Malware Analysis Report

2025-06-16 06:16

Sample ID 230505-n9rkhacb4y
Target Technical Spec.exe
SHA256 59171f457fb4915d408fa293f0ca3cdfeb613a20d6fadc50ae88b1cf58f0b004
Tags
darkcloud spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

59171f457fb4915d408fa293f0ca3cdfeb613a20d6fadc50ae88b1cf58f0b004

Threat Level: Known bad

The file Technical Spec.exe was found to be: Known bad.

Malicious Activity Summary

darkcloud spyware stealer

DarkCloud

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-05 12:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-05 12:06

Reported

2023-05-05 12:08

Platform

win7-20230220-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

Signatures

DarkCloud

stealer darkcloud

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f056041e831f2d02.bin C:\Windows\System32\alg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1304 set thread context of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{079C300A-76CF-41D3-B78A-C790865AB8DE}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{079C300A-76CF-41D3-B78A-C790865AB8DE}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{AA370EA1-28D7-4B88-8BFA-13AD062E1B87} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{AA370EA1-28D7-4B88-8BFA-13AD062E1B87} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Windows\system32\SearchProtocolHost.exe N/A
N/A N/A C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1304 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1564 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 996 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1636 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1304 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1040 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1356 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1384 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 1936 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 832 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 832 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 832 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 832 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2244 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2456 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 2596 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1564 wrote to memory of 928 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 254 -NGENProcess 1f0 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1d4 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 260 -NGENProcess 1e8 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 23c -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 264 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 270 -NGENProcess 23c -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 24c -NGENProcess 1e8 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1d4 -NGENProcess 25c -Pipe 240 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 27c -NGENProcess 23c -Pipe 278 -Comment "NGen Worker Process"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 26c -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 280 -NGENProcess 27c -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 270 -NGENProcess 28c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 27c -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2961826002-3968192592-354541192-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2961826002-3968192592-354541192-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 270 -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp

Files

memory/1304-54-0x0000000000C00000-0x0000000000D8C000-memory.dmp

memory/1304-55-0x0000000004E50000-0x0000000004E90000-memory.dmp

memory/1304-56-0x00000000004E0000-0x00000000004F2000-memory.dmp

memory/1304-57-0x0000000004E50000-0x0000000004E90000-memory.dmp

memory/1304-58-0x0000000000530000-0x000000000053C000-memory.dmp

memory/1304-59-0x0000000005CC0000-0x0000000005E0C000-memory.dmp

memory/1304-60-0x0000000007E00000-0x0000000007FC6000-memory.dmp

memory/540-61-0x0000000000400000-0x000000000065B000-memory.dmp

memory/540-62-0x0000000000400000-0x000000000065B000-memory.dmp

memory/540-63-0x0000000000400000-0x000000000065B000-memory.dmp

memory/540-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/540-66-0x0000000000400000-0x000000000065B000-memory.dmp

memory/540-68-0x0000000000400000-0x000000000065B000-memory.dmp

memory/540-69-0x0000000000340000-0x00000000003A6000-memory.dmp

memory/540-74-0x0000000000340000-0x00000000003A6000-memory.dmp

\Windows\System32\alg.exe

MD5 e76864c09e8a167a5783c1684be004f1
SHA1 5d83499d0a8a52c288219678ce1541b07956e83f
SHA256 ab4c9dd29b4b0e1dafb95dbc5323e6c2470fce7d198ba10bbfa10a7f0dacea17
SHA512 f387a0fe4948bc9975b7b1fc5bc70f7da0405a97d090c9a994ca904619a97e46d8e7d972da4d6c44b0f13a1c59733dafd17e3f45c76226578cba8a586ca480d7

C:\Windows\System32\alg.exe

MD5 e76864c09e8a167a5783c1684be004f1
SHA1 5d83499d0a8a52c288219678ce1541b07956e83f
SHA256 ab4c9dd29b4b0e1dafb95dbc5323e6c2470fce7d198ba10bbfa10a7f0dacea17
SHA512 f387a0fe4948bc9975b7b1fc5bc70f7da0405a97d090c9a994ca904619a97e46d8e7d972da4d6c44b0f13a1c59733dafd17e3f45c76226578cba8a586ca480d7

memory/1504-82-0x0000000000900000-0x0000000000960000-memory.dmp

memory/1504-88-0x0000000000900000-0x0000000000960000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 dbaa2599cb675b385f83c7c02a25bf54
SHA1 a27ef0bd5b3f30f9900507b4a3d17cff566a2bbd
SHA256 f4cad8c992432c40a501047f5d90bd1e35c38c5435765f851c316218eacc69c9
SHA512 e189a312af9cffd19c757cd49418422cd6bd78ffcc024aa0eae3189e4d60dd4b1891d43822468f421cfa5f95c432d8db0dff73914344eb3ed0c9cedb9746b8e2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 dbaa2599cb675b385f83c7c02a25bf54
SHA1 a27ef0bd5b3f30f9900507b4a3d17cff566a2bbd
SHA256 f4cad8c992432c40a501047f5d90bd1e35c38c5435765f851c316218eacc69c9
SHA512 e189a312af9cffd19c757cd49418422cd6bd78ffcc024aa0eae3189e4d60dd4b1891d43822468f421cfa5f95c432d8db0dff73914344eb3ed0c9cedb9746b8e2

memory/1504-94-0x0000000100000000-0x00000001001FB000-memory.dmp

memory/540-95-0x0000000000400000-0x000000000065B000-memory.dmp

memory/1608-96-0x0000000140000000-0x00000001401F4000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 19afbae44ebba56ccc6e1e4051d3ddf6
SHA1 4b126f923a0c6f946b9b134ea3ec31532c8cc176
SHA256 2eeab36e82a6dee243889b08a46b08faaff72af67251f70e5d9c0cbcc63201d3
SHA512 8ee9624e1c25c8c70cd2299bc3e09e803dae00ac61eb557db3f1f3f6a51743e8d7eded0533c22c46b65d3ac195f5b4ae8ae2812d6cb1176190de82c55742e41e

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 19afbae44ebba56ccc6e1e4051d3ddf6
SHA1 4b126f923a0c6f946b9b134ea3ec31532c8cc176
SHA256 2eeab36e82a6dee243889b08a46b08faaff72af67251f70e5d9c0cbcc63201d3
SHA512 8ee9624e1c25c8c70cd2299bc3e09e803dae00ac61eb557db3f1f3f6a51743e8d7eded0533c22c46b65d3ac195f5b4ae8ae2812d6cb1176190de82c55742e41e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 6359b02b1de304137054bd64322c84d5
SHA1 fcf0a3f7ca59d4de2ed3abd147bc4a0048058839
SHA256 f301ea8e63ba1b635ce20af004c962de4a4cf49c8bbd58e250fbdeff27080358
SHA512 3b0afa6035f907b46b9ea847ec2b0a72ea7f8cea47dd3d0a2a47401706be4e5277555577e0b8bf29003b42514e0a1469ca6b8a8f2c86c1d1f03888197091c128

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 6359b02b1de304137054bd64322c84d5
SHA1 fcf0a3f7ca59d4de2ed3abd147bc4a0048058839
SHA256 f301ea8e63ba1b635ce20af004c962de4a4cf49c8bbd58e250fbdeff27080358
SHA512 3b0afa6035f907b46b9ea847ec2b0a72ea7f8cea47dd3d0a2a47401706be4e5277555577e0b8bf29003b42514e0a1469ca6b8a8f2c86c1d1f03888197091c128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 33ad352714ede8229d60ba9aff0a7771
SHA1 f9128f74e0cb2a8ac3fef258de6478852c5cc28d
SHA256 fc588d4033f8b6e69867a660f33d37e491ff7f77d301ccaff8b47f5578bb7462
SHA512 7a783043ff12d3dbf7ecdc5a4db7f0886616cb85c015499ca8b49a9ff9ae7c777c6a7a52652064095e1b1e3cb3bde6857f374358dfc46f07f388b43c3d259941

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 6359b02b1de304137054bd64322c84d5
SHA1 fcf0a3f7ca59d4de2ed3abd147bc4a0048058839
SHA256 f301ea8e63ba1b635ce20af004c962de4a4cf49c8bbd58e250fbdeff27080358
SHA512 3b0afa6035f907b46b9ea847ec2b0a72ea7f8cea47dd3d0a2a47401706be4e5277555577e0b8bf29003b42514e0a1469ca6b8a8f2c86c1d1f03888197091c128

memory/1556-112-0x0000000010000000-0x00000000101F6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1564-116-0x0000000000B60000-0x0000000000BC6000-memory.dmp

memory/1564-121-0x0000000000B60000-0x0000000000BC6000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 59ff6ca2f69397ad60235bfe493e58b5
SHA1 2140bc474ee68009754b7f8f510351e63934681f
SHA256 b811ef943c4320d06bb01700f95167cefdf5ee0ab59bd277a9cc4904615ded35
SHA512 1d00633474a1686aa7295a0cdc8129856d6c051bf69e3a42184cd68b0398f6c89359a25e6f959f77025bb04a17cb481157afdb0ba4c8b734929ff7958a88185b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1564-128-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1756-130-0x0000000010000000-0x00000000101FE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 5df581ca218242ea43437501ffa65390
SHA1 381d748a186de7f7bc3a2a5e2062c3750436d8b1
SHA256 1fbfa18eb0fc5f43317973934e19600682b0b090bcbe65ae95a8f8f1b067730b
SHA512 27e77bb345d3e49fcbc13c8b56959fcbb9489832c046afc51a7f8224ea405198973da9582fad3f03154ffa30f58c1094841c3f323a7b68a5bf5feb94dfdaccf9

\Windows\System32\dllhost.exe

MD5 d1ffa60544689307ee0d4d3429e0cc01
SHA1 97adfd32a74502eaf8a38eacad57a05946085d34
SHA256 c3eff96dadf0b759a3c5a08f2d4ac198bb007ec7453adf6e0f95353784e631c8
SHA512 b80e32b00f2b5d59b99a2623d85bee10d2af80aad1b30e06d7e8b5800f1915162721e9e302069e608f1ef21f5db54d8ff73a510bf3a04e7a09b97d76c8d5500f

C:\Windows\System32\dllhost.exe

MD5 d1ffa60544689307ee0d4d3429e0cc01
SHA1 97adfd32a74502eaf8a38eacad57a05946085d34
SHA256 c3eff96dadf0b759a3c5a08f2d4ac198bb007ec7453adf6e0f95353784e631c8
SHA512 b80e32b00f2b5d59b99a2623d85bee10d2af80aad1b30e06d7e8b5800f1915162721e9e302069e608f1ef21f5db54d8ff73a510bf3a04e7a09b97d76c8d5500f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 5df581ca218242ea43437501ffa65390
SHA1 381d748a186de7f7bc3a2a5e2062c3750436d8b1
SHA256 1fbfa18eb0fc5f43317973934e19600682b0b090bcbe65ae95a8f8f1b067730b
SHA512 27e77bb345d3e49fcbc13c8b56959fcbb9489832c046afc51a7f8224ea405198973da9582fad3f03154ffa30f58c1094841c3f323a7b68a5bf5feb94dfdaccf9

\Windows\ehome\ehrecvr.exe

MD5 f957bfe4830ef573723c95f014328ae7
SHA1 6af1b9fae2c260a9c0d71c4f5e32e2a00508560a
SHA256 854ed62541388aca06dd8b40cfeff6549488f26efc4ad9461d93d23c92cbd351
SHA512 16dcfdf452a1cb1ea2276f801ac8eb09eb3ac27db42ef95483acc8210d4f689b68c10791f13116a44d842ffa0fae1acd6be5503cad6ba9612119fe0550d11a59

C:\Windows\ehome\ehrecvr.exe

MD5 f957bfe4830ef573723c95f014328ae7
SHA1 6af1b9fae2c260a9c0d71c4f5e32e2a00508560a
SHA256 854ed62541388aca06dd8b40cfeff6549488f26efc4ad9461d93d23c92cbd351
SHA512 16dcfdf452a1cb1ea2276f801ac8eb09eb3ac27db42ef95483acc8210d4f689b68c10791f13116a44d842ffa0fae1acd6be5503cad6ba9612119fe0550d11a59

memory/980-142-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/980-148-0x0000000000840000-0x00000000008A0000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 b1b92779a6ba3812bfbda2f47b0e8973
SHA1 2325b2bc28deded5a2551199f5d40a3b3f151e7d
SHA256 5cb02748aac95c443a2445a4eb297269d1f565f9b703142e550a3588ecbaae81
SHA512 bcb89666b78ecafbfc4fcf4b183aec9e6285414afd330e7301a78b8348404c32585e14a9acaab69132f65910fe2e632eb353162e211cb2a5b361688a5a6d7d75

C:\Windows\ehome\ehsched.exe

MD5 b1b92779a6ba3812bfbda2f47b0e8973
SHA1 2325b2bc28deded5a2551199f5d40a3b3f151e7d
SHA256 5cb02748aac95c443a2445a4eb297269d1f565f9b703142e550a3588ecbaae81
SHA512 bcb89666b78ecafbfc4fcf4b183aec9e6285414afd330e7301a78b8348404c32585e14a9acaab69132f65910fe2e632eb353162e211cb2a5b361688a5a6d7d75

memory/1772-156-0x0000000100000000-0x00000001001EC000-memory.dmp

memory/864-153-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/980-155-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

memory/1684-157-0x0000000140000000-0x0000000140205000-memory.dmp

memory/980-159-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

memory/980-161-0x0000000140000000-0x000000014013C000-memory.dmp

memory/864-163-0x0000000140000000-0x0000000140209000-memory.dmp

memory/864-167-0x0000000000860000-0x00000000008C0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/996-170-0x00000000002E0000-0x0000000000346000-memory.dmp

memory/996-175-0x00000000002E0000-0x0000000000346000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1636-180-0x0000000000370000-0x00000000003D6000-memory.dmp

memory/1636-185-0x0000000000370000-0x00000000003D6000-memory.dmp

memory/980-188-0x0000000001430000-0x0000000001431000-memory.dmp

memory/996-187-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1636-189-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1636-200-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1040-205-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1304-207-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1040-221-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1368-231-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1356-245-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1384-254-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/1576-265-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/832-278-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/1936-279-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/540-280-0x0000000000400000-0x000000000065B000-memory.dmp

memory/1608-281-0x0000000140000000-0x00000001401F4000-memory.dmp

memory/864-282-0x0000000140000000-0x0000000140209000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 2ea5636e011aaac0905b826356c72a0e
SHA1 bca98b8fbe547f692b916defe4a383d60b938d36
SHA256 546a585313d03b04e6aca9d6f5485550923b95031361bd1401cd111228f3c044
SHA512 0050f706fba65643cf6bd65f07c75eb420a94121b4deab81baa3bf1b4bd65f2b74c830c0d9991a51d47c0b597be8c16e4f519967166cf9c7aaf9521b45a38f1f

memory/980-286-0x0000000140000000-0x000000014013C000-memory.dmp

\Windows\System32\ieetwcollector.exe

MD5 66f53f51e67ed6b978a65d221bad0104
SHA1 08236a1990b3033f887edafbc68e1dedce084e56
SHA256 2381c9010e158511d681ab12e43fa7d2f8eecb0286bcc39851befc8340d46dd6
SHA512 636db87b422546b32d8c8ddb0ba24fa7465ae752e5ed3be8c94cb87602664fc998fe6c8cdfb9c4cedca6e0fb504ad653ba9b0ea56a39d846b4e1529623c4b0ee

C:\Windows\System32\ieetwcollector.exe

MD5 66f53f51e67ed6b978a65d221bad0104
SHA1 08236a1990b3033f887edafbc68e1dedce084e56
SHA256 2381c9010e158511d681ab12e43fa7d2f8eecb0286bcc39851befc8340d46dd6
SHA512 636db87b422546b32d8c8ddb0ba24fa7465ae752e5ed3be8c94cb87602664fc998fe6c8cdfb9c4cedca6e0fb504ad653ba9b0ea56a39d846b4e1529623c4b0ee

memory/1536-307-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1004-308-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 915ee8677cd82d1ad0a497f729f36752
SHA1 7081f360fc8307f2d24a0caecea8e899167df4cb
SHA256 b203fe226f354e108aee589bbca7692afede68b84856c24d337f27723d4f402b
SHA512 221f46a2b102039925cc79776d43554476a2b4c96331b24e9df0cad34b1a0efb90df10a681f0c50edcde0cfbb7dea301879d77c707e260a8fc60ff2c716a5099

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 93865117e7ac5bea1978327e18cfb9c3
SHA1 849713cc79d15953a6f2ca9680dc4021ad40683e
SHA256 fb7efbb83962685707d09cf49e3f44d0dbe5e2e5f11314fd4ca4de895cd76105
SHA512 3217a57cbfb0f1a3d857bf0fff94caee58c0d106afe1496ec96e1539db803476d2bf74073bfd9bf5da3e4d05403c3355e93cd0f8a61c51beacc697514728a941

memory/1120-322-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 13d91cd9f721526fbf94f5ba824cc0e0
SHA1 f5455f3c0d64127f90cf611e77bf141c6afb6e2d
SHA256 83f7aaa92cf9cec31a58ed898dcb3d351218a2549073f50554c18487637981b5
SHA512 5913073db2a02fee127b5e6ef9ef1115b4fdb0815ab6c263cf588f491ae590466331598a1a89298d0659689d4095305cb86e14bdb2b24ef13fdf68a911d89962

\Windows\System32\msdtc.exe

MD5 13d91cd9f721526fbf94f5ba824cc0e0
SHA1 f5455f3c0d64127f90cf611e77bf141c6afb6e2d
SHA256 83f7aaa92cf9cec31a58ed898dcb3d351218a2549073f50554c18487637981b5
SHA512 5913073db2a02fee127b5e6ef9ef1115b4fdb0815ab6c263cf588f491ae590466331598a1a89298d0659689d4095305cb86e14bdb2b24ef13fdf68a911d89962

memory/1556-339-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1356-342-0x0000000140000000-0x000000014020D000-memory.dmp

memory/1556-346-0x0000000140000000-0x0000000140221000-memory.dmp

\Windows\System32\msiexec.exe

MD5 82cb5e4596f155794b0803fd96345189
SHA1 b23fb2a5c678d3da10e6960fba67e8fec49d69f0
SHA256 8325e219b08fb8384046b01e0e127c6cadbd4438fe23760edb622f14c69aa26f
SHA512 0b6ac74a4faac3fac12ba147e94ad908e81d579e10aa1cbfcced98b33cf2a722cbe43bc92fb6bf2998bc65c1b5c267e85ca559e82c9346a4eecd716a720ec998

C:\Windows\system32\msiexec.exe

MD5 82cb5e4596f155794b0803fd96345189
SHA1 b23fb2a5c678d3da10e6960fba67e8fec49d69f0
SHA256 8325e219b08fb8384046b01e0e127c6cadbd4438fe23760edb622f14c69aa26f
SHA512 0b6ac74a4faac3fac12ba147e94ad908e81d579e10aa1cbfcced98b33cf2a722cbe43bc92fb6bf2998bc65c1b5c267e85ca559e82c9346a4eecd716a720ec998

C:\Windows\System32\msiexec.exe

MD5 82cb5e4596f155794b0803fd96345189
SHA1 b23fb2a5c678d3da10e6960fba67e8fec49d69f0
SHA256 8325e219b08fb8384046b01e0e127c6cadbd4438fe23760edb622f14c69aa26f
SHA512 0b6ac74a4faac3fac12ba147e94ad908e81d579e10aa1cbfcced98b33cf2a722cbe43bc92fb6bf2998bc65c1b5c267e85ca559e82c9346a4eecd716a720ec998

\Windows\System32\msiexec.exe

MD5 82cb5e4596f155794b0803fd96345189
SHA1 b23fb2a5c678d3da10e6960fba67e8fec49d69f0
SHA256 8325e219b08fb8384046b01e0e127c6cadbd4438fe23760edb622f14c69aa26f
SHA512 0b6ac74a4faac3fac12ba147e94ad908e81d579e10aa1cbfcced98b33cf2a722cbe43bc92fb6bf2998bc65c1b5c267e85ca559e82c9346a4eecd716a720ec998

memory/2104-357-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2104-359-0x00000000005D0000-0x00000000007D9000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 2b30a389e308da60d3f8d7bf52250953
SHA1 9f85c53290d743f1f73f30611e5280b3c6789fd7
SHA256 f3b8458acbc5ba86f908c8a1c481e39024702ad2a24c0e9b6641e83085b7f7ee
SHA512 02af8787fd1767e015c3dde50fc6f169506a85b788beb2cb82db27659ee688762d259b4d0b2b98245312c1c60c48a04c24883a82ef54ab10e75a02110ab9646d

memory/2284-378-0x000000002E000000-0x000000002E20C000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 2a5233c9c0af73b391a29d32227e5f37
SHA1 0b6ce201240d45fbbffd2b8e3b4078ad3eaaa950
SHA256 650b799a8fde41496d8805f6ce0ea51195beb3ee42d6d64d0b6ac85646160089
SHA512 845d3f720ee329d943c26614340c2bcce0ebb43f757fc3c33b808b9d9ce13eac6556c33d553800b980df17d48f5aae83f8670610b39fd4ccda2b459c6705d714

memory/832-375-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2244-382-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/2356-393-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 a6a606efb7536b9ec68f0933eed3ed31
SHA1 6c1ad2777c20878f473dba81a57639bb55ad5c5d
SHA256 948965ed8c72bafe5177eaeb0ab3bc3a088942fa98667a800c062d70113e4a8e
SHA512 2e5d024b1c18424c3b15385987f48cfda5369415bada09013fbe5b2118e2aad0cac7d182c7b4b064a7d10c571c7c531663d4f5357ca8688b9019b75fea2c54b1

memory/2244-402-0x0000000000400000-0x00000000005FF000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

C:\Windows\System32\Locator.exe

MD5 f47689261ede2faec0fcfe4bccf9b5a1
SHA1 efb7e8fe3aa89b82c62d2c049e3b28f6ecff8b23
SHA256 5480beb014b60e0b0e9b596fc19d24fa3ec19222f9607c087b981364059012c7
SHA512 3ff409d7163abf30ba9a3f10c87891aa4640db1f4ccae215b0e422ae11dd6a0ace13f16cdbf51daaa47c5b0595f1b426d164c3dba6b99a0d2fb5efc604116326

\Windows\System32\Locator.exe

MD5 f47689261ede2faec0fcfe4bccf9b5a1
SHA1 efb7e8fe3aa89b82c62d2c049e3b28f6ecff8b23
SHA256 5480beb014b60e0b0e9b596fc19d24fa3ec19222f9607c087b981364059012c7
SHA512 3ff409d7163abf30ba9a3f10c87891aa4640db1f4ccae215b0e422ae11dd6a0ace13f16cdbf51daaa47c5b0595f1b426d164c3dba6b99a0d2fb5efc604116326

memory/2500-421-0x0000000001000000-0x00000000011ED000-memory.dmp

memory/2620-425-0x0000000100000000-0x00000001001EC000-memory.dmp

\Windows\System32\snmptrap.exe

MD5 d93cbd8dd6aa6fe35f5a19c21830da44
SHA1 05c31a4110bab95cbdd220d7553c8a7e34efe99d
SHA256 3dd146ffda625df4df35c03e49331167ae4454f7c51e315719ba97fc85fe2645
SHA512 1b0689744f23c45bd091a5a27df276de14e55a0537401597100eaba9ba37af0b07e8bb39b2c33f4a5d5bb1b9a59eae049284470eb2e20194c78eeb33912b27c9

C:\Windows\System32\snmptrap.exe

MD5 d93cbd8dd6aa6fe35f5a19c21830da44
SHA1 05c31a4110bab95cbdd220d7553c8a7e34efe99d
SHA256 3dd146ffda625df4df35c03e49331167ae4454f7c51e315719ba97fc85fe2645
SHA512 1b0689744f23c45bd091a5a27df276de14e55a0537401597100eaba9ba37af0b07e8bb39b2c33f4a5d5bb1b9a59eae049284470eb2e20194c78eeb33912b27c9

C:\Windows\System32\vds.exe

MD5 d045646505068bab1ee251d4d27e1f6c
SHA1 df6379dde1a9821ba0bb77137200b2dfb7da2c3e
SHA256 671d2110ae8b3d1e87635165de76cbea40bf3d7051596e07225e3da53ea33ee9
SHA512 577c9a30936cfb311d17e6fa81d7e2289bd3133eac45c77d4823e5bcdf22fbd2ca1a8c6809e93968dc11bc3e2f8164a804a5ca2fe58c790f7cec16d54fd0bbaf

\Windows\System32\vds.exe

MD5 d045646505068bab1ee251d4d27e1f6c
SHA1 df6379dde1a9821ba0bb77137200b2dfb7da2c3e
SHA256 671d2110ae8b3d1e87635165de76cbea40bf3d7051596e07225e3da53ea33ee9
SHA512 577c9a30936cfb311d17e6fa81d7e2289bd3133eac45c77d4823e5bcdf22fbd2ca1a8c6809e93968dc11bc3e2f8164a804a5ca2fe58c790f7cec16d54fd0bbaf

memory/2760-445-0x0000000100000000-0x00000001001ED000-memory.dmp

memory/2848-447-0x0000000100000000-0x000000010026B000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 1cccda0dbdca1386867b2a57ef0e0876
SHA1 3a48d192f2e3b0b046d115e103d88895dc4e6b28
SHA256 b043b3fdd900dbc70fbd1ff31f4a25b1828f40de190419f73649ffda9978f515
SHA512 a65cd4ee8a5dfcf7f34d27f52e107b38dcefe52519d319d4795b3d27aad1a98fd48c6f9af4b115490f41c9277ca5d551b437871125b019bee28f685b607bea33

memory/2936-461-0x0000000100000000-0x0000000100219000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 c7ae2ba59672c1349d4a651e7ab3d1c9
SHA1 7b32edf3da492bcda2fa9fa7cb2bd3f65eaafeb1
SHA256 ddeeb062e8f2b5be48ef6591960e53654a0a0f16d1566ea773ba288aaebe8754
SHA512 15be3cffb9c05756009d90a0ab215a25972602acdc9b31a0aa30a5875f071dcbed7953e076b210b6e99fad0a0b2bed36b297e076997927df045d7a2c6ed29bd1

\Windows\System32\wbengine.exe

MD5 c7ae2ba59672c1349d4a651e7ab3d1c9
SHA1 7b32edf3da492bcda2fa9fa7cb2bd3f65eaafeb1
SHA256 ddeeb062e8f2b5be48ef6591960e53654a0a0f16d1566ea773ba288aaebe8754
SHA512 15be3cffb9c05756009d90a0ab215a25972602acdc9b31a0aa30a5875f071dcbed7953e076b210b6e99fad0a0b2bed36b297e076997927df045d7a2c6ed29bd1

memory/3020-473-0x0000000100000000-0x0000000100202000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

\Windows\System32\wbem\WmiApSrv.exe

MD5 7e905478edd2e1507843ba37aaaca287
SHA1 8d2b5723ba57b3c6e9d3f7f39d1817264fd59b03
SHA256 c42c906dc961502883e54e9b6b4808a62a52f0e542115ebc08bc3f7f43264148
SHA512 c0ad36e8bae50ae388b6b559b58ed984457ae7665565e72619bb8de9bb0c52260f0fd7388036b25628d65db0bd78c3cfb0b76b5857618b0c495cd5cf3ccf70f3

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 7e905478edd2e1507843ba37aaaca287
SHA1 8d2b5723ba57b3c6e9d3f7f39d1817264fd59b03
SHA256 c42c906dc961502883e54e9b6b4808a62a52f0e542115ebc08bc3f7f43264148
SHA512 c0ad36e8bae50ae388b6b559b58ed984457ae7665565e72619bb8de9bb0c52260f0fd7388036b25628d65db0bd78c3cfb0b76b5857618b0c495cd5cf3ccf70f3

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 9224e3177f319d1602090b3aaf93d8e6
SHA1 ce9649b4b7484eb31df62c12ff064a2f74bb34a5
SHA256 7ea30ffdc7726fb24981911d83761f852efb86adb2e0e6ff34bade4297cbb617
SHA512 7f059aab635aeb6ba0a918cd7caff144eb0ee239a4f23930fab0fbe1fd318de79878249c5a78ddb9a7dd951622ad937c041ce71d12caea1f426e7c808c3cd12c

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 9224e3177f319d1602090b3aaf93d8e6
SHA1 ce9649b4b7484eb31df62c12ff064a2f74bb34a5
SHA256 7ea30ffdc7726fb24981911d83761f852efb86adb2e0e6ff34bade4297cbb617
SHA512 7f059aab635aeb6ba0a918cd7caff144eb0ee239a4f23930fab0fbe1fd318de79878249c5a78ddb9a7dd951622ad937c041ce71d12caea1f426e7c808c3cd12c

memory/1004-498-0x0000000140000000-0x0000000140205000-memory.dmp

memory/928-502-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2088-503-0x0000000100000000-0x000000010021B000-memory.dmp

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 9224e3177f319d1602090b3aaf93d8e6
SHA1 ce9649b4b7484eb31df62c12ff064a2f74bb34a5
SHA256 7ea30ffdc7726fb24981911d83761f852efb86adb2e0e6ff34bade4297cbb617
SHA512 7f059aab635aeb6ba0a918cd7caff144eb0ee239a4f23930fab0fbe1fd318de79878249c5a78ddb9a7dd951622ad937c041ce71d12caea1f426e7c808c3cd12c

C:\Windows\System32\SearchIndexer.exe

MD5 1c6744b81e2a829165c8ad2acfe5981d
SHA1 59ac2b0c088cbdac275ea61aaf46ff0aa877fb11
SHA256 6386c719f931c57b30324cbb7efe332fc4cb834b9fb5810b216eb4923decdadd
SHA512 c5ce470ce7e768e29df76022e7e0a0f1f2655a80f182e935dd124d46096738ae974e572f951aa20148cdc37107b61d89f1b6ffe8eb2a367260b596e0d8897ebd

memory/2312-519-0x0000000100000000-0x000000010020A000-memory.dmp

memory/696-520-0x0000000100000000-0x0000000100123000-memory.dmp

memory/1356-583-0x0000000140000000-0x000000014020D000-memory.dmp

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 6a9f0a3c37057ac66f14d4864a9e1eca
SHA1 5505ac51b9f5137daf17bc80a01b6e830386f6c4
SHA256 643fafe9b62afaf2838ea400c0ed91dcd70f1b5a90c7bbfa4bc83c9ae1652042
SHA512 98839fdfbdc3323cc1fc0b886f012418f043b771857f63831bdcda97efd5c4b2cceb70553ab934a1d6e31c1f281ded31e8997ad826ff8fb99115ba7da69c6c8e

memory/2104-668-0x0000000100000000-0x0000000100209000-memory.dmp

memory/2104-670-0x00000000005D0000-0x00000000007D9000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

memory/2784-746-0x0000000000400000-0x00000000005FF000-memory.dmp

memory/2284-744-0x000000002E000000-0x000000002E20C000-memory.dmp

memory/2356-762-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 f30604f41ad059f0f944d77d9f1e09cd
SHA1 df0a97be8b7aa42c5cd9297b77e40857b8d30858
SHA256 328c3e60fa80c9075bd91f0efc1f0893fc3444de7aed45d48db1220dca55879f
SHA512 ea07855879162293d06237337518881624148ea89b260c096adf1fe69a71073b9ba1889c2eb3252724b904d1fec63ec129e95af8ade001280e422ad59a244d88

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-05 12:06

Reported

2023-05-05 12:08

Platform

win10v2004-20230220-en

Max time kernel

151s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

Signatures

DarkCloud

stealer darkcloud

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8201552c50d0d086.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3992 set thread context of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8d348f05a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9f96ef05a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebc940f15a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e2565f35a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de93aaf05a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002732c7f05a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000923f56f15a7fd901 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3992 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 3992 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe
PID 1644 wrote to memory of 4940 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1644 wrote to memory of 4940 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1644 wrote to memory of 4948 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1644 wrote to memory of 4948 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe

"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 152.195.38.76:80 tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 93.184.221.240:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 173.231.184.122:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 67.24.33.254:80 tcp
US 67.24.33.254:80 tcp
US 8.8.8.8:53 122.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 58.152.191.206.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 25.106.251.63.in-addr.arpa udp
US 8.8.8.8:53 88.35.99.167.in-addr.arpa udp
US 8.8.8.8:53 12.161.5.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 206.191.152.58:80 cvgrf.biz tcp
US 8.8.8.8:53 251.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 ww25.uhxqin.biz udp
US 199.59.243.223:80 ww25.uhxqin.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 63.251.106.25:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
NL 167.99.35.88:80 przvgke.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 223.243.59.199.in-addr.arpa udp
SG 72.5.161.12:80 knjghuig.biz tcp
US 8.8.8.8:53 ww25.anpmnmxo.biz udp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 uhxqin.biz tcp
US 8.8.8.8:53 anpmnmxo.biz udp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 199.59.243.223:80 ww25.anpmnmxo.biz tcp
AU 103.224.182.251:80 anpmnmxo.biz tcp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.242.101.226:443 tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.242.101.226:443 tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 15.189.231.173.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 124.184.231.173.in-addr.arpa udp
US 8.8.8.8:53 10.126.251.63.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 173.231.189.15:80 xlfhhhm.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 63.251.126.10:80 ifsaia.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 118.154.83.99.in-addr.arpa udp
US 8.8.8.8:53 76.235.251.63.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 173.231.184.124:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
SG 72.5.161.12:80 vcddkls.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 63.251.106.25:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 77.76.21.199.in-addr.arpa udp
US 173.231.184.122:80 dwrqljrr.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 99.83.154.118:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 72.251.233.245:80 nqwjmb.biz tcp
NL 63.251.235.76:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 199.21.76.77:80 deoci.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 199.21.76.81:80 ytctnunms.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 63.251.126.10:80 qaynky.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 173.231.184.122:80 oshhkdluh.biz tcp

Files

memory/3992-133-0x0000000000A50000-0x0000000000BDC000-memory.dmp

memory/3992-134-0x0000000005BE0000-0x0000000006184000-memory.dmp

memory/3992-135-0x0000000005630000-0x00000000056C2000-memory.dmp

memory/3992-136-0x0000000005590000-0x000000000559A000-memory.dmp

memory/3992-137-0x0000000005610000-0x0000000005620000-memory.dmp

memory/3992-138-0x0000000005610000-0x0000000005620000-memory.dmp

memory/3992-139-0x0000000007590000-0x000000000762C000-memory.dmp

memory/4192-140-0x0000000000400000-0x000000000065B000-memory.dmp

memory/4192-143-0x0000000000400000-0x000000000065B000-memory.dmp

memory/4192-144-0x0000000001300000-0x0000000001366000-memory.dmp

memory/4192-149-0x0000000001300000-0x0000000001366000-memory.dmp

C:\Windows\System32\alg.exe

MD5 d0c94dd810b273a9c789849533b037c5
SHA1 f99c09bc6f0c1d6bc8c3b5920dfa7d8f9e299d33
SHA256 29d243cddc1a6df44fe412496c6100244df3f9921f79284f1f3a2893e437f628
SHA512 dfe9cf85f804c6a5a4ee5b3aa959e910a6ab634471bc2f741ab442c9585c54df9eda8a37e5e2b84010728b3310d111d97439a34b8e0aa687256c92fe0d3ff27f

memory/4932-156-0x00000000004A0000-0x0000000000500000-memory.dmp

memory/4932-162-0x00000000004A0000-0x0000000000500000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 20017d9db1304fdf9c18ac1b1f179dcf
SHA1 194eeb33949ad1decd88e93b23dbd57d8899eafe
SHA256 f86133c8503c4c8a95041ac180311630d17702b89b51ad3310599b49b939633a
SHA512 401e2d668b23f261308326e9895e75706fe2159a66a0c9a608de789ca1f6ada79eff4b0856b62119ce6f06a4b90a8820ea4f6af98afde87dfde5af0c7547b0ee

memory/3056-168-0x0000000000690000-0x00000000006F0000-memory.dmp

memory/4192-172-0x0000000000400000-0x000000000065B000-memory.dmp

memory/3056-176-0x0000000140000000-0x0000000140200000-memory.dmp

memory/3056-177-0x0000000000690000-0x00000000006F0000-memory.dmp

memory/4932-174-0x0000000140000000-0x0000000140201000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 0dcd020850a8219cf5f59970cae4e5dc
SHA1 16f0aae13774f2d001545149926aea75d9598c00
SHA256 adabd0fb6f506c1272d4f44e7ed3b857026e5c41cd0cbdafdd98bc52f2b3667b
SHA512 7912274c9491e692e7ddab3e5109526a4d5eceb4dfd695ab6c5fe5198cb54c054eeb960f3410cddb63c8708c4e326b46a94b66e7672884121e0b4740ebfc8a30

memory/844-181-0x0000000000EA0000-0x0000000000F00000-memory.dmp

memory/844-187-0x0000000000EA0000-0x0000000000F00000-memory.dmp

memory/844-190-0x0000000000EA0000-0x0000000000F00000-memory.dmp

memory/844-192-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 8e3d7238bc3e025657f6132ed941d6b8
SHA1 84d81be5b306ef54dafd440fc7ac89a7487ba7fb
SHA256 ff06ca14f3f9cebf3e999515ee60690b7f211f8a54166a9b35533faebc38afc2
SHA512 c7c6cef9f3cbbef0da47b546b1f520bbfcb8ac260c63dc251ecfaf849f048ca6f12b74b1b394d168e1543a2c059abc8e1698e759bd92497b4b9b9000841d27fc

memory/3920-194-0x00000000004D0000-0x0000000000530000-memory.dmp

memory/3920-200-0x00000000004D0000-0x0000000000530000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d04b9ca30cb91a3faab649fb0503614a
SHA1 bf035a01245763d39249bb3b8330d05f28b1731b
SHA256 acb65cb4f604ce58503f238b4f96b3e6f006093e0e33535b77861df353075166
SHA512 a46f417fefdfd9172f2f4b442c5cec86a5f955b18f22bebc888bcc880de7b233f9b3d40f0cbf7288c27c1b986f5174703cf37f8f511b74e72be0f8926d9e206c

memory/5116-204-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/5116-210-0x0000000000190000-0x00000000001F0000-memory.dmp

memory/3920-213-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5116-214-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 e7fd961fbc91c8307b8a7c86b91fb5bd
SHA1 66789386235bb02a912133c284f7a5a29e9d0498
SHA256 22e90eb1eb5500f87c276b7f0a9f78c0d95f846fa9acc4a0d130e1d997578f9f
SHA512 fdcb069a7d0b20058eba58fae2ed271da31d63275efc889979f85b0af632d618f2cae182f91727c8bff20442bb0f1bbfbe5ab2cf9b3d013eb0b3a842c03e53e8

memory/1780-216-0x00000000014D0000-0x0000000001530000-memory.dmp

memory/1780-222-0x00000000014D0000-0x0000000001530000-memory.dmp

memory/1780-226-0x00000000014D0000-0x0000000001530000-memory.dmp

memory/1780-228-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 3002e9a3eb52d579d75ef53cabc2b2da
SHA1 f4519d4166058e4f55946b918727a4b32a73e407
SHA256 89eaf4a80069dea74a881fedcf44ec9f4dbc54cccb31812b84552f8b49f03c62
SHA512 d94984b71f0d2a3301b9ac6051139360458c89ea72cf9a44de16e73b2a97ce5733f09a02b2dd8f8a4278b0812bd9c324614f80ca6e0e9e7488c01428507192a2

memory/1616-230-0x0000000140000000-0x0000000140210000-memory.dmp

memory/1616-231-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 8f95be67a2ce00dbe3556c211db87f35
SHA1 0e8126d9ec23a93959bcf8039ffbbb176e096204
SHA256 8ec31f049f51df1a362a49cfc8f37a51b889872a31d7dc2243c2a5bfd3571a14
SHA512 276fcc1fb8a344e6056639d2311062ce5892414f85ef90ab5fe3f85be0cde814dd3cd16ee7e783ae08cfa0b1a3d95e7884ff576f3f7aad8e83a75fe097b2813b

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 34303b41680f77b205d9b21b6023a4e2
SHA1 f93aa7b1f5961981398d49be09f0e172c652c89f
SHA256 f62275b77cbdb8c43a0094232bedd797d173ca7335c052f941e657334ad5357a
SHA512 359aca96ce6fd6de5229edc4453a4537a14e82135a69941706952ef6c803c95984b5aee8ed153569180ffbfbfa9c9db1d43e88dd1fcc8c5c78ccbd6e0f910e93

memory/3492-264-0x0000000140000000-0x0000000140226000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 d74944d3471004ac1fc86cdcc3dcd3b1
SHA1 deb58d1a1645d4a95814388cc70a033f4e180172
SHA256 f051972c0e6db66d374482c3c8f7064fcff08b355efab9b336f0d439a3545788
SHA512 1d4ff4d5814dd89ad8273326f742df2971f89efa2a5c806957cd4304eaba5bbcdaedcd1fabcd5cae1f4f2d345b32cd3a97718087388693cf2d846379ea838fb0

memory/2028-266-0x0000000140000000-0x0000000140202000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 50be656239a16b23efa3d2a25d5f6da9
SHA1 ea59a5ea20651832e22fd0b4e20c77b82e1d9410
SHA256 318c17dbc83ec4fca3f5708db7a634ca41d19fb4d7707cec9407f8fb838419cb
SHA512 c67b5dcb7ba474bef26013d3420c06e88854fc6de0eccc7db1e1e87cffee28f82446f50c5dd2615cddfe32de960637586955318fd6c498f2595d7e339fbea1cd

C:\Windows\System32\SensorDataService.exe

MD5 f053977e53e2da0b52d2401bea7b6c18
SHA1 037c97e1a8855a5ea2ead278522bd5ddfb369872
SHA256 413e982e621b55db5c0a113411e3455d406e3fb1cc80cea33a1ac69196c1093e
SHA512 c6523b0a1b1b974c30bcbf365c42b5ed1cf0db5eee6e46887ccfb187756d712f2373e63f582f3980a26a2acaaceb56281c7448689259d7b3f8addbb187e9e6be

memory/3512-296-0x0000000000400000-0x00000000005EE000-memory.dmp

memory/2068-297-0x0000000140000000-0x00000001401EC000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 9a2f722ed7ad887b6baf741adee11ac8
SHA1 360babb56b0521d0aa6aa026308055940925d753
SHA256 beeaad2b492e3e5b75b751a65edb2810e5c99917421c1b2c2d61512d9cc25770
SHA512 61348ac426c63a7c4c786c247d59d76587e25b744e4f99592066c647b25e7d08ccfe5ca57dc9e493358cfd91bf136d3d064ab2173303f8787effad10f14e216a

memory/808-300-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 2702417ee26c153a9fc3929fa0aac867
SHA1 d45c9bb53b21ba5652adb1aa6aa61be6c4ded981
SHA256 730aa61c36e9fc6eea48aca60bd057fcd58cc9ad7caea4ee297d5933e1bbb7fe
SHA512 368d2f9af7da9eff5b91b01789dd50814f7ab289d6e25e61ef97a55370232a55ee577ffdfa90c639d011d93467f6408feaafe7e39e1b07c7f64678197a92d563

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 d45f77cd35eefad25251cb02567b5a6e
SHA1 a3976b3a3a541e8cfee4ae21a8d5561d34ed4ccb
SHA256 ce0bede9bb6a76f09849d1b32063a9b13f85342497579883bff58740c94de8c3
SHA512 0f8c7322a60f82737de755fb2033686f00873a46dfd046ac5e590b9ea5f73c19c54fb9428bec4ad2538524c586ba6785c816ed36cc569e67ffba221dbba04303

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 d45f77cd35eefad25251cb02567b5a6e
SHA1 a3976b3a3a541e8cfee4ae21a8d5561d34ed4ccb
SHA256 ce0bede9bb6a76f09849d1b32063a9b13f85342497579883bff58740c94de8c3
SHA512 0f8c7322a60f82737de755fb2033686f00873a46dfd046ac5e590b9ea5f73c19c54fb9428bec4ad2538524c586ba6785c816ed36cc569e67ffba221dbba04303

memory/3656-320-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/4148-322-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 d64441988c96be8db277fb5b36003bcd
SHA1 4a117c179f980833954e3aa5567d034f16eb0d67
SHA256 27cbc6ce6331b60f8b6803e595cf1abffc8338eb69c843b27c7bf03371d958cf
SHA512 13527315d593c0ec8bb8a9984554d027bbf91843b06ef8d47ee733d37233b9eae35fb7d6fb392ec2d99657ef735e6d20b3340a1ccda89dd16569a6a2bcd50def

memory/2112-342-0x0000000140000000-0x0000000140259000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 82e6ee2e347d323fa122fc5009950cd2
SHA1 770326883a7b7153ba6a9d53e15e581a35bb08ba
SHA256 c62685a376ae17c8f640ac78bf8969cbd216df983b494206526e8652a04bf64c
SHA512 6f5da78787a75c7bc6d5bc8f5d0528a3003aa807ae2962cbbd726e8a12c054eb793646226e783a1f512956cdbcd5a84610284a051158418dd73bca008f532f0d

memory/4632-344-0x0000000140000000-0x0000000140239000-memory.dmp

memory/1000-356-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 8392d3ae7459f5d1786dd7f5eb878a83
SHA1 f5022d85b8ef124003f8ca5225da3e6ae057c962
SHA256 2669de31392d0fcf75721505526f39116b9f77504d664c3092a91893c82607ba
SHA512 690fe35ba1b45e9e72d9cacacc55a50fe17a80d39a3ac7184b72455e82a942a8bd245161da793c442dd7401ae4d2362a55582e5f6273555d74066b711376bfa6

memory/2076-359-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 86c308b2f83e42aef78ff3fd59911ddd
SHA1 e2cc50ad58cf7e400a7b1b07ba182e180a31fc6f
SHA256 75ea2a1b0f91a85825749f2935d313f1a8f22a58cb5c43dd13cb90e643f15ad0
SHA512 0e15490765ed8b4bd6a87f8107e0421f927831991958c421972aff537c56411290ef286a64bc35d0bcecc72d1976b34bedfee872a931d3c0af4f4d9583a16b64

C:\Windows\System32\wbengine.exe

MD5 ca0bda2a7dad69a66e00648dd4cb9337
SHA1 ba4200699cf001f95632d0324042a612713041e7
SHA256 d79596c79c61dd2a1e6c6caea13f89b556ea176683abfba4ad2b19caf4269ff2
SHA512 518ffcbf6b9ee889897f0545c833c8afbf9645a23979028cb84b83b5a1c7987638c2ba1ec66094543756fc5ca44803f1640581df828883cae537a5a5e597dc87

memory/3820-385-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3880-388-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 9b77c41ef1941e59b7da42004b0cee35
SHA1 235d924407507edba2b29531ce3d7fa008f267ad
SHA256 86ff7bc2952c04214840a602223ad9b819684db0755d614c6f5e3aeb4ce8a334
SHA512 d3134a6d7295125c0834283457ceec50a5cb6f544c90f55bec6aff30ae2a6565fc7b48d01d0ad7b97f534ce42d0120395fed5b93812bf5f8c5f1b6137f5c1164

C:\Windows\System32\SearchIndexer.exe

MD5 dffa5648a8c8ad2c30ff61d127c521c6
SHA1 f49c34baee4c551775214d3acba7f06702418b16
SHA256 c55aee63c87b6234f29d57295732fb4e855236f654ba09078151f2d518d3717a
SHA512 502877b0a4dae35ccc2cd43e89845a03ab8f5ca15a0b19d7b87b35a1790e372e1eaff55af5349097b2e0c15e29d1d018ef4d71ca31ece5c9e661e697613a168d

memory/4192-403-0x0000000000400000-0x000000000065B000-memory.dmp

memory/3056-405-0x0000000140000000-0x0000000140200000-memory.dmp

memory/844-407-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4704-409-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1644-411-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3920-472-0x0000000140000000-0x0000000140237000-memory.dmp

memory/5116-474-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1616-498-0x0000000140000000-0x0000000140210000-memory.dmp

memory/808-516-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4148-550-0x0000000140000000-0x0000000140169000-memory.dmp

memory/2076-578-0x0000000140000000-0x0000000140147000-memory.dmp

memory/3820-585-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3880-587-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4704-596-0x0000000140000000-0x000000014021D000-memory.dmp

memory/1644-597-0x0000000140000000-0x0000000140179000-memory.dmp

memory/4948-636-0x00000164F8B30000-0x00000164F8B31000-memory.dmp

memory/4948-637-0x00000164F8B50000-0x00000164F8D50000-memory.dmp

memory/4948-638-0x00000164F8B50000-0x00000164F8D50000-memory.dmp

memory/4948-673-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

memory/4948-672-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

memory/4948-674-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

memory/4948-676-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

memory/4948-675-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

memory/4948-677-0x00000164F8FF0000-0x00000164F9000000-memory.dmp

memory/4948-699-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

memory/4948-706-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

memory/4948-727-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

memory/4948-728-0x00000164FAA80000-0x00000164FAC80000-memory.dmp

memory/4948-761-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-762-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-763-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-764-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-765-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-782-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-783-0x00000164FAC80000-0x00000164FB080000-memory.dmp

memory/4948-784-0x00000164FAC80000-0x00000164FB080000-memory.dmp