c34c35b678

memory/2028-116-0x0000000010000000-0x00000000101FE000-memory.dmp

memory/1172-118-0x0000000000600000-0x0000000000666000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/1172-123-0x0000000000600000-0x0000000000666000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 4eb1505922c62079f6b60f2fc02f8ed1
SHA1 0d88fddc3147f96e882b7d7d8b5169d88293a310
SHA256 77bc368796c1530da4437e6e8d88709f524b94aab0ebdd818f8c9e403a7908f5
SHA512 774e4544bff369df927360bc34fddc238e8a7073845098368f92a6535c1803fb626e67eea2587ed743d02eeeb505ef317e8ba196641cfd953c4cf189eef7875e

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 4eb1505922c62079f6b60f2fc02f8ed1
SHA1 0d88fddc3147f96e882b7d7d8b5169d88293a310
SHA256 77bc368796c1530da4437e6e8d88709f524b94aab0ebdd818f8c9e403a7908f5
SHA512 774e4544bff369df927360bc34fddc238e8a7073845098368f92a6535c1803fb626e67eea2587ed743d02eeeb505ef317e8ba196641cfd953c4cf189eef7875e

\Windows\System32\dllhost.exe

MD5 522fa3ed0cd9790ba5ce8b7ec93218ae
SHA1 2d1b6a17287a8c16d3cbf2c26371f45ff59e5398
SHA256 00af1306e86de3b9263eb868d550f957edf97dd3d2ec8ce358be8d26f4c6a5aa
SHA512 f9f703b0c42213d35847705b1f0b099450de63bfe56cff7f851bdc07dc1e9138e7fc473e36fa55342027891ee790e72212e839369a91c034ab8ee047c1e5f398

C:\Windows\System32\dllhost.exe

MD5 522fa3ed0cd9790ba5ce8b7ec93218ae
SHA1 2d1b6a17287a8c16d3cbf2c26371f45ff59e5398
SHA256 00af1306e86de3b9263eb868d550f957edf97dd3d2ec8ce358be8d26f4c6a5aa
SHA512 f9f703b0c42213d35847705b1f0b099450de63bfe56cff7f851bdc07dc1e9138e7fc473e36fa55342027891ee790e72212e839369a91c034ab8ee047c1e5f398

\Windows\ehome\ehrecvr.exe

MD5 fcdce10660dd31938f55c91f33f87378
SHA1 7aea7001f3c3cb1c491d644db1f54aa4cf405b02
SHA256 3528452ccbd8043b6fa17b0d43708e32d8464aa7326e3fbe8d024e27af437c15
SHA512 893289f5dcb020074e8d5edccdddbd0182bb4d1a18d59e56014c74d773dd801b421e6bcd9e7b3d36e4ecfee27945ffedee1b9f6bf4a541fc3fd66a94d6d040f2

C:\Windows\ehome\ehrecvr.exe

MD5 fcdce10660dd31938f55c91f33f87378
SHA1 7aea7001f3c3cb1c491d644db1f54aa4cf405b02
SHA256 3528452ccbd8043b6fa17b0d43708e32d8464aa7326e3fbe8d024e27af437c15
SHA512 893289f5dcb020074e8d5edccdddbd0182bb4d1a18d59e56014c74d773dd801b421e6bcd9e7b3d36e4ecfee27945ffedee1b9f6bf4a541fc3fd66a94d6d040f2

memory/1724-141-0x0000000000830000-0x0000000000890000-memory.dmp

memory/1172-142-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1572-144-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1992-146-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/1724-148-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1724-151-0x0000000000830000-0x0000000000890000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 43987b95d8b744c055f6217fceb4585a
SHA1 0c3c1b3434780c1e52467aacdd7a3758f1bdbe18
SHA256 fd6a8bda9984a65ccedfb3dd9d3c5945bf993ee60be9532ef8eb81639b1b772d
SHA512 bd4e6c363cac59604d066db55f91273963b6897d33265892f2c86e0ac1188ac24af48c437459d42f126facd8346c1f1c4e9ca0366786e2e8cf44d421c5561183

C:\Windows\ehome\ehsched.exe

MD5 43987b95d8b744c055f6217fceb4585a
SHA1 0c3c1b3434780c1e52467aacdd7a3758f1bdbe18
SHA256 fd6a8bda9984a65ccedfb3dd9d3c5945bf993ee60be9532ef8eb81639b1b772d
SHA512 bd4e6c363cac59604d066db55f91273963b6897d33265892f2c86e0ac1188ac24af48c437459d42f126facd8346c1f1c4e9ca0366786e2e8cf44d421c5561183

memory/1104-156-0x0000000000240000-0x00000000002A0000-memory.dmp

memory/1724-157-0x0000000001380000-0x0000000001390000-memory.dmp

memory/1724-159-0x0000000001390000-0x00000000013A0000-memory.dmp

memory/1104-164-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1104-167-0x0000000000240000-0x00000000002A0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 4eb1505922c62079f6b60f2fc02f8ed1
SHA1 0d88fddc3147f96e882b7d7d8b5169d88293a310
SHA256 77bc368796c1530da4437e6e8d88709f524b94aab0ebdd818f8c9e403a7908f5
SHA512 774e4544bff369df927360bc34fddc238e8a7073845098368f92a6535c1803fb626e67eea2587ed743d02eeeb505ef317e8ba196641cfd953c4cf189eef7875e

memory/1900-171-0x0000000000210000-0x0000000000270000-memory.dmp

memory/1900-177-0x0000000000210000-0x0000000000270000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 0352162e5dddfc4672705abd2b887d63
SHA1 cc801389dd0bf727051f2cefba077dd189cc681e
SHA256 8f0e208b24afb5356deb3be189ef302d8eae1a50b8a8ef8652003a296a240e64
SHA512 955e432de7bcfe5848a055ab1a3c3b60b9538ef25cb772ccc5d6e1977f66c5be90f204d00707483c3eecad85d8a083701f6f1aaa1cb0a76f793695d5b9cf8ce7

memory/1700-181-0x0000000000310000-0x0000000000370000-memory.dmp

memory/1700-187-0x0000000000310000-0x0000000000370000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 a083f96754ea3f311906c3d05f391cf8
SHA1 6dce9b4a86dc24e094789f818c674944835c0ae8
SHA256 b7731def90de0c768e65f8de32386dfc29bdc4de03a56cef8367b6929e65b664
SHA512 da9d7577f5f25e334a9a6e03ff1eb21a1ed00cb29fc2aad75d8d6c8e8ba3de805c7eac24ae7e21617fd710d99fe6d8335ffa3257062cf24f750ff646754b135d

C:\Windows\System32\ieetwcollector.exe

MD5 a083f96754ea3f311906c3d05f391cf8
SHA1 6dce9b4a86dc24e094789f818c674944835c0ae8
SHA256 b7731def90de0c768e65f8de32386dfc29bdc4de03a56cef8367b6929e65b664
SHA512 da9d7577f5f25e334a9a6e03ff1eb21a1ed00cb29fc2aad75d8d6c8e8ba3de805c7eac24ae7e21617fd710d99fe6d8335ffa3257062cf24f750ff646754b135d

memory/1724-200-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1900-201-0x0000000140000000-0x0000000140205000-memory.dmp

memory/1700-202-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1964-203-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/1740-204-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 4eb1505922c62079f6b60f2fc02f8ed1
SHA1 0d88fddc3147f96e882b7d7d8b5169d88293a310
SHA256 77bc368796c1530da4437e6e8d88709f524b94aab0ebdd818f8c9e403a7908f5
SHA512 774e4544bff369df927360bc34fddc238e8a7073845098368f92a6535c1803fb626e67eea2587ed743d02eeeb505ef317e8ba196641cfd953c4cf189eef7875e

memory/1900-217-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 77c35f13c00b2aee1ac343b4b18ee1cb
SHA1 3dbf00d5dc867604c1091dc025d4463db40ae9d4
SHA256 d16ef8082f3611edb9edf0190cac5c233e1ff05e9a44db60487e0a33b6dd6baf
SHA512 cde1bade7addbe9c9f2ec77c6271f3b42bb7f038f6eb5054fca191c206b863a71899bfbb556384f5e99ae344b50937cbc7dc85766d15fbc89d17340356a942f0

memory/1708-227-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/996-228-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c3734a9b1ee0b64fa8dd7d4ff7fba31c
SHA1 80af7cba13394ac5a13b7369870db6744d54592d
SHA256 caa7a477efcaab55f267adfe5fa1221ce2961d57906c9075c7138a03aaf7fe42
SHA512 e0ed804378249bb7c9678c227d66f21ab41cd42c0007170a5d5b531c51d4aa76ef39ed7181b46de5ab143e5bf99c327f564ca9346626058f194175ca56cfd650

memory/2144-240-0x0000000140000000-0x0000000140221000-memory.dmp

memory/996-243-0x0000000140000000-0x0000000140205000-memory.dmp

\Windows\System32\msdtc.exe

MD5 10086dade7f2c923312930b247686c94
SHA1 7224221667af6a22d363b914b0ce12a83eaa1cf2
SHA256 d173950521b6507f3428412d91b3c89b8a7a8492da4f8412362c3b3b8e00df86
SHA512 c737b358d98c71ddfe1d960aa7b6a9e13bcd17595fe2106ad4e3f276dce6c388ad6d4e9063e9ac95ff0a265757ab86754a793163d07c06c53fddf6d58fd540a5

C:\Windows\System32\msdtc.exe

MD5 10086dade7f2c923312930b247686c94
SHA1 7224221667af6a22d363b914b0ce12a83eaa1cf2
SHA256 d173950521b6507f3428412d91b3c89b8a7a8492da4f8412362c3b3b8e00df86
SHA512 c737b358d98c71ddfe1d960aa7b6a9e13bcd17595fe2106ad4e3f276dce6c388ad6d4e9063e9ac95ff0a265757ab86754a793163d07c06c53fddf6d58fd540a5

memory/2144-260-0x0000000140000000-0x0000000140221000-memory.dmp

memory/2244-261-0x0000000140000000-0x000000014020D000-memory.dmp

memory/1964-262-0x0000000000CA0000-0x0000000000D20000-memory.dmp

\Windows\System32\msiexec.exe

MD5 9f3c5ad0f682230381b78d95a1ac0903
SHA1 691a6a6a864066043d2c92f739235443deecd546
SHA256 bd37197513a696d513471b1539a9a6c9fa840ff23d79d90e5ec02f3b7bc9afa8
SHA512 953803ed5f06271706149d779ed6cd629aded897d0b735412d0f25c65e155b536ae1fca4f656e39fe9fe3d94215af326079e336e90a4298ffe496536b8f59ac7

C:\Windows\system32\msiexec.exe

MD5 9f3c5ad0f682230381b78d95a1ac0903
SHA1 691a6a6a864066043d2c92f739235443deecd546
SHA256 bd37197513a696d513471b1539a9a6c9fa840ff23d79d90e5ec02f3b7bc9afa8
SHA512 953803ed5f06271706149d779ed6cd629aded897d0b735412d0f25c65e155b536ae1fca4f656e39fe9fe3d94215af326079e336e90a4298ffe496536b8f59ac7

C:\Windows\System32\msiexec.exe

MD5 9f3c5ad0f682230381b78d95a1ac0903
SHA1 691a6a6a864066043d2c92f739235443deecd546
SHA256 bd37197513a696d513471b1539a9a6c9fa840ff23d79d90e5ec02f3b7bc9afa8
SHA512 953803ed5f06271706149d779ed6cd629aded897d0b735412d0f25c65e155b536ae1fca4f656e39fe9fe3d94215af326079e336e90a4298ffe496536b8f59ac7

\Windows\System32\msiexec.exe

MD5 9f3c5ad0f682230381b78d95a1ac0903
SHA1 691a6a6a864066043d2c92f739235443deecd546
SHA256 bd37197513a696d513471b1539a9a6c9fa840ff23d79d90e5ec02f3b7bc9afa8
SHA512 953803ed5f06271706149d779ed6cd629aded897d0b735412d0f25c65e155b536ae1fca4f656e39fe9fe3d94215af326079e336e90a4298ffe496536b8f59ac7

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 bc1bed9a4e22ef972f70300da2a5d75a
SHA1 40f0d0eb2175cb52ab57b90d0490147bcdd2f8ef
SHA256 f0c90a3bc76a4d3b35baa0e768530c04001c404314e8d86ff17680224fbc9f65
SHA512 0537e10ceb220602dcc3c2c01dbc7823f2308123532a715cdbfbc3fd576f207e514e599dc46ef10ed9b4aa1e0a027284666a16697f03f863907f522ac196a229

memory/2376-289-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2376-290-0x00000000006A0000-0x00000000008A9000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 3f6f85333fb2e3e8dab8b58b92da9546
SHA1 3f47aa0e8eef40a2201b22d6cf2205404570897d
SHA256 31c853ab654aa4ed3003948efe13a05229ba86ffef8771c3e7eb778d121306ed
SHA512 36860b55196dc28d0854198bb75e8589f7d52245e2e6172162e45977e6133ce5e4a717203491e91a6c580cb88c079d093e92adff6c1c6300a4b33cecef095aaf

memory/2444-293-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2576-295-0x000000002E000000-0x000000002E20C000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 03b930c71137fc4ef7d002a4f548408f
SHA1 d192382c7a388fe29677c454898f5c6c8a219a01
SHA256 48f7130373af06482b11280e5750a4fdd354f72ed63229693e0b3fdef26e3abf
SHA512 3d9835d843e2c3ccbd242f2962431242bd13686aa181ac0bfd166295b51db6f11ee4bbaed2757714c4250617cb4ee848d3512d0777b6850191119597726ad5e4

\Windows\System32\Locator.exe

MD5 7b5f3827a2b2910f04717c37ea45dad4
SHA1 c175388c7955b44e1003c2bbc900e70abed47ff3
SHA256 ebc6aec28c0e4f1f5043031e6ff2e745afb8a442b2eaa0aa5623771534bb61f3
SHA512 be66b3dc7ecd7db888cbd616ad80edc7636706ee9c6070ba6711d6c0ded5243ee57165c3dd17930c27615917ea77235f6e929f82863a9384a1f5f9448772fe83

C:\Windows\System32\Locator.exe

MD5 7b5f3827a2b2910f04717c37ea45dad4
SHA1 c175388c7955b44e1003c2bbc900e70abed47ff3
SHA256 ebc6aec28c0e4f1f5043031e6ff2e745afb8a442b2eaa0aa5623771534bb61f3
SHA512 be66b3dc7ecd7db888cbd616ad80edc7636706ee9c6070ba6711d6c0ded5243ee57165c3dd17930c27615917ea77235f6e929f82863a9384a1f5f9448772fe83

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2444-324-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2644-325-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2756-326-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2788-327-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/2808-328-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2808-339-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2012-340-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2944-341-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

memory/1964-350-0x0000000000CA0000-0x0000000000D20000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2944-361-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/1724-370-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1104-371-0x0000000140000000-0x0000000140209000-memory.dmp

memory/2232-372-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2068-373-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2232-386-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2136-387-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2136-398-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2052-409-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1964-410-0x0000000000CA0000-0x0000000000D20000-memory.dmp

memory/2532-411-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2532-423-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2764-434-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1708-435-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2632-436-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2632-447-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/2956-457-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/3052-459-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

memory/3052-470-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2376-471-0x00000000006A0000-0x00000000008A9000-memory.dmp

memory/2076-472-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 3838016c8d32bf76975bfafdcf6fbb55
SHA1 867507f668f049bbad98b9c49a4ba3943db2fea2
SHA256 ef4f8f122c2166d178bdbabf03d63166ddd3a0ae68faa5b523d5aeabadbf62da
SHA512 ff008a479db25020186dbf6f32b983eaccd53bc8c25a77c949b95d2c202568589bedb63c22726d748daac61e1bd322e02688bdde11429a112c15ccc355bd49ff

\Windows\System32\snmptrap.exe

MD5 6f6ec6ac83fc61e32eb0d7a78bc27972
SHA1 6ff862242e8a71606acde04aaec468ef4110194f
SHA256 68c7c7882c906a1a13b168364c9fe3f7c2c1317be29ed1428989f2a70f5064ff
SHA512 f05c4910d4020fc7c78f82f104688f64f5d9169d69024b72237c7b67f7a8b874e7b1decfbd3de6ea053ff742a8dbab5f6ecbaa284f10faaea87ab13d17cd71c2

C:\Windows\System32\snmptrap.exe

MD5 6f6ec6ac83fc61e32eb0d7a78bc27972
SHA1 6ff862242e8a71606acde04aaec468ef4110194f
SHA256 68c7c7882c906a1a13b168364c9fe3f7c2c1317be29ed1428989f2a70f5064ff
SHA512 f05c4910d4020fc7c78f82f104688f64f5d9169d69024b72237c7b67f7a8b874e7b1decfbd3de6ea053ff742a8dbab5f6ecbaa284f10faaea87ab13d17cd71c2

\Windows\System32\vds.exe

MD5 a3a55cf9eb3d6290c83f65d292936c40
SHA1 d048bb336b6bbaadd07498bb190630a5c0211934
SHA256 c41f4c77ff374fc7d652810d301fb50437250401e7feef3f628a659e097c0f83
SHA512 ad1baebd4ceedd721fa238491b39d5c13701b00d9875719216ee81140488c51378cb8e6e0b97769fb755fcfd8745958fda2d2640a3f1df96057a3ef76b0b895d

C:\Windows\System32\vds.exe

MD5 a3a55cf9eb3d6290c83f65d292936c40
SHA1 d048bb336b6bbaadd07498bb190630a5c0211934
SHA256 c41f4c77ff374fc7d652810d301fb50437250401e7feef3f628a659e097c0f83
SHA512 ad1baebd4ceedd721fa238491b39d5c13701b00d9875719216ee81140488c51378cb8e6e0b97769fb755fcfd8745958fda2d2640a3f1df96057a3ef76b0b895d

Analysis: behavioral4

Detonation Overview

Submitted

2023-05-05 03:27

Reported

2023-05-05 03:29

Platform

win10v2004-20230220-en

Max time kernel

116s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

Signatures

DarkCloud

stealer darkcloud

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8cda7fb49a2815e1.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6000384127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7454483127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cb91e85127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096496e84127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a459a386127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ef45483127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062ddbd83127fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 4280 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe
PID 2284 wrote to memory of 2336 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2284 wrote to memory of 2336 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 2284 wrote to memory of 464 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2284 wrote to memory of 464 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe

"C:\Users\Admin\AppData\Local\Temp\8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 104.208.16.89:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 zlenh.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 209.197.3.8:80 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 209.197.3.8:80 tcp

Files

memory/4280-133-0x0000000000AE0000-0x0000000000C7A000-memory.dmp

memory/4280-134-0x0000000005CA0000-0x0000000006244000-memory.dmp

memory/4280-135-0x0000000005620000-0x00000000056B2000-memory.dmp

memory/4280-136-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/4280-137-0x0000000005A90000-0x0000000005A9A000-memory.dmp

memory/4280-138-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/4280-139-0x00000000092F0000-0x000000000938C000-memory.dmp

memory/2144-140-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2144-143-0x0000000000400000-0x000000000065B000-memory.dmp

memory/2144-144-0x0000000002E60000-0x0000000002EC6000-memory.dmp

memory/2144-149-0x0000000002E60000-0x0000000002EC6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2d847bdc04fc179746b66fc84d1a4fef
SHA1 5790b4c00f7d2b25943f051568775e59012094e2
SHA256 801b47cc4d6ef6f4f027390e3ae76ae3f069ebeb76cc5465d0d09036971918a3
SHA512 a6b360d570fe643ffebaccdc0bc0be8c5d4345973b4295254d24cd55758cdce01480af6e8f03fb7715564a665d4fa7fcb9353ce83a9765f1aa2fb3f005cce50a

memory/1152-156-0x00000000004A0000-0x0000000000500000-memory.dmp

memory/1152-162-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 f4e8496de60124561451c65da56465ec
SHA1 76b65bc514d1036ce0f1e68e4a1812d952d598dc
SHA256 f6d46845261f576f77d97a0a2b7bfba02acab2a9e196585612bb4ff0f2067a80
SHA512 3daba433de89e5cbd559ce4ae787e40afb4bc4f2f39c9e9d76fa91b1969d2989156a36255890c7befedc078853762ed12f0da41706003bd84bccbb5a00f4a664

memory/1224-168-0x0000000000550000-0x00000000005B0000-memory.dmp

memory/2144-169-0x0000000000400000-0x000000000065B000-memory.dmp

memory/1152-172-0x0000000140000000-0x0000000140201000-memory.dmp

memory/1224-175-0x0000000140000000-0x0000000140200000-memory.dmp

memory/1224-177-0x0000000000550000-0x00000000005B0000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 3dc8d509ce25753943c35b9e66b7e705
SHA1 cc8f222264280ac83fb83b72c13cf4bd784b9323
SHA256 0a7d3eaf8ed1f232f876474bf7ac226662fb621f458c25f867f75422c4cc42c4
SHA512 e40f1e4444f203e2ea2ae3cd242839dee4f2d5ef6f0afbdeedb79202d923931c7fe2625344a970777c09487fceabd58e4606313f9c047e3ecc3b7393ef22f97f

memory/4812-181-0x0000000000500000-0x0000000000560000-memory.dmp

memory/4812-184-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4812-188-0x0000000000500000-0x0000000000560000-memory.dmp

memory/4812-190-0x0000000000500000-0x0000000000560000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 03cd76fdd8b0bab7c140a639ca23f7c6
SHA1 d823621e00b6981dabc86a9c007dd26c9364d8b8
SHA256 5094ca921be6db7ed8835319df3b2f7d0d93acb29bbe577ed18c835590e24d1d
SHA512 f247a4f444992bf89e8016472bf4374ed48b1c21bbe26d42f1f0a1a71320c8f5fb82f9e70d9d4eef32e204e40365e1a429aa2398d5d006401def44c0abf72598

memory/896-195-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/4812-194-0x0000000140000000-0x0000000140135000-memory.dmp

memory/896-201-0x0000000000860000-0x00000000008C0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 03a8f0cfe02a049f17da6c8ccb98ffdb
SHA1 fd8227f7693c652ec0f0f57f15a5d866f71be4a5
SHA256 5e02c4c2c9122b1fb5cfbce66c84f4039283e2079de0c3c743eb85041a9ed134
SHA512 8dc2883be9a1324a7baca8072018c55b5c6da0057b22bba83d46e4a4177749bd644a05389f487b9c61cc9f8bdc077826fba756cfee5dbd311a0bbd27b07b227b

memory/3228-205-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/3228-211-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/3228-213-0x0000000140000000-0x000000014022B000-memory.dmp

memory/896-215-0x0000000140000000-0x0000000140237000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 022a4a340b37e4d698093ff8bcc463c1
SHA1 360ec5ecf42dbc0ce56cf60451db6ca3b308d471
SHA256 14c3db6783cc28e3c582d6aa2e9633ce49ea0ebefe229c68e7d3aac3783c8784
SHA512 b57e80c46952fec8f5874c80c36031fbff59c7282286bdde882258bcd9afccf94d350efb74a7424c4cb8f06220629ccd2c4a3ea38abadd17a1f56ef58d647ce3

memory/3796-217-0x0000000001A40000-0x0000000001AA0000-memory.dmp

memory/3796-223-0x0000000001A40000-0x0000000001AA0000-memory.dmp

memory/3796-226-0x0000000001A40000-0x0000000001AA0000-memory.dmp

memory/3796-228-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 321d57f9bf6da94523db72e4d4476fea
SHA1 e0454fe8fefda0d4a6bb47fa576f95da8aaa2592
SHA256 91e513656d75c01e0622140f879061d29812fef210c7a5c854ecb7cb71eaac25
SHA512 809d2eee5d88b8ce78c9da0fe27e2c73bd7d7c702f49b59b1f60bbb959fba7e875d77288d35cb88d348408ad045fee6435e6c92af531c8314fd9a3812b84376e

memory/4220-231-0x0000000000720000-0x0000000000780000-memory.dmp

memory/4220-240-0x0000000140000000-0x0000000140210000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 6d0840fba8953158d58da9c279331031
SHA1 48ca4881a3092e14d270bdb1d7dc70a0377c90e5
SHA256 a77df0ebb23bf4f8673eed8d9657dfcc846c70ab1391107edd83b1e04567b460
SHA512 54d6a986f8d0e395f34880b2a17ffc62a1eaff0a1e4d92d2e26a357680e00afb57ca42a2ef584ff72a54039a170cdfbd53b30571a5f1feac8c74570488feb507

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 f592c51609f9c17d22fe15777a48026a
SHA1 73527c68371ce386c1e5874f89336497b6ee8c83
SHA256 11ac76cba58ce10a275350f227d809152b1e1248ad4d3ebfee55e95928bd869b
SHA512 ea54ed9a064996046c4a7da3dc94659f343021a80fba498ad5167e0d9d45954106bf500bd4dba722345d028dbd6e3861ac9418967205ffd9e695276e68cae4fc

C:\Windows\SysWOW64\perfhost.exe

MD5 b17b67fce158ebdd8703046a7ef2023c
SHA1 29b95f85cb63fa70768212d4b0f5a14b4f8615bd
SHA256 6115678f9b214d6a229c377661021b269843a1beab1ff0edc0552f27241861a1
SHA512 d4ba917dd06a31a485a7ffc8524e71da023314c40409f610379ee885639f4d290390beccd94a906f094d3a0f3d89af3338470d40b40fe421428490f35ec6f786

memory/1180-273-0x0000000140000000-0x0000000140226000-memory.dmp

memory/4168-274-0x0000000140000000-0x0000000140202000-memory.dmp

memory/2772-276-0x0000000000400000-0x00000000005EE000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 1d872cfa85d9b310781d7aef3defc692
SHA1 10b95bad9d207fc946b3d8c93faed1a00c42d4e8
SHA256 094f3ebe06a89fa7f368c1d672fd5ffff0ff21cc707346a37d5d6a9e5a43784d
SHA512 84ee2e50cfeb47f432a8f967dfc03957738ca4e48e24f94de57aadc07a3e60c9fca587758aa717807f051287d6182c6c25eb766ed624ffbe7d5d779c66c2110a

C:\Windows\System32\SensorDataService.exe

MD5 87861acad17b1c86bb3568a3f8bc124b
SHA1 63a3322fb692ebf06c1c117c9afbbede26756c36
SHA256 cdf095dc20b100733abff923a05e4c7f3b082d385307074be8f027dc728a82b9
SHA512 9605d3e7e854d7ac8ff3ff37f8698f42322d9fdbd8c74176f8e36a051d6afd8baaa2e566a6311b3838c6a82e2527cd708272a9fbbe5a158f5f70a5a22517e1a9

C:\Windows\System32\snmptrap.exe

MD5 ddb0ce5eb6f443b823778313eb2245cf
SHA1 c81b82b27f7f0b5227ffd7400233d9fe155e724c
SHA256 5742904a9289f273aedad1f81611539fe6d71bda96a7a3dab5fced8d16ae4181
SHA512 2908399517a1f405720146008dd63e79fe48a625a794597478495ff21ebb8e88e771f57c0d42eb3b7e94bc73fa0ab01adb3759998772165e89b9b75d250b1545

memory/2764-300-0x0000000140000000-0x00000001401EC000-memory.dmp

memory/2532-302-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3472-305-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 956dba5e34a76e9b4291760e6914c993
SHA1 713fa9397187981e491beaa5c2785f759712b5cb
SHA256 1d880564d0f0fd80c8939e372006b5e20772b89d5506314b7c13213e459f7d47
SHA512 0b728aad01eb10f88ad9cbb7fad60ef4d1411e1e1791ecc6f9d0cf6318e79ea3b22c308277e34d0ef0e9729b3d801559a9d514c23bb2a22a9c7cd46bed04549c

memory/3668-321-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 e41a1c4693019f7d25f0a583dd657186
SHA1 fa0f49c3851072b72ea69d760165f90866579a6d
SHA256 745416ad0f30534e987b2379c599669efe422429356841bb45b722eb3fa4f216
SHA512 f059d37e22c87daf6c85740d88a3fe09ed9446334e540e59a12c2de39d3f9ac072f5b46597801f1e41dd78d267270c49cef895fdae422532d003c49315252661

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 e41a1c4693019f7d25f0a583dd657186
SHA1 fa0f49c3851072b72ea69d760165f90866579a6d
SHA256 745416ad0f30534e987b2379c599669efe422429356841bb45b722eb3fa4f216
SHA512 f059d37e22c87daf6c85740d88a3fe09ed9446334e540e59a12c2de39d3f9ac072f5b46597801f1e41dd78d267270c49cef895fdae422532d003c49315252661

C:\Windows\System32\TieringEngineService.exe

MD5 9fd6651d9ed523d569018b723b0c573b
SHA1 e024281b2f8bffe7351780e5de204b0ec9a3e09d
SHA256 909bf98e9f9c575297460069d8124f6fb302b5c816f854e1eab5eb4c70bd06bd
SHA512 b61ac0ae5512a3a978337ff62e81c004e0f7460dfe2d2ebedc758050b58146363f20589a74813ca32daaf090e1c537db8f04275f3df7469d35d1d98118ea4f8c

C:\Windows\System32\AgentService.exe

MD5 0c09a8a1693d630da57f3e5fca5492f3
SHA1 ba92cd1225d5e31a0fd3dbc0bcfcd14a633b4123
SHA256 d118bbe290fbaf9411492f67903e4008632428944c99fd419d41c12761c6f5b0
SHA512 3a7d4f1a3bea2585d846e9b969a196ea2286293249c2aa0e33a9cefb3e3caf4c8af43d6095d29104e5369647cb5a86f1af8cf61e342d79b7e2bad70d71c8dfab

memory/4056-344-0x0000000140000000-0x0000000140259000-memory.dmp

memory/1708-346-0x0000000140000000-0x0000000140239000-memory.dmp

memory/4680-349-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/4680-358-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 7a2dde3ae34176751cdf0055eb1dd714
SHA1 8bb36c87b186fa5662e563729b6af7f8b1e9a97e
SHA256 ec9941ec00fc7e4bf6ffb337eeaba52d67dd1fb75cdc358012176d3683551dfc
SHA512 241895bcfa7bc1643922fdd2a4ff93d8cc99179d24bebf216595550b2f47fa2d4953ebe1d58abf97440c57cffa27146f43080a5e4348492a232d1a544b14b5c9

memory/3000-369-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 7814433dd12ab5f3ab7bb8ec1be61326
SHA1 78d926c058f44aceeffa2141677f782cb1e03114
SHA256 99adf1b8c247e568f044797a92f3fba19ce5bad01c2afd819d8026cc9e9eab82
SHA512 3741274e1a46980d4075f8e73a7417791af32024110fb828f8be9a6a07027d00e009dcfe11cf6a06c967102ca78f0b7b0379f600082a02b562624ab107ef7161

C:\Windows\System32\wbengine.exe

MD5 228eca4e9d15644b847de51270b129c7
SHA1 fb6f9e271d1a19085b3ff2cd4c5ee52d710c92cf
SHA256 0c68cf2dea81f31ce5c97d1f9ad3e692574527d20f2680f35cad2f31c858cca2
SHA512 77d5947dd733061e6071bc4a7808911efa53e7f5ffd2ed04ad1d5aae967123ada282d1abc96616fc88e69c8c0baf00f3d3d466d97358988e9d37f02581339084

memory/3852-383-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4228-386-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 2c88d75ca7bb891d11e78453c0ba986c
SHA1 a928b47d8ddc959206a48d539cb8f587b26b9376
SHA256 d5ed6a96fee727a5b6d8df245647b369cbc36244ce980a269a1152e767a68f76
SHA512 bcfae411672e2f625678d4e385c6f5eb4da8555bbb6b045f1e6c582b4b44631f37b4b1e7350b0b7f11c686b45012d7277d987a27eef48addf3084a0d714adee6

C:\Windows\System32\SearchIndexer.exe

MD5 f1556aeb38a116c7185e941bff864dd6
SHA1 5af8d76ca9405fa3d36529ec3a374658b552de2d
SHA256 a3bdfed958d2e9d86f07e0d83dab5c0a34ee5f351f58fb578bfd3675709e4f9e
SHA512 f8f5c81a5b4e253b7fcaecf21a60370895e4f753de15fce279d41458a457b8ba48c66742e7b89317f9abef81b7c5cb3b787cbaa3ce4c42629654633df3230c4c

memory/2144-412-0x0000000000400000-0x000000000065B000-memory.dmp

memory/1224-414-0x0000000140000000-0x0000000140200000-memory.dmp

memory/4624-417-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2284-421-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3228-496-0x0000000140000000-0x000000014022B000-memory.dmp

memory/896-497-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2532-539-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3472-565-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/3668-578-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3852-611-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4228-613-0x0000000140000000-0x0000000140216000-memory.dmp

memory/464-615-0x00000271423E0000-0x00000271423F0000-memory.dmp

memory/464-616-0x00000271423F0000-0x00000271423F1000-memory.dmp

memory/4624-643-0x0000000140000000-0x000000014021D000-memory.dmp

memory/2284-644-0x0000000140000000-0x0000000140179000-memory.dmp

memory/464-645-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-646-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-647-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-648-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-661-0x0000027142BD0000-0x0000027142BE0000-memory.dmp

memory/464-662-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-663-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-664-0x0000027142BD0000-0x0000027142DD0000-memory.dmp

memory/464-665-0x0000027142BD0000-0x0000027142DD0000-memory.dmp