Malware Analysis Report

2024-11-13 14:01

Sample ID 240407-2yc5maha7w
Target fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d
SHA256 fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d

Threat Level: Shows suspicious behavior

The file fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy WMI provider

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 22:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 22:59

Reported

2024-04-07 23:01

Platform

win7-20240221-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3202a36278a61a12.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\psuser_64.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_sl.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_hu.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_es.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_pt-BR.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_am.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM1E79.tmp\goopdateres_it.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{38D93637-65BB-42A2-B2A5-475F4F6110F8}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{38D93637-65BB-42A2-B2A5-475F4F6110F8}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{DF48634B-63D9-413F-990F-705C140B8BB6} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{DF48634B-63D9-413F-990F-705C140B8BB6} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2968 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2968 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2968 wrote to memory of 1588 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2968 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2968 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2968 wrote to memory of 1688 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 920 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2372 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 1792 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2020 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2848 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2980 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1516 wrote to memory of 2576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe

"C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 25c -NGENProcess 244 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1ec -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 268 -NGENProcess 240 -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 254 -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 1e4 -Pipe 27c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 288 -NGENProcess 244 -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1ec -NGENProcess 124 -Pipe 1f4 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 udp
US 34.168.225.46:80 tcp

Files

memory/2972-1-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/2972-0-0x0000000001EA0000-0x0000000001F07000-memory.dmp

memory/2972-6-0x0000000001EA0000-0x0000000001F07000-memory.dmp

\Windows\System32\alg.exe

MD5 649f40101f35c00415c5037a934b8564
SHA1 2928a0aac2f4eeb65902177d38800602dfd00fcb
SHA256 f13be82a5e41846248adb2b106efa901de4513449810646d36b9c8fbaa6afc28
SHA512 f4e69c7e17f02ae143de06ffcf9aa2f9e5b7e6cdbefa7556715eeea454416e66d7e1c26fbb1dad641382b1dd8aab0461dbd29b0944636da075685662a07266d8

memory/3068-16-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/3068-12-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/3068-38-0x0000000000390000-0x00000000003F0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 11c6036ac3b3302a0c9c5e756db13abe
SHA1 e484cca23318558bedb0ee499d6068b408c2deb5
SHA256 588bfd5aacd82d668420a659447e70eb4ebe38deb8d65d4755663e944f084589
SHA512 8b48d99725cad5d39235b73ad9c1d920f430a043a539fc8dbc70e8817aab19d5d02ecbbafc5d5fbba736cfa4b7abb015a5b87ded2ac58b9cea39302962f7d9fd

memory/1668-94-0x0000000140000000-0x000000014009D000-memory.dmp

memory/1668-95-0x0000000000A80000-0x0000000000AE0000-memory.dmp

memory/1668-101-0x0000000000A80000-0x0000000000AE0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 280ab23b90146e466a376f8fe4648a53
SHA1 891db9fcaccff010fde3a381989e1ddccaa2f0ab
SHA256 1000524f5269d1f0b072b3f413fa8ab482c8642ffebce1ed003598987538aace
SHA512 8c63b6acc4056ca6a5168d1f0cb2f69ab65a988d417beafe31ddf5e0bdfd0457bcaf929ff6cd697acb6d752a1bcb2a1fcd433cdbc1f039c1fcc311f0f0ddcdde

memory/2728-105-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2728-106-0x00000000002C0000-0x0000000000327000-memory.dmp

memory/2728-111-0x00000000002C0000-0x0000000000327000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 951f23d8d6f604088edaf6d08d8e6aa4
SHA1 6d61f5785c947c897daefec0a350c37ce2bc405a
SHA256 e508b28f94f8ec75e27ebfe5af8507a7136d6c17d91e5495dfd4fa4e87fca26e
SHA512 90a4d5385836089168b6cc143039ff976756d92761a736c6f915aec3e4e85e560b48041ec4d7a5c3ae68ca055625270b63858380bc179dbf739d65ded5c4a508

memory/1028-120-0x00000000001E0000-0x0000000000240000-memory.dmp

memory/1028-119-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/1028-126-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 a5986bd85c1c69eba78c07229f5ce0d2
SHA1 fd1675e5e5dd2f9b445d51f21823779da34be7e0
SHA256 ddadd4b25ec9abccc955c0b598b8677c6d5d3336038493620f48201f8f037fbd
SHA512 182bde394f585604f1c7785dfa26cc302192102580e68c5d8fb2d9251a8d965fc8547d64cf745993bfe74fcf39d3eb73ac63522a4de37e42df84b8d3a2e6e947

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 390ff9a1be9a20080ac2c48197e40b37
SHA1 fc88cbcfebab8f13f2d26c5e7980d1800d1f2d1d
SHA256 e18efd82f8e9a7dcc08f74461e1f31325e77712dc474c82e936795bdc167d44b
SHA512 1e2f7749bf2187b939a518d89dd85aa802ca48f59d707fda71a0d5468efa963d5ef496dabb73b6037e8b83b00176f8beefc908bb7308ee499a1ae9da9551363c

memory/2972-136-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/1516-137-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1516-138-0x0000000000520000-0x0000000000587000-memory.dmp

memory/1516-144-0x0000000000520000-0x0000000000587000-memory.dmp

memory/2728-154-0x0000000010000000-0x000000001009F000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 010595c69f8c9dd518e39714a03cb9bc
SHA1 70004d05e014e5afbcf71200c3e49c6864506a0a
SHA256 1c2c45edea146852498b4fd9b328e063a92377c571f71823031a99ab20b17cf8
SHA512 ca9dc2f8c4afcd99224a2643343b8a7424c9ecf9480e35410e25d73b71ab5e13ecd4ce4b6f5f85e9dbc6e8600e1502a7aa1c8419f5bd3cc5514c9b1846531f3f

memory/3068-157-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2968-156-0x0000000000550000-0x00000000005B0000-memory.dmp

memory/2968-159-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2968-164-0x0000000000550000-0x00000000005B0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 c723a84a1cde148c14467e421d42f5be
SHA1 2ae183abeca47023c61e97a3df9ecf42ef94fa97
SHA256 46909c0db38dd0a54d1b5469068690837b1df1efd116ebfc0c60880134c7f0c0
SHA512 013f8eec5143e84604357afda0d37be2fe8901f6868736e3f840a5fc1d0e899e19e640a9646aad2ecd7dd11f0b5ecee74c9af4b6e099741a88385d17bd2da6e1

\Windows\ehome\ehrecvr.exe

MD5 ed6540ed2906a0a4338a3834a083dcd1
SHA1 eb425ec55d9711d7a82e31a84bf81c43c555d357
SHA256 ed41a0061dd45d16e26745de114258f9249ad3e4f062e87966d564c7a485cc6c
SHA512 56cb678038b1516e63422eb10ee67a6a13466704efe6efd53c810d24c86e78b216898fe4ae73a97851ec56091401a32ed5cff34aff6ef696b5e059f4b21699dc

memory/1668-178-0x0000000140000000-0x000000014009D000-memory.dmp

memory/776-180-0x0000000140000000-0x000000014013C000-memory.dmp

memory/776-185-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 bf8781f26a4e071fd08b9144e01fbd1f
SHA1 b461585e39623e6cfd6ed2b4529ccaf4bd97fc14
SHA256 6eb55030206d94785c20a5e3dd1b698cf71c436790e2a2ffe632fed6662e2fe3
SHA512 5c8910b1ee1592b0dc8bbd7b8415127aee02905874faa6f135d35a081863d177a07049759f5345975d849adb40d707f2dd2a77f649ab22968fdc1b9d6a895ffd

memory/2400-191-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2400-198-0x0000000000BB0000-0x0000000000C10000-memory.dmp

memory/1028-274-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/2972-275-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/776-280-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/1516-289-0x0000000000400000-0x00000000004A8000-memory.dmp

\Windows\System32\dllhost.exe

MD5 262f4dfac67c95164d72f76fed393aed
SHA1 de67b7aa3bb7872d48ffe25ba03648bd07470d81
SHA256 e5bc1a68ca51f0160155c0a1c0fddbbc5fb43cd4c9934f55988dbb0bfb3f27a9
SHA512 3448341feab8572675e0d6509337784d91df81420baaf7f508343efbc40b13b8f08f679e66f7bf80523d35088a064765d77bb689ec27755c64129b0872ef9ea2

memory/1588-293-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/2992-295-0x0000000100000000-0x0000000100095000-memory.dmp

memory/2968-302-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2992-303-0x00000000008E0000-0x0000000000940000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 ab441bde882341bed6a68e176bbe15ac
SHA1 7731a31529c57d08209bea29829ab36055b0d864
SHA256 1a4af06c10038f498786b2477a20075de88580f969b0ca98b9ff63702f417c4c
SHA512 b6152c371c9553aded3999b2b2bd7a36645927371ee6d0066937c4d7e1168f29493f84879a54a6eeaf3e4530252b39b509d97c38875880989b60bc646d00da09

memory/2592-307-0x0000000140000000-0x0000000140237000-memory.dmp

memory/776-314-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2592-316-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 f23fb699ca90e94ba0fe6a198a85cf7b
SHA1 5e44a242438534a292d3664ee84eea8df73f5edc
SHA256 d1a807683529fb712b71a44e7d15821f9044dac14d7aed8a86c958f672c24d65
SHA512 c97858c373b293bc5db7f3c688ae5c260f2f2d5dff4ef455a23e8b0d368791663e42773e0c390ea0856d4e9781affc7cf4390e47892ab4dc45b911ae1f880c4e

memory/2596-329-0x000007FEF41A0000-0x000007FEF4B3D000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d808803698e57bc6e59125eb1f919337
SHA1 4fdf09332867df629006a82e49d99abd4e098b04
SHA256 cf2492f53f3b97a35d3de487e9acbd5d480c83a110676cf36c0f4524efc51eff
SHA512 4c89ce3024087917ab4775649231fb65324fdecc1ee4f70d46a5e0bdbe4af2350d78cc86426ef322dc2c986bc468bbe4294c6c60b8ccaa5ab3b78f42a1d988ab

memory/2596-331-0x0000000000EF0000-0x0000000000F70000-memory.dmp

memory/2596-333-0x000007FEF41A0000-0x000007FEF4B3D000-memory.dmp

memory/352-336-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/352-338-0x00000000004C0000-0x0000000000527000-memory.dmp

memory/1848-339-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2400-341-0x0000000140000000-0x00000001400B2000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 7d580551e36a27414c55f9c36233a6b6
SHA1 7be8916203e71ca76223ebf471a026ef4dd7f64a
SHA256 1abb3a13c12897c821a4d77432125e0bf5f8cf2caad7c1c6aa137596e36498e1
SHA512 b679ebb683b6a5ffceea6f4ece8f9f7911e8410b38a28917ef7c2ed7ad16bbba815b401fa69184f069cbd55865054a5bd61f0b0a1262c23cdc50d048560bc464

memory/1848-359-0x0000000000FC0000-0x0000000001020000-memory.dmp

memory/1848-361-0x0000000140000000-0x00000001400CA000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 31053717d82707aef40e6115821c67c6
SHA1 c464d42e1df0754d0d2e70f5a3456c6424e2799a
SHA256 2842f280e97783096932b489b1803f6c0bceaf287bad12852a816452cee41bb2
SHA512 463abd9974a83219ccbf50292353ab0595aef3ae965651f15e9c9dde1a12c4554d4427d89d670a702c6ec3822b10970a7a92f2f4aca463c59ed32a825e576d24

memory/1588-378-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1588-379-0x00000000002E0000-0x0000000000340000-memory.dmp

memory/1588-381-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

memory/1688-393-0x0000000000500000-0x0000000000560000-memory.dmp

memory/1488-464-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1576-466-0x0000000000230000-0x0000000000297000-memory.dmp

memory/1688-467-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1488-468-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/1488-469-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1688-470-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

memory/1576-471-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/1488-472-0x0000000073D48000-0x0000000073D5D000-memory.dmp

memory/776-478-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/2596-479-0x0000000000EF0000-0x0000000000F70000-memory.dmp

memory/2992-480-0x0000000100000000-0x0000000100095000-memory.dmp

memory/2596-481-0x0000000000EF0000-0x0000000000F70000-memory.dmp

memory/2440-484-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2592-490-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2440-491-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2596-554-0x000007FEF41A0000-0x000007FEF4B3D000-memory.dmp

memory/2440-560-0x0000000072770000-0x0000000072E5E000-memory.dmp

memory/2596-568-0x0000000000EF0000-0x0000000000F70000-memory.dmp

memory/2596-569-0x000007FEF41A0000-0x000007FEF4B3D000-memory.dmp

memory/1688-572-0x0000000000500000-0x0000000000560000-memory.dmp

memory/1688-574-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1488-573-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1488-575-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1688-576-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 d84fe5fcdac6a6fd4a1320f0b0610905
SHA1 21da026ba19a627c282f284e01f66827e0bcaf8b
SHA256 670de2d13e129e916296e0ad2e5a1a5803cf5f22e4bdaf6431ebe49e6ca60269
SHA512 59a79a1c755200a75ba53b5db2f8c6309d9c1c6a74c198f10f4d33c40d15b16cefb4b651df55d507259b76f8f514c1b789096f904970a767a770544d6cd31e1e

\Windows\System32\msdtc.exe

MD5 d2e4606bf8fcdc565fbeef9e8243d053
SHA1 fcbd1f15959be168a87a7809733b2798d54e3d31
SHA256 dd184c89ff814d29bd782179912c3ad21a66633addd64f34a1150e369d202980
SHA512 cd9eaf663c11b57c9b6724f8ca0e0c279e13bf84184a194b57006e7ebb0d16a7f98882f796831bb1f20a9729673f1f8f6062d17d6f3e8180db8efa4899b1370d

\Windows\System32\msiexec.exe

MD5 1301e9c80df93f032effc6d93c727635
SHA1 2b0f2f42d2bd5bfdcfdd12bd110bc27e79a2b9d1
SHA256 292c52a5e765264488ac7c27e2867d2745e773939395cd694df5bc4c765340e9
SHA512 1129037064eb64ca6869639e58b8e3f65a0fb5329da153f6b48c8030fed92d17d07c828724617da9cdcd9f367966fe79951a5662a9f82e52e4d4142b6fb45ac4

C:\Windows\SysWOW64\perfhost.exe

MD5 f9bc28d421de9981ed5364ee38a97629
SHA1 693704a7785bac0f7f337283b2b28661dc0cba8f
SHA256 d7e11ce3ca2a43d486cd93b9bdcf3507909c8abc0976b604f7f6a453a7a69700
SHA512 00c203d23b6c19dd534469f2ce6963a33eced60e0909061fc93210c6f45e76a6bd221de5b4d3ed7f38e2f8b7b89bd355532babb469dca20ddea3e7e56219e95d

C:\Windows\System32\Locator.exe

MD5 2d4cf9de191f809e2084e783bd5f110e
SHA1 fb09476c08e085578447d40f8961f4fa54f4d9d8
SHA256 8d26b07b5a2a915d532dc95d38501a2304a3c43ebff0da6b6fb1c6a84b92317e
SHA512 9f630543d3e259fd9f94c5a20ae367112a21ca60fe7128a6eea6da0a6b400889f7b3966e782d908cc6d61734d6932cfa7c37e693f86a71378502250294b98c67

C:\Windows\System32\snmptrap.exe

MD5 4110d7fa54ebbef0e77a9ed2d2c7ef59
SHA1 a17b5ac54b37408f804092a9a8af86df8d5dc577
SHA256 32409850806bc8ebed21e24ac89791d1f31319a5d7adbe01cad7e813fc180eca
SHA512 4b4f0f30f85a124458a5733307dc4c4084af5cc37756481770adb2fe7eff030304f6c3e8d9a9f13904f0853585abdf63ff007a023e9e75e64cee1c7fd6ca00b0

C:\Windows\System32\vds.exe

MD5 d0d7e2c8be8f93875caefe6056531287
SHA1 6333cb9684d39dcbf23c8fe5b3c7dcfe202c9db1
SHA256 871ade394c69f904e37f95ce8ac6d5a0ed2339b45b0c93fed89513d93469850f
SHA512 b65a25ff78ce82a14b401bf9243e943ad85bb515f0023ffe2d142cc22cfe1315210c90d601ace4fd307a024e38c65c8f400f3f147735a0034c461e92e3ba196f

C:\Windows\System32\VSSVC.exe

MD5 228ae9a734b0025ab640d6c807b06ade
SHA1 53375df76150a662a5f078e53389878a2ed241b9
SHA256 172a4658be1d6ee1385b145afd57be39738cab33e49e31174b7ab8fac6603214
SHA512 2f426d85bac530576af860241a12d8af4946d2792ffcf707c77aec0d428cdfc0293fba91c27530941a27bb3349ddb0b38f3af12d705c982c7fdf02b82fe44604

C:\Windows\System32\wbengine.exe

MD5 764da1be128f905515ba0feb19adea27
SHA1 23e1fe7fd8693508688e41e176efc075837c394a
SHA256 343afb6cccc38ddadaa6bf35eb9d6408c00362ec9591d828ad9f3f37c0a7a73a
SHA512 9536a23d7712e07c23d8e10c07dadc5a2c4b98b9959191f6173861ca5814d21742749b2b8d8b445292919a2d0ea4a631c331361f5d1b37823ca75f05294683ba

\Windows\System32\wbem\WmiApSrv.exe

MD5 8e95b8b1d7cdb0a121345bceacc4614a
SHA1 ef55d6a3f2c119fbdbdd7558d90a39245b6e0d74
SHA256 2551d41e63a4cd3304b15acf7cc0141f64acc57bfc9840bf1c0950d5c82262ef
SHA512 c4aaf46bb0e0d4346ed40cf171afb52e0ce917459974f13cebed88816596b8a56a8c48188d17820c3dea3a041015fb6d04dfc26c962bd8b5e904f8284d4c181a

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 2406d615f4cd1e70f8535223f79f4434
SHA1 96a51169049dce63a8c550ba1d3576b6aeaeaa6a
SHA256 bc038e51213a383b38d44aabaa937b96f250cf5cf114e5d9323d43b95b1c37cc
SHA512 3708b1ae7deb0e605bc94f5e3bac915b8f01523f4a67468b7da129ec206d45e126dbfbf86f4cd3d68a1bb10dd556c0e22a4ec61203742870807b83ceb69a0be8

C:\Windows\System32\SearchIndexer.exe

MD5 571b358fb420e0add5eeb1f48a89fd57
SHA1 6ba271eba13e65026da3869c1adc7f61f326e070
SHA256 5dd8dd76a5d37a1b51577fe2bac27f8281cb4ae7766e3ad42c38b7f2ff543224
SHA512 57eaf276dd7684d6d905cea3e8fabe56e2e639951f5205806e804f3730945d9aadb9d90ef7a4a5a6ec7b265b92dde9616bbe8ec1a9baae9068f7ca4ac7de03ea

C:\Program Files\7-Zip\7zG.exe

MD5 5878cb6a1229b44ca89959dbd2baaba3
SHA1 8c4175bdaf4bc990dd33597dfed692c401530159
SHA256 59a5380df8c6d201b579c029d9254dd74573859ccf96c522d1547a2f564ed713
SHA512 7f5683489d0f7c867dd90c31090612921710b613ad7be40ad8914f6dd4eb6a2bc30b90805b043f1eb1d78ccbcf333b20a7b64eb0d46d2baf64ab0cf2c3a6d6c4

C:\Program Files\7-Zip\7zFM.exe

MD5 b4435666cb7c9f329cbda20b2772867b
SHA1 eb1fc402ab96b7adea75095fb2d8d9a1d78995f4
SHA256 820fe6bb3f85e51532f25cc4776d465c80ed9b3c2e87d6f57612a74723fd1af2
SHA512 12ec13aabd55a2b478027c980cd783280dcbddcc37ea015a8afe3505ae90fe39c87ba9c4903a3a0b8dedda3704f8a9dd2cd54f9a7261008c7f8b4935b5708d51

C:\Program Files\7-Zip\7z.exe

MD5 8056391784ae8dc7ac99ab95a4651966
SHA1 c35dba823de40ffec60824b5e6cf973b6d8c7e3a
SHA256 d254a18047ba138fa7f94b6caf4eb3b3d7c9b0f42175b64c35531de3e9225803
SHA512 1ab36192c377e69065e8213c8dd8e93391161caf2938fba3a9588a3b06b155f70287bb10d9bccb3551aa45d9fc34f7e9b0f072f921f4fcfdecd0c8eb52dd5e15

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

MD5 40b8c578494d752a8394e19a3fe1cb2b
SHA1 1dec4dd17c7bfbdd89a3dbd06c9e096b923e2535
SHA256 90326ec9f3f73808637c570c1677f385c501c422bf37fe4b1788b5e96d3ce94e
SHA512 9293d08c58085e74a84f5092e192a22f14827838ee128e238dc309b5988ab19526d6f5fcb70343c61e1982b3b8d6b51220d841deeab3375379e80d47e16b0648

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 2267540f7fd2eb7997d072b54bf4fc3f
SHA1 8d99ee6c480c769b5b2ad14d8a36394059211334
SHA256 8a05c22fdd98bf45f32919e4e29b14a0e7652775e19f60851547d2961a2fbbc6
SHA512 85176cb761bb1c423e9206ebffebefbf7080259264bb92d24556d24831a9a180c6160af9a11baf131b0a1936b41b8759af1cc28b545c7032ddedf06eb9f0089b

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5 8908942df1b0afa5f55e599af0744ec5
SHA1 0b72578e56a146d4f0a3670521a867eaab61b854
SHA256 339a41c4dec351e9f477770c09a162ef5ea9b3effd9062361f2568bb6f2f50ad
SHA512 fc4dcd64b98db9eee2fdab0abb7e957a07c4e889905545d30ebfef733df5794531d8172669e6091cfd469a08738d75a9e068ad0477e8f9f5792da49942f3a9a4

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 cda81a493e067bfbe8f7522f95a4ffb8
SHA1 69dcfdc03d604aea82c83072ed8569f95ecf54d4
SHA256 85c78e445110d5f913a4e4b899ed5e347a6f715cc03a34e419a446c107c86260
SHA512 579b5c694da5671383dae8a53b9b645c566b278fa0b6970ff10e8534ef8c4f4c527c642f85a290c2c67bd31daabaecece94ad14b6ed04891cf999f4918c1dde6

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 22:59

Reported

2024-04-07 23:01

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f630044646f975ab.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\goopdateres_el.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\goopdateres_cs.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\goopdateres_es-419.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\goopdate.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\GUT3DC5.tmp C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM3DC4.tmp\goopdateres_uk.dll C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fc36d373f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026e30f383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b56a57383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f416f383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001422ae373f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f14412383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000026876383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe

"C:\Users\Admin\AppData\Local\Temp\fd0f2d0062520a56a8c888c3889a892210c8f376e9641a2b36364184264b999d.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 42.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.13.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.13.160.165.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
US 8.8.8.8:53 ecxbwt.biz udp
US 104.198.2.251:80 ecxbwt.biz tcp
US 8.8.8.8:53 pectx.biz udp

Files

memory/4324-0-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/4324-1-0x00000000006A0000-0x0000000000707000-memory.dmp

memory/4324-7-0x00000000006A0000-0x0000000000707000-memory.dmp

memory/4324-6-0x00000000006A0000-0x0000000000707000-memory.dmp

C:\Windows\System32\alg.exe

MD5 94065e7df9dce2c8402690d3c595f56e
SHA1 a5c59920222f9e1a9048bc4eda0cd21ed349c805
SHA256 f0e994fb73c068aa45249965f1ac72176627e77e13574472992eeccb7786e1a0
SHA512 4af86b8ec7ae0cc06b5472b5ba6c36b6d5430de03306c3513648c54374b556aca6dd0ecbaad833ebce325f6d218d2cace18a1ca30b217f20975fb28dc49b683c

memory/1088-13-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/1088-12-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/1088-80-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 2428c1597530b1113a5a0429aacd453b
SHA1 9d6d4f1ce854c63f4670a8ea9ad9987b8c220478
SHA256 3240ee1ce5250859aad3bd26fcd2fc16aa5037c4f13dca51914a01b35b2c88d5
SHA512 4ffa6981af42443e6cb832724c9c57044359e901ad8e200c7a6799bf97b5f509fc179a7691204bbff1decc3f4efda918cb648189b68de2f7c881d427cb200650

memory/4528-95-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/4528-94-0x0000000000700000-0x0000000000760000-memory.dmp

memory/4528-101-0x0000000000700000-0x0000000000760000-memory.dmp

memory/568-105-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 b944dcc6543957d2881c23f42faeba8c
SHA1 888510bd16bcf1f39fb44e5c72530f20dfba7fa8
SHA256 82922d41a9be8035c675e5fecfdcf0d627aa55e8fb63baec11098d6177398718
SHA512 57f63c753e7bac020c11bec236a2826c69c89c4ea0f248f22062a2d69dd6da2b5e690eae93d2c613b387cafab3271e835489f1315b5353aa26376fdaf4537f69

memory/568-106-0x0000000000930000-0x0000000000990000-memory.dmp

memory/568-113-0x0000000000930000-0x0000000000990000-memory.dmp

memory/568-115-0x0000000000930000-0x0000000000990000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 ef110ba2387e39d8610808995dcc9a54
SHA1 afa71f7192b0c9d990528bfb699feda1545bd3a7
SHA256 5a1b5ca3b607b17e666b2d981af11f0044ac10b0581e91303777fd42b7e54165
SHA512 9566deffe90ad02ae63888d690655c877ad2a63751ba8dfb84c240f07ba026a2a61e564b5bacbb74f6020dc37a848ce56e60cfe859a67ea47674c5698b71dafa

memory/568-120-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4468-119-0x0000000000710000-0x0000000000770000-memory.dmp

memory/4468-121-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4468-127-0x0000000000710000-0x0000000000770000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 439f19759ce7220c2e690f37ae5a59ae
SHA1 2d36065f22e19982edd42ab89fd1ecad193dcd91
SHA256 2750fffddb8d0988d2f2039f212d33aaf53ba4325b833f5fd0040ad0d3b67f4a
SHA512 e2f2e8b2db266fb690985dab846eed51c5f4313287a0981f430106d9c68e42bbc1471f63a14829b39b39d2e623acf053233e8fa453e40d612e958db8805db587

memory/4324-132-0x0000000000400000-0x00000000005D4000-memory.dmp

memory/2492-134-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2492-131-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1088-144-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 6f6dc7b968b908d8cc23ebf6a66733b6
SHA1 97d054a9e964b4962261f6670c3937d598cf3b30
SHA256 4a1af8d118ac7d77dbc71f4c7f09d3b6f6c78e8ea4d8422e97477d014e1eed77
SHA512 f0ae287d1fae6ae2dd10ee06556aa30a9b1c13389c3ec3dc7c9535151b28735c8346cb89609468873c35b6f46a95a037426ed61bef23ab4e88fda45773c9be30

memory/1600-146-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1600-145-0x0000000002230000-0x0000000002290000-memory.dmp

memory/2492-140-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1600-152-0x0000000002230000-0x0000000002290000-memory.dmp

memory/1600-156-0x0000000002230000-0x0000000002290000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 d2b92636dd6a3b7bb4dd412775cd8ac6
SHA1 49c9ccafd9ba9e46ca60b7f4ee184a525b664a1e
SHA256 eaddbdc1e330ba011000c35808549fbb991a60ba0a6ff9986155c140353ae373
SHA512 e52270e3ae8a3e190ffe46308041f9f994899e479cec6276016aeddc501864464e28bfebbfca3f0e49dc2669efb309731118b4a65595f5d738acd6414bf95bbe

memory/4528-160-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1128-162-0x0000000000D50000-0x0000000000DB0000-memory.dmp

memory/1128-161-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/1600-158-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/1128-170-0x0000000000D50000-0x0000000000DB0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 f47fbb4f563966c8152b2f99762e5fb6
SHA1 5f6ddb481fb104da69c18950906d2041a01a8163
SHA256 477c21fe52d383c0c179c69f8e212e1586d776517894c683df96d58f908e2a3d
SHA512 3ae722c89df21bb96790de6c6c49bdaf13a633beded480ec5caf390414243e2f988b9bb8571c9c52d69cfab44f557a6760c0f1d3ecbacbc27aa73a7e11cc2cb3

memory/1728-174-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1728-186-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 75bce99a36ed3ccce704413fdfed1566
SHA1 862cd769f1b1a19ad409782e625bc701b26dbf1d
SHA256 02ee6bd9b0f3ec960808ddec04fbe7c4ae8e9de23693d2c87fa553b2dca82c63
SHA512 21e93e0afb1a763ee1b1b2cf9a202a537bc7036ee804ac8760c67608f8508f2495abb3cd4508a24f12e09e8132524b9ba8f0c66dfb34714f8d2d008c37c76379

memory/4468-190-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4844-192-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 4070557e083d5fbc0058605d9bee98a9
SHA1 2931fa4f49af9281ab29e5ec757aaa03b998e0af
SHA256 a22479d9ad4f24cf808394bea3e809dc89c5cf4d1224884abb009df3d70abcc4
SHA512 86ebbd76fe5486ccc3a219f1f6c8a1c59b8053ae313808bfe9a3fbb1c7bb653994c2b38e1c60a08c1d472c16dc0cc0a39086f5c697772ff99d3dd7902f46126f

memory/2492-203-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4844-198-0x0000000000B30000-0x0000000000B90000-memory.dmp

memory/3932-214-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 0cc3c55381fd7002907bf63202edb591
SHA1 6d24240657d2f61c04ac2ab3197a6c8bb585101c
SHA256 c07d73f89767ca100f8bd6fd2fdbaac31d9f93c55c1114e1570b52c709a43095
SHA512 5667fe7b4840b6af1f253d028fb05badc390b7ea3dc5183919209210091d3c718b868588b48b93d88bbc009a5cf28f5eba572822a362e72fb25e2f9046574c73

memory/5076-211-0x0000000000670000-0x00000000006D7000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 5a38ad11708be60a73c3235b367c4272
SHA1 9e1f2b923605a3dfc3646fb0fee98e6964c96072
SHA256 dafbf32d8a8847896b446e00546638991138a5543809dc7f0d5e99c23f3e1a1c
SHA512 810d8943411caad4d91fd633f6e32c7887fe6df11fe826a7301c0d149602f3582abae04fae4265dc928445eb52c9017c3bc1276bd80f61b6daa70e9b89e9e4db

memory/3932-223-0x00000000007B0000-0x0000000000810000-memory.dmp

memory/1128-227-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/3340-229-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3340-236-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/5076-206-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1728-241-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4044-242-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 811f926bafc967d8987ee855e18dae9c
SHA1 1d91457ef859c69c2e017b4bf2e26a2a2b1ac727
SHA256 dcf66774e44cbc628aa445770db74366ab6d6d8e293f0f6cc8ed1bc5dc95fbd1
SHA512 d1814288dca26de03bcd1407fe83e72c39f6c5aa7f6c80e56e6c53611ebf09b8a9a3013ad54a95e57ddc3589a5cbad1df7e70ebecef5da3fd2b49f65ffccb8ab

C:\Windows\System32\Spectrum.exe

MD5 f076e289d0ebf6134db1601f14115795
SHA1 3ce0cd8fc60f11096eb738d2aa8a51d211e74609
SHA256 872c448dcaaee5e0a5fa45a6111a5429f5b792bb517bb7ce30b5526d47c4d1e8
SHA512 3ec49bf24c6fd1415498bbefd86bcf24739eee88a040b6b272a9d6df94a2cabc52f369d7423220f46907adf9685f027f20ae2e93a84eaef8ca701c5f9d0a4efc

memory/2200-256-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4844-253-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/2200-262-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 09d6c74ae8968505d3c1a78c60fc9712
SHA1 41096b2aadd22ac24663ef5eb304cb512d0b9aec
SHA256 52e581e45654210ca13689e8ed834b5df27a1a72e7f2ec82b7d1851ea73d0578
SHA512 b0a71d256bca05ce26ff1fc67eac08855ab584193177ce79617f4a98521922fe8a407040ba6e9a7d66859005e1fffb058de0342a9a4d2b127bb47fb15d411c1a

memory/1148-268-0x0000000140000000-0x0000000140102000-memory.dmp

memory/5076-267-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 4ef6d0a7f809330d4fbf3c56f1f77cd3
SHA1 dce441324f5154840877bb4c1af545944e438f29
SHA256 f81729e4f9d96d23fc107a1d76776c2dd54bed42ac953460f803052a0eb380dd
SHA512 bf0fa6ca7c14168968d720a48a403083135ac463b7b63b9799aaa8a944f4419e30192135b685061fe74128f8e509f505dcc8206d597ec549c5012ce5a4384e0a

memory/3932-280-0x0000000140000000-0x0000000140095000-memory.dmp

memory/1148-277-0x0000000000D90000-0x0000000000DF0000-memory.dmp

memory/3320-283-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4044-249-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/3320-290-0x0000000000810000-0x0000000000870000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 f9e5571b85329525563ffd42a8271749
SHA1 fb585109ab548f9230adb582400999f6ab11eac7
SHA256 cf8e19a7c304cb555ec816645437e4e1cb187a92d8c7ace1bfd895b8ba9a4cdc
SHA512 9021e77e6966b34c571320742190c836602c474f216eb2830442fd6b6ac7c525ca9350680382c2aa1dff854a08fb38b1bcc2b0fe3adeb9654863b7a5683ac4c3

memory/3340-294-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3544-297-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/3544-303-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/4832-311-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4832-320-0x0000000000C20000-0x0000000000C80000-memory.dmp

memory/4044-310-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2200-323-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 1df294c9bc28cc2afb41a9cbb3f7e12f
SHA1 7e109a0e4ded0f0e6d82a3b8cfae5b33270120de
SHA256 4ad8b3ad9a84f07198f8dacbc6f18657ea70cd48e04ed430912bce7797fd1d7f
SHA512 ec540a10dcbecbf8a1f1bf3c4620d0cf46696a6c9c3a48a6d3400589e881aacb1900084b03a8ca6ae999d8a6b42b0a382cc9d63d5a8367093394e4a06929b3d8

memory/3356-332-0x0000000000770000-0x00000000007D0000-memory.dmp

memory/1148-336-0x0000000140000000-0x0000000140102000-memory.dmp

memory/2964-337-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 5e4e08fa3614d01b14a1919717c8bcf6
SHA1 473fe71eb7f9ad3ff169cb840aca0bd352cac2b6
SHA256 4571d8b427dd3a9374cf8f0b5c4c8d89438b3d43233ad6339bca06111614306c
SHA512 43ad2c021609cd8777e67f7785855ae2bc264abce4b0aad7c7de311ab9760dfac88e99a18fdfa97eb8af749f8faa547fa365e31fe3f5ad4256354884777e55f6

memory/2964-346-0x0000000000BC0000-0x0000000000C20000-memory.dmp

memory/3356-325-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 6483bd8aab598fc6c9897202c52e90c5
SHA1 2b074716ac75aa186530e551bbd80102cbda8ede
SHA256 7012343f689a1c8659fbe727c588d301d559a32a3cee73ffde9dd118115d5bf6
SHA512 c8f412b420c1a4b0f10804c88fd5bdc44a3e515539bcfc6e19b8871d24054336f443175b038007bdca5677e34e0128480ebb2c62556adaadbaa7cbd6af01c4cb

memory/2060-350-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/3320-349-0x0000000140000000-0x00000001400E2000-memory.dmp

C:\Windows\System32\vds.exe

MD5 9a96ef5a2ad2fe7a167e02d1341636d4
SHA1 12a009db0c7b0436a78f3f77113399913c1b968b
SHA256 f156db0d087c0f32f3d8b92072f51263f2c5806dbfba290e1eb74646f93be042
SHA512 cc2067c758f01810284dd54e85edcc8f2e0dd1b719d4e14ff4012ed6ee6bfb592efac2c6c787920b3ff86a85b1022246512fba34bdf1c4b0bfcdee535894c898

memory/2060-358-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/3544-308-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/3544-307-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/932-364-0x0000000140000000-0x0000000140179000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 f807fb00db8e82ec12df70ed0d595b95
SHA1 c51207065c95bc8fdf1f0dd290956aa4c6f7eb12
SHA256 27a78b9866724b3b05c837acb30e60da208ebe4c5ea9b33cf230ce57b1857ef2
SHA512 aa69d9854eaaef0d3962521748bd38f9b7ce12fc238d940f6fa237980cab3aa374a9a01d8713b99624bdb8b10b75fe4deea1c9795be39a92c05ae5110c9b226f

memory/932-372-0x00000000008F0000-0x0000000000950000-memory.dmp

C:\odt\office2016setup.exe

MD5 17cf3425d6136b529662b7318c1a4a11
SHA1 9ea13adccb754b4778d8529fe0b76069c5a5e7c5
SHA256 2ceb58972796210b023e0fe64d40f7144a53c8d45f7f111e024119b067d79e58
SHA512 0fb2b0642784a07ea17551cb0f606ec80ae81847747ea843a0c89433e40ecccc021e0c12fd5e8cb04df66d35bcd65969d3babd9091226acd8c8d20591b3dc0fb

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 8ea54a10aa8f6f849e5f4a092f43a282
SHA1 01c1a736fd5ed65b7b16831a41bd2dfd13f8dcee
SHA256 5e575ebc885a7a3c3511e67ae6ca3df8314c75f92833a4bd68dce641c3dfbe4e
SHA512 030da9e8f7a2920bde00d353dba906c79e6088c40eb040f17ce64c3f5612f4ad7289a2eec9a666511181ec8e2f12936944c186820d99fe713c6bd22c53207e44

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 350e7239d647d962a7096ca2417d9cec
SHA1 89feba616287d1ec412a4b44643d307af7a25fa5
SHA256 997934ca8126f2f5e7b349b8ecab50b6ab4395199481a380613e150b15533be7
SHA512 04233177656b8e8ae2ed52646baa036da4d9b689134b2e5a582a1db83b819fb4252ee26a3851afbfabce7e330c962549af042e6cb0d072be2ce825780f685bdc

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a63181a3d427d22a4d4df228713bb4f1
SHA1 9041cea637c20a56a5a2e5cadafffd95f9fc23ba
SHA256 8faa74f41a27ffdd9c37d09e108f76ae45eb07bcca7f70250273b46f9aeb1bd6
SHA512 d7ab6aa376b0c14e7a48a4f3071293dd732678e3a20308e075123d044885de22a3458b2e7680ca92ed8512bab46be89487bd71bfb5f9759f2dfa3e02cd0e2102

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 54a03d17ee4d769c9d6e78d1b5b2fbe1
SHA1 dc7d7acc7d20448a76265abadc8811295cdcfedf
SHA256 05609a45289bbafd03ef85e1035844953d73760b8901af80b8f7d401be7d99c0
SHA512 3a0632792515726f32265af9419c34a1492dfd250c46900e9a9f1fa7bfd9d2378a9ecf6d84fbb1c28067df302705e30e40f1a483587456972f23d87e1bf694bf

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 c368c86adfca9f88ab51273d05453d49
SHA1 95a83482020cb222991ce5c863724f60ac83d033
SHA256 0626ef3f58dbbc9588e81b645d641dd10efe0c2b39c55d6e73d65f9e7f45f89e
SHA512 b488595c081c912f13ccd7dbd389e43d752a8024fa1321de53a18b7a060826213a4b44fa9ca5b7748a8ce5f9eb0f6c8a6dde42688e21f6becb1c17a17ad061a4

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 22a6f1c4f25375dd80dde06806d5fc56
SHA1 bb9b92ba5d8c393d7410c405993e9011ab343762
SHA256 c516d4e7d5854751eced027565d1bed970974ccd7ed954deb3cf599c24e56c61
SHA512 efdb10e6b58fca16af439837083023ac09aae01e5403c31ba0a0a8856365d263f81a44a635abc089c7bbd9085217fdd61cd598e9fb0f92623bd78dce6561b5fb

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 7c8bc635b8f88ae2008ac45ef2d0de38
SHA1 ac519ddf66dee6d8d80c1d2ffd7914d4b4699fcd
SHA256 fc8658db376b0e7159cfd6e34ac4499f992852b8e4d931f3d6dc4ffc1bd05651
SHA512 ab77c4a29ba9764de12f319574486dca7d0bb6a172e3e54e0ebee00752c625289765d711b68698e02212bc9dfb7cd65e817f1c41486ecf867d82d237c83a2c3d

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 e444eb9306cd7ab4c001ac62b17a6422
SHA1 63117591fb7d7038813e6222d17236250a970a4d
SHA256 055ded48a9c58a985947863b637efae287bd3c1cd4540563cf9a5905e5cab97c
SHA512 4e6e08e512cd3419a5739e0d76d6cb57007a1057e6885a375ad87c8ed089d7b36d471606a809625ffeec3a91d75df689e9c0c651fdea2e5410efa83409d4d07a

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 c5822b46ef5cdf07fe69f4043c24a854
SHA1 e199a30961918eeaa557209c0971efce78f8d5a4
SHA256 fd3116f9aaef277f946a0d6de9df6fa6d875639aa883b7a6d415d745155ca97c
SHA512 dd7ca51fef9083d9a7cd6f7d3e5235d001cbb8834ba03cb80bd50ecc0ab01492c20920e0dcd53f4dc9ac37de893eddd3a80ddde4051f5c7e3545e85b567b25e3

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 41b91ac9a0ff4c40f0154dd3fdaaeb6c
SHA1 6eed7e33ca2468563dc44216a0bed54a56acd292
SHA256 4478db2b83d8ec29a0cf93739da9602cab20c7ad6faa68ace9967398cbb73ff4
SHA512 5049f328e2d1553722fd426ef304993c7894b4faf597c421c251d9a8700175394bc6dfabf999e8bbb9b75a1a0dd6143d6d6497636e32baadf5450843c1eee33c

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 d09e4ca3c63ad5eb05d2a6c403504eeb
SHA1 7956570aec27725a6fe796f46c65992c614a805b
SHA256 0bf572c54ad0f13772a18e3d6ba922aade985a3e16c408a190503ff75f987990
SHA512 aaedc484b34c64795efbf9b416e48cbd9595a4968a6f1b303cd01cd0bd5969417b512fc77a3ce71b86ca80893b4069cefc3658f2172316267d785c38e0933f57

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 5c2bdc3ed21553c87105cab5a8e59c69
SHA1 25b4a7f592bf88639e09249c693945242a6a5e40
SHA256 931491ebbd80fc307cc7adad0f23b970ee39d050931f630cae02e207646d0a24
SHA512 7d74b3d53eb259a64094a5b1062a43210d975a689ff31a47b72f6eac8cd75a734cbf7f3cad11764926e104b0ceab2432851df7e48b91300b53c1fdbb9a305f6c

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 e8e14f8787da7365dae264ec785c230f
SHA1 c38c3b56dcb67520edc459e742693d4d0efca3bc
SHA256 2a7d5884055991e898db525d15c0331b42dc13c790f3d83f3cbc9e757b63e390
SHA512 139a6d0f685a91e0ee3782f5696611d658661fa3069fc3b1fc624f5c6fe4ccdc27e74ea3d9e07ed6d00ad87b33fd7f72a815d2b8ec7cafa9665b639f39ec8db9

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 5e23c1a077e3b89e20d1c1f0a5ac3481
SHA1 aad8bd09ac380efd4dc9a5e118d7880bce39bdd8
SHA256 05f9bfbe0100cbbb0d2054fdc0993d802163e5287a4b54ff4b61433bd6170ce5
SHA512 fb02be10c073b3294d94027efdfe9cdb58b8aa86b5b73df2d24874842da9b576c3ee1bc4da3eac441a819fda21631411c295cc332ab9e0f38d91a3bba46b4675

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 9744a06a3ae0ad7b3fc690d5a60a8b67
SHA1 4e227bb88260a9e55ae26dc8980473b13f0abedf
SHA256 0a37b85438c4c1878405720b145b708847e32b21974dad76b399c36a8aaa5ba8
SHA512 018b0e63c9e5e80e57b81360e5bf71021fa3371183d95694566bb277180c29c46145f56a738c8e8f5ec3fd9ca060d2efa8102435dcf6a9e53745f1ac3e6a8ed1

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 9c72f7000dd28b4ebf430d322e91391b
SHA1 0d49d1b23486c932c8c4c393fbe18b120cfac88a
SHA256 57ccc6a7dd50b929b3f6386be829ac7ee9ec757b8f4778e40f4bab6984129b28
SHA512 73ba7805f905231635fc86e33758bf9eeb9d940cd36253851bd846f2eb9ea8282759a45c61351e3d58b8e33149b6f2d6b18eaf5d55d65968336082d8dca8a577

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 d47ad86e1b4660f6b7695802122c8ce2
SHA1 443fd4abb2e181d28b5cf4ae8529949f9d61140e
SHA256 bc7bcc2f8d0963a5b6c74cda534ddecda96767577ce9896e83bea9aeafc54d70
SHA512 2e2c2061ea30eb013b22489e2dc9da13fee7a6c1612782754f7d186c5be7cc99720c545d784211bc676e8f32cdf29ef4f8f19e3f813f97dd4b28e82244396077

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 b5d92cc15da0710149b8abbd13819641
SHA1 aa6faae87a3b597a69b7a4e527c87c95180fcb51
SHA256 adfd2af123678a487f07f06a856cdae5fb0d09ade9351bfeb6dab17da09e7ebe
SHA512 b39c602854a76cc953fde1f4be48dc7c9222f89ae0d5c814c606a21344cf570625c40e71becdc5a08f4d9bffafae7cd433783f058d7b11b4f03e08c71ac858e7

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 4fc2f3846f03f9bc7586c9c795129b72
SHA1 f2ad1ac4312dcb1649e15a5fd3732c95c604e99e
SHA256 df43da3e7d4e556e86247c6ed3b71e5ff6f2cd5aee470d6f6a95e9dd5e34473e
SHA512 f17847fa5435c3df5cded1489ccf948f4803a241bcde0b81cd0a2a0d3356f3db98467f3b9444d7fff2ea02e266489d3f8d1463f7239e85aef2341a35cbb99795

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 2715db20a927daafc83f4b7eb5ef226c
SHA1 04e5f571627981f82335d8a4853b3a015e32a2bc
SHA256 ae7dbbbd8c7d934cfb07fae64d2d5e6221f8ba1c53d23ce955e188f1ea9afc6e
SHA512 845c646212fd74f010657ec2152a39ada11bf72faab76368ed7fdffa881adc0f1cfa70250f60cf37024b54ed0a897e4d00753ef68877272e377c846dc9f75f81

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 5dea792e8554ad04f00b125142b21965
SHA1 7ea409676a675ead01321c51775733cebd647b0c
SHA256 03e1807e00cb6c1d8960475f9b5fc9e9615263494ae4eb3d5461a61a87a36a5a
SHA512 1a4da4714b8cf9497c4189aa6840eea27c0f1b93d3558a05f0e63f06500a565b8273474771aa6724b9f1ba49c8175db4ce8af5df635c055ca0a6f09eab53f728

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 e7f1c3fac7fb29f0009f76500584a7a5
SHA1 aa9e03a8e0d3f70c92a6fbc250fcfd3cde109c15
SHA256 0acd61544ef999b4e6b775576606d17e1c5c8bf825a92ca86bf6167d453e9a88
SHA512 e60141c553602b540fb54937a12b697e032f32cbcb5ca192f56aed2d809dd4f8f35db4351784048b1f60f558edd4712ac788b1b3517630b160b27e3508631dae

C:\Program Files\dotnet\dotnet.exe

MD5 13a41e2d34242f957e81e366a1ba7840
SHA1 0e81313634b6feaba7bca5adc4c1658da45aad6a
SHA256 5b5aeb78eb66c209f07553a13a26ae7146bc9449a1b59c6bc610ac0ee33ec3ee
SHA512 5fae00af8341e5faa52dbe0ecc922b7adebb6caa43f7953aa7f3cc6302c9f7cdc3ffd9d4caa7aaea9bfda5f665cbac45201984befb3d82a557ec72b74cc77d7e

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 89b426b7217fdfa7bb4d1c5b8ca832a4
SHA1 7c52c40a57cede402201ce37ecf0ff01e3a1c4ea
SHA256 4219e35f97bb2e61b2cff11611bfb3a8a1bd47efe94b43c078eaf9f01fabe925
SHA512 9e3e547e898fde733a3e877a5aca2c43493e0ec749ef4139ebc0cd07d883386a22da9a5d72fae72b69740bf32f56845be218ee94e904b4bdad0b2a03a351843e

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 cc98e8d4330b1c485540b273f4f879fa
SHA1 3033ad33e609f82e7bc1ee6c830327247de247d4
SHA256 30ad5f6e4a505a03d0d7e64cae28e476625d249b51719021d2c97251a38e2661
SHA512 cff7f18adc5cbf9396e8966c82b7b155c705cd5e79cbdeb4ff2b479354414ed9ef956a875b3b95ebfd49294c817ad68fb2ce645257c848dd9b081f74a4ab9d07

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 da15070f11735e3562263a9773072757
SHA1 e589c55ad9ae079564f9fdb048533417684f502a
SHA256 c268fcb6602592d34e2abeda20071e2bf4034a99f82da678a6c86642c4c4436a
SHA512 18cf8146577a4c3347a14065c402dcbd350f51b4f22119d0a640102e9609e9b213c81bb376f7542bce845ed6153cc30290877000ccc0ee99977d7537bf5fe7ed

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 eb7d2aefbdf1e5aa357d754f00e7b344
SHA1 e4ae498df5fb4279ed4f0794794d0a8b32e1f0c1
SHA256 efae529d30b9ffa560557a4eed495e89bf476db7c5e1985601d04f1640ac781f
SHA512 9d272c4b73d2c9ee31a278e1e01138906c75b8bb28d9256e236041abd16a1c8435fd65413210745a800f4a5b0dc81d9b1cd263958cb5221b22dbbbaee4d34e43

memory/4832-663-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 ae1d1d74f6a4342ae4fc35ac82a6e72f
SHA1 e3c0a7205a8c7f98e186415f502bc4d9b20b6214
SHA256 e77e5f73fb6b9b1b04b4965d7fc01741c3c7c146a23b10d69be92ed6ba571c54
SHA512 5f7be9266d5a51b1b706fd431e3ff34183db90ad24812f167d38412eaee396675ab29c43202ab2efd2a1644ef697638b0c64ec85c706f49c2f6bd8a0245170fe

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 6e03bbb0c8b3fc18070fefd8a4c0a12d
SHA1 b81c206b2712e3bead9fa61e6a7159399c07b5d0
SHA256 39173046c976e11edd065f68e7f6c9a2a4cc21879792f4a9664576f761d6c834
SHA512 cb50d7c7572acf8aa875bb85992e9cb6c45e6f6e74ab937b3892529692ccd289f0977892177591e59cdb2cdf8630143f1b8ff52ba4519182cc8d9632eaf98530

C:\Program Files\7-Zip\Uninstall.exe

MD5 80460f1a5e2386d5535d9ee862d09657
SHA1 7b3d743581130aa7eae4fe5f9990de9abbec24cf
SHA256 17637387e5b916066dce2d3d1ef4513305944a484ad9903a59c354a54b441ce5
SHA512 077b1740adba5d1678ddee081646da931558ae280247f7bf59e3bb5c23879333c832800cc5a3f3b306dd22db9c2892b1203222a14f348738850b601b24c27ba4

C:\Program Files\7-Zip\7zG.exe

MD5 ebf715ca1aed7251fd42a32bcdcff360
SHA1 25c397eb4366bed817685caeb31e2a71fce35a3c
SHA256 a58bb48c851e50094236b4dfc22fb2f8a14dcc4d282e493396b646e15ebd6a09
SHA512 639baf6c6ddb22e9b8b788063453782a8fcb220b094f0fc981c7b7b547ed5f72e772f64f57278e2f9735ea520c2d15ee4190b1fdda05d23323d1a95838cc40ab

C:\Program Files\7-Zip\7zFM.exe

MD5 eea961657ff8557b7014cbb8ab402ea1
SHA1 c2f70c343cb5ebf8580036bb4b0aba4418d2ab97
SHA256 f308b441aa062a5bc2ac6d1503254d504ea9086ab989331fe3a34eb7d18fb5ab
SHA512 bc947eff89554da1f79a6fef988323badf87593c9f92e371628eb856634c4db83f15c366b1a9edccd4014c7bf4f768be038c9793bb09247778a5d8a5e2cffbfa

C:\Program Files\7-Zip\7z.exe

MD5 7ce8dadf145c544d96a015fa0b946aa5
SHA1 3a7edb9b4defd57b243989bcd61ef550d03cf43b
SHA256 bddc4e95c7dada9178b2a7314b0fe5fd7a145606330cfde5b6750e05b287f154
SHA512 37161fb2fb4258ac8a3ac8f4d46de0c2179f3c17f3c24874fe4a1561c864140c007be275b2c768afddccf63058ab67e9fcc84ac5cbd4a77a7b8377398ccae396

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 2351e9fd674b3dca4e36e9087aec5cee
SHA1 9259bddf51b6eb52f17fd7a7f571c1dfc8315596
SHA256 bc843064e17e5a3b875f236f05e8b9eee879a3dbf3542132b4c7b4328bc86c68
SHA512 a43a6796256dc625b84a74200c7a2719c17961f6d2dc8f0744ba3fb8160bafdd0239f7092234c9b6163514e4f6cdac53229ed026f2f50b10e6f5a7abba908c54

C:\Windows\system32\SgrmBroker.exe

MD5 e3557b43f36dad9b837f13f3a08fc687
SHA1 3761dfc38d003cfa91d0ec4c919055c0a0895eae
SHA256 73a9c9f1db7eafa33df86cf1afba7f5ed2bc220413798b9bb60b00b0791cf714
SHA512 456a3b04dcabbd085e6435560b7aed29706b3acc0d256a73c2812c4d0f35246e4c9a1f0280622dd9d7324410da2f17e068abef3c81249f620269e6326a895188

memory/4324-623-0x0000000000400000-0x00000000005D4000-memory.dmp

C:\Windows\system32\msiexec.exe

MD5 4e7bc042f2a9fadf40c4f25a64b5d311
SHA1 8775f78a9b77dbdcd8d852eb9d4191901ec353ef
SHA256 9904a2b1673597d9994cfbff56fe7c475386e1ca73449cfa7b32442395b87adf
SHA512 50d317dd1f9819e2fff4224b815a50b64107c094444ddb146c909109dd6eff1300f538a9e0d5f68011abe26d036653070eac20e22c1a028f6c576f75100c97cd

C:\Windows\system32\AppVClient.exe

MD5 8c82e9fcb6e812a8de5493fa579787e2
SHA1 b0dc5bf7f61cf99585f9c162d63f9fee7448bdd1
SHA256 b28c2a913b6ab519288b2a80979513e5d172b7045210c938f0547d669aeb9ba0
SHA512 ba7339ff7f766b39f985968a6d2176cfd0919d7eb323c702891aaf624074f8fdea2bac3c686ef4971c57b247d3ee63b79761f614e338ef70747df6e0c0ce39d8