Malware Analysis Report

2025-06-15 19:50

Sample ID 240406-fl9r6sbc2y
Target 7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda
SHA256 7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda

Threat Level: Shows suspicious behavior

The file 7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 04:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 04:58

Reported

2024-04-06 05:01

Platform

win7-20240221-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\496597a078a61a12.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\psmachine.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_sw.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_zh-CN.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_kn.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{1FD4E3A4-6FE0-492C-90E9-7EE360CDB9FF}\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\goopdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM18FD.tmp\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C7EFDF59-F9BF-4F31-A211-3B63D9780C6D}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPCEE3.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP517A.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP4A3A.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C7EFDF59-F9BF-4F31-A211-3B63D9780C6D}.crmlog C:\Windows\system32\dllhost.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2020 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2020 wrote to memory of 2356 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2020 wrote to memory of 2544 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2020 wrote to memory of 2544 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2020 wrote to memory of 2544 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2692 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2312 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2084 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1968 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2944 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1800 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1800 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1800 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 1800 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2612 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2444 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2320 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 556 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2932 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2140 wrote to memory of 2932 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe

"C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 254 -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1ec -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 264 -NGENProcess 25c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1d4 -NGENProcess 258 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1ec -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 24c -NGENProcess 258 -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 274 -NGENProcess 1d4 -Pipe 270 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 238 -NGENProcess 25c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 24c -NGENProcess 27c -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 254 -NGENProcess 260 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 284 -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 288 -NGENProcess 260 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 278 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 27c -NGENProcess 25c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 294 -NGENProcess 254 -Pipe 288 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 260 -NGENProcess 28c -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 25c -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 298 -NGENProcess 28c -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 2a4 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2a8 -NGENProcess 28c -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 204 -NGENProcess 1e4 -Pipe 208 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 254 -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 25c -NGENProcess 22c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 204 -NGENProcess 264 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 230 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 268 -NGENProcess 22c -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1b0 -NGENProcess 204 -Pipe 230 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1b0 -NGENProcess 204 -Pipe 230 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 204 -NGENProcess 1e4 -Pipe 1bc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 1dc -Pipe 1b0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 22c -NGENProcess 1dc -Pipe 270 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp

Files

memory/2724-0-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/2724-1-0x00000000006C0000-0x0000000000727000-memory.dmp

memory/2724-6-0x00000000006C0000-0x0000000000727000-memory.dmp

\Windows\System32\alg.exe

MD5 e4d53eb18d1a6a3703fd44f75c1ee595
SHA1 11c606b2e03666ffe33c1e08c16821f1f9df24bc
SHA256 70c24dbc3ded0acf08fdf4f5277bc4f5ac390d772ee4ec31a20ae7854a86633b
SHA512 ee9309317c4da07367ae3d46929f556e8303fb5b5e2340cdd71a26a780ac3d83f715e78e1cfe9b06c39aafd57db29eb1f3bd9297c74b1fcf34724195828c31df

memory/2540-16-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/2540-15-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/2540-31-0x0000000000840000-0x00000000008A0000-memory.dmp

memory/2540-34-0x0000000000840000-0x00000000008A0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 181c7a44276d7732c1527e6ae4c8bc3f
SHA1 b585335903e6667227f8a603e3b688b138ec177d
SHA256 223a02978c1312c683a849090b9dc5f31bac7891778eeabf573d110de7dececd
SHA512 1ff033d915eaf1a6e98c4edbb39295befb9d186b9a2ba9a72923990c0a7f54683f0d630437da3faf6dbedb0790118d0216065c12a34630d353168838ba84f0da

memory/276-94-0x0000000140000000-0x00000001401DC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 3bb514157d03efe49848151c4cc15b95
SHA1 52752b808b209496e86ba99133f0ffd2fabfc683
SHA256 6559339dd340db887063d4104aa01987e4384b686472d813f96ffa7c88006eec
SHA512 d19ef771211db4b16f6193fd77b59a60743329bf074792c0d6bc23b35bd8eb5d9a672e1db996ca739f0568da39c1024bb76cd754898a15236759dd72df5b1569

memory/2716-97-0x0000000010000000-0x00000000101DE000-memory.dmp

memory/2716-98-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2716-103-0x0000000000230000-0x0000000000297000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 245cd3d10f21cd331f164f0c8b1ba655
SHA1 f6d0a11d76a2a4ef561236100225b22bdda59fa1
SHA256 a0bdf6d60a699f04b7f8e7a3a415e78cfadda4d954d37fca18d2fdebf952911c
SHA512 7b8c7806cc980ff625c58fb481640f161b9859eb39eeee68254a5eb7da2b84c5b023bf1a3085cb231ea0fa9787bc41cb527929bdccc249a21792db6fa7ec71b9

memory/1948-113-0x0000000010000000-0x00000000101E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 44c2c379f4fac49e09d5d97d6fefbc19
SHA1 8f135d2f16edc2065bb748fa2b99a0753f4e8d1d
SHA256 b5d08f4e4697aaeef01befd6feb5ea59d3e25bcf16818b41b3b95dc4c8de2651
SHA512 2916ed2d57b4b3137332018ce97a0159db7aa4eef28a33a7ed260f4af909c4f8809a8aa4799b0b68bd9aeff1acf767fb1593decd6b7fcd9d935637bbbe670c9c

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 dd64d7d0ef550daff1564299cb986598
SHA1 353c52da98ae664d19d7ba8374603a71d82eb393
SHA256 03063760f660c87af11661c2ddd00547f8d9f1c6a0922444980713c959e49745
SHA512 de6169ac2710934ddfdaf696623bf2a97c37125859af2fa0425bc7fbc7a5ee4e4f933ada6940feca8bf3d94bdb6c171fe58d558f41f43bb9903a7e2a2374caaa

memory/2140-121-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2140-120-0x00000000002F0000-0x0000000000357000-memory.dmp

memory/2140-126-0x00000000002F0000-0x0000000000357000-memory.dmp

memory/2716-131-0x0000000010000000-0x00000000101DE000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 60852a44909c11dcfea9cd9951876faf
SHA1 ac224a6e39a19bafba39d9a4f556a64fba3404ae
SHA256 b1fda08fa153a8771e6deed08a529a99a43aa39de09bbe010cec2835eef9d38a
SHA512 9c62f54929edc0716e5e3e50954965d3618680326a2b4458667c9af3eb4fcff048b30af2462334af139cd673060d4a380db8e9d68f6612a4f41f11ad6237eb2e

memory/2724-139-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/2020-138-0x00000000003F0000-0x0000000000450000-memory.dmp

memory/2020-143-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2020-147-0x00000000003F0000-0x0000000000450000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 af901fc78eafa2f8d24dbfebf108863a
SHA1 d049976aceddf160c22b2af0e5bd7cf58b41d288
SHA256 f141cbdd8f643cf869bc0d48fe6e5487544e3372c5a5d0cbf9dd9017f7e0ee53
SHA512 c5fc1d1821170eec48eb3388bf07e56ba567aa57d43766caea091197d4bce9ec4e3ab0608a56be46eec017b73f5e8f22c522540706e675d206543cdcdb765571

\Windows\ehome\ehrecvr.exe

MD5 1bdce016f4c4f494807a43509b0d2f09
SHA1 85d29385f33eea0c92d5e9fdc04f16a864fddf8c
SHA256 8fd57800bcaded554c49120d8655d0ab9e354512e9805baee1b24cd4b0546f9d
SHA512 300fc6361f772df72eb5b606d18250f971729bff6a09f71c47f6fbcefbfa2498785a2dee365584db9b416437931a4b951d52b4ea2161251f378f671342ff3281

memory/2540-159-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/1228-158-0x00000000002B0000-0x0000000000310000-memory.dmp

memory/1228-161-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1228-166-0x00000000002B0000-0x0000000000310000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 0354d2c411aef97b1d2889d8eee6b777
SHA1 918ab3d3d43369ce927e6cc5d804d7c03bc74726
SHA256 30e49cdd76f8b343d5a15068a8b7c74b1b9fc8b33e8ba61d945681e63e2759cf
SHA512 3e02b754bfcdeb0ebbd1bcdd6cd9cc2cb781f30bf920f7755d68464cdbcd403d98a3ed6dd3cb0556654f57be46f2605c1483aad2bdb4736defa4edba43791ef0

memory/276-172-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/1228-171-0x0000000001980000-0x0000000001990000-memory.dmp

memory/568-173-0x0000000000B80000-0x0000000000BE0000-memory.dmp

memory/2356-180-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2356-186-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2724-260-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/1228-175-0x0000000001990000-0x00000000019A0000-memory.dmp

memory/568-176-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2356-263-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/1228-267-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/568-270-0x0000000000B80000-0x0000000000BE0000-memory.dmp

memory/2140-271-0x0000000000400000-0x00000000005E7000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 40a781bf935f7bf4fc6bf4827404838c
SHA1 7c292e7f8b622bf1c37496a1a3fe193f88ea85fa
SHA256 e058b7f94ca12ca6abf5347eee728538ac0d9c15b3200d74632a9b3fd26f801b
SHA512 9e80085f22cd49cd80c49832710b87ad501819dd41c3966a47c69d35fb566ea845a6ad875839c671b3497d14dd98bb9f77391bbfc779a78a9124efb797d47a2f

memory/2356-278-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

memory/2356-287-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2356-286-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2356-288-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

memory/2604-291-0x000007FEF2B20000-0x000007FEF34BD000-memory.dmp

memory/2604-292-0x0000000000FA0000-0x0000000001020000-memory.dmp

memory/2604-293-0x000007FEF2B20000-0x000007FEF34BD000-memory.dmp

memory/2544-294-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2544-295-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

memory/1644-296-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2544-297-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2020-298-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2604-299-0x0000000000FA0000-0x0000000001020000-memory.dmp

memory/2692-307-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2544-304-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

memory/1228-313-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2544-317-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2544-316-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/2692-315-0x00000000005F0000-0x0000000000657000-memory.dmp

memory/2604-318-0x0000000000FA0000-0x0000000001020000-memory.dmp

memory/568-321-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/2692-322-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/1228-325-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/1976-327-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/1976-333-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2692-336-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2692-337-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/1976-338-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/2604-343-0x000007FEF2B20000-0x000007FEF34BD000-memory.dmp

memory/2604-345-0x0000000000FA0000-0x0000000001020000-memory.dmp

memory/2312-350-0x0000000000BC0000-0x0000000000C27000-memory.dmp

memory/2312-348-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/1976-354-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/1976-353-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/2312-355-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/2372-358-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2372-365-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2312-368-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/2312-369-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2372-373-0x0000000073C90000-0x000000007437E000-memory.dmp

memory/2604-374-0x0000000000FA0000-0x0000000001020000-memory.dmp

memory/2084-376-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2084-380-0x00000000007D0000-0x0000000000837000-memory.dmp

memory/2372-384-0x0000000073C90000-0x000000007437E000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 ad0b9f99f439f016e749842587e53129
SHA1 fdda5472fb42656b106ac2896c7ce764e8ee5986
SHA256 7327a9a8d5b07676a6f207fa02f3a4d937fdf9442bedbcce20b5ef99b8607d2b
SHA512 dc1f618a27da9683a200d4eefb79a65ace9aab5caaeb36e0be3221371005831c0513e43206424720268c5f40a1a7280ec1b8c58e2ff3cb9c0ac35f7e504a9331

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 4384094d9accfa80e182239e0c48e524
SHA1 ef74476b48434906ecd29d8f6593c9b2c29c23a0
SHA256 f246a0f776e7899a17d85267f92318178826aa8e96e3e197d2b13a84e1a9b4f5
SHA512 fbb43316bf523d50ac0109a614c65a35c30bdb276c6c42626f5272f06ee1bdfe492731d23a6e855205d434b9569b7088c7f36381c8ea5f002b258b8bc105d7bc

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 525a7eeb10109d1f10f04a885a5c2725
SHA1 7595f222898d529d7c2b76665b495832e95bd970
SHA256 86a2749059e5e7ce7a266c2bea0e8e906affe6deda0d08d7d83610f42338174c
SHA512 604cb69c6e31ed749bf6fbd66d3f97c72e9bc04145dac861c92fe984060ffd2104d6b2484db6e3dc8a50802a10d13cf3ba91fe59d4d8aa293ffabd583a04a8ce

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 b1df58a56062699f5b9ff929340adbc7
SHA1 9d4f3598d2484f3c5b6a58322d156858809c8d41
SHA256 c1f25f7489c0d04b13e8ade39060c1be5c442ab5ee6cf60a586b8b6dd6457a5b
SHA512 457614d017ef129ad040916bccc1cf39bddad438d8c519a9ec75047cf1eabbea002b29543d4906626e57f4c5e39126d2561735aced1fc2c38dfbb1bd24218964

\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPCEE3.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

MD5 5180107f98e16bdca63e67e7e3169d22
SHA1 dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256 d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA512 27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

\Windows\System32\dllhost.exe

MD5 59a15037577598563198fda62104028e
SHA1 3e703825ebecd5b668d1658017c382d7ba1ea60c
SHA256 2cfa6a0bed59a8457077d89d3b4282ca0887599b1f97a57b79cbd2d7b89f2386
SHA512 408471194acb3288f29d5f4244df3cbf5bcae836c2db3bd04a5b3c558ec16e932a76b84eba1673809091a19aae45b28bc2172b46b92137158ec422e8e595f29c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 2c9c15fc716d378364a13578fabf5646
SHA1 e20d4dd1588c49f160b4bff002b45f77847da6e8
SHA256 952ec439ceb3d3a1f2fe4734cb3af5583ec036bec65fa2ce1b60340d3959b911
SHA512 4d2b8d76561b5e3d96a15448cbe306886a8a83b583ac9ded43f02a80f9704ce0b1b110955538ca83488ebb6fac2d10e2ddff5ec78c5cf75db9a4934bd406b9d2

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

MD5 5fd34a21f44ccbeda1bf502aa162a96a
SHA1 1f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA256 5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA512 58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

MD5 8804835fb71ad482679c97d1a767cbf6
SHA1 9c5031e7245a57883de199c72f142f15aa156412
SHA256 8752635640ff0d51191c33a91a8b3a7c1ba5f57af860471d288c9549b301f827
SHA512 ba209979712a3059cc91ab79096318d21bf764773f0c4c517408f02ed621ca54bfcfbe760b8dde4a6651af289fe99b7dcc739883f281680ba7241a41a016ba97

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

MD5 3d6987fc36386537669f2450761cdd9d
SHA1 7a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA256 34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA512 1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 04:58

Reported

2024-04-06 05:01

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_zh-CN.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_bn.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_fr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ms.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_da.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\psuser.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_hi.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_hr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_is.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_pl.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_sv.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_th.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_zh-TW.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_fil.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_kn.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ar.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_sw.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdate.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_de.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_el.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ta.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_iw.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_te.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ur.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ro.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_lv.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_sk.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_tr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\psmachine.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_fa.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ru.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_no.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\psuser_64.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ca.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_id.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_mr.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_pt-PT.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\GUT1C1.tmp C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1C0.tmp\goopdateres_et.dll C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe

"C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

memory/2412-0-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/2412-139-0x0000000000400000-0x00000000005D4000-memory.dmp