Malware Analysis Report

2024-11-13 14:01

Sample ID 240407-2yenfsha7y
Target f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13
SHA256 f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13

Threat Level: Shows suspicious behavior

The file f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 22:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 22:59

Reported

2024-04-07 23:01

Platform

win7-20240221-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a25780414501ed38.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C6606122-6B51-469D-B687-7FC2AA924C60}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C6606122-6B51-469D-B687-7FC2AA924C60}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\ C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{DB7B78C0-B840-40B6-96B1-57E3E1A5D25A} C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" C:\Windows\ehome\ehRec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\SearchIndexer.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1508 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2864 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2768 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 400 wrote to memory of 1460 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 400 wrote to memory of 1460 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 400 wrote to memory of 1460 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 400 wrote to memory of 2628 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 400 wrote to memory of 2628 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 400 wrote to memory of 2628 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1508 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1916 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2448 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 400 wrote to memory of 2052 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 400 wrote to memory of 2052 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 400 wrote to memory of 2052 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1508 wrote to memory of 1640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1640 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 908 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2808 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 276 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2964 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 2376 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1508 wrote to memory of 1788 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe

"C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 260 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1dc -NGENProcess 1b0 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 274 -NGENProcess 260 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 274 -NGENProcess 1dc -Pipe 264 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 280 -NGENProcess 260 -Pipe 1f4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 288 -NGENProcess 1b0 -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 254 -NGENProcess 258 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 298 -NGENProcess 270 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a0 -NGENProcess 1dc -Pipe 29c -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp

Files

memory/2776-1-0x0000000000400000-0x00000000005DB000-memory.dmp

memory/2776-0-0x00000000005E0000-0x0000000000646000-memory.dmp

memory/2776-6-0x00000000005E0000-0x0000000000646000-memory.dmp

C:\Windows\System32\alg.exe

MD5 686a92597fff471e2ebfbba95265284c
SHA1 673b0f50501d998adf0fe666a32cd617dde7f167
SHA256 f56bc238894a32fcd77c224e274a780c810c2ddc87f4b5b129d985d1e1ab6756
SHA512 33d79608897f84e970dd4ec013bb56a726c0b1ac69e24e898f1a9653c6601dbe0b354f89e589661ccd2331b62c88a903e37c211abd280dec05390df4e91b1752

memory/2552-12-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2552-11-0x0000000000780000-0x00000000007E0000-memory.dmp

memory/2552-18-0x0000000000780000-0x00000000007E0000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 de71631ebb829398e155036a2ccd952e
SHA1 d104295306db9731b0d4f5532a07992cb5bc904c
SHA256 57a1118dac31726e5b7bf4aace9ddbadbd0b4fedce405800e4f74fdf5f0372c0
SHA512 d1e94b057ead0bf3d7bf6f81fb3cbbd7a4bf57fbe037ce8c160805a86bbd8de63b84721c2f8a7d6c36132c4c420e3ed18afccb2bedd611ce720e55b533dc8c93

memory/2408-25-0x0000000000950000-0x00000000009B0000-memory.dmp

memory/2408-24-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2408-32-0x0000000000950000-0x00000000009B0000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 7bfd38404f1dcaccbbc302971f952c66
SHA1 49fb174f96363f7e59a2889225da386c6c99bb8c
SHA256 ddac52fef2660587f7b5e7722a972e1e8f585d93e6ba598115166a8ad0d2bbdf
SHA512 5211bef0109ce3241155b78aa6d0b870b860738182d227a5c3b1355a76b253018d833ffe28193af51163099ddff404f924aabfd9ee86900a6337a57a5554b066

memory/2540-37-0x0000000010000000-0x000000001009F000-memory.dmp

memory/2540-36-0x0000000000450000-0x00000000004B6000-memory.dmp

memory/2540-42-0x0000000000450000-0x00000000004B6000-memory.dmp

\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 b4ee16a0a095f2b2f9e30e7af5639ee4
SHA1 7d76985c941db9dded919a29e2e0762df7b3fb34
SHA256 e3d0f71acc842f3a0939eae4dbb74ec85a77b1f2550651e446556d1dddba1891
SHA512 15484d51d3f331ce4e59b1d586a9034f52db0dd20ea065a95412b19397bc4c7eb1d1d5e6f4267ec35621f0b850dca56fd5adfc41c1ed533a68c4e9e7d263fa08

memory/2864-51-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/2864-50-0x0000000000BE0000-0x0000000000C40000-memory.dmp

memory/2864-58-0x0000000000BE0000-0x0000000000C40000-memory.dmp

memory/2864-57-0x0000000000BE0000-0x0000000000C40000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 34bb7238217d0c3b7a392f33037db1b2
SHA1 0a3a4873f4f81ff0b06199e3047d5a22ed5db69a
SHA256 66c8c40d5b9671aa20bd89ee28704a1c5a5254f447267aae818cbf10fa463c41
SHA512 307797d55595e8269b4adbd6765e8ac77df5e3233bf4bdf03d65aae2e39d02a032070c89debe574168baca17e9cdf414f7d84a2cdc1e7b443fb97e87b97795b3

memory/2776-71-0x0000000000400000-0x00000000005DB000-memory.dmp

memory/1508-73-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/1508-70-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 dbd953cc03004f6386cd55df93c85587
SHA1 b6fa7b8d56165946b2b56cd65e907d0d41c093fe
SHA256 6b7733aed4fe997bdbf58e3f5a12b5bd95d1cfc39c1703a3a32d7433fc676dff
SHA512 0eca875344a830b27c5f546928d3eaa71275a54af47cc172730b8b2edfaaf8c5ad4ac470782c495e07b82fc28c31aa635e819227f6d4b4b26616dda375aebc31

memory/1508-77-0x0000000000230000-0x0000000000296000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 7d9bf98055ca9f84c5c259d1a6f6eeb0
SHA1 32403a4f65305beebbcb857fa6176dde0e6566a5
SHA256 2cbc7c3798711d88fe783f99c993eacf5de922081134850db1aa9edcd4616a9a
SHA512 5bd4d7a90c5661ba1404d0816f75b72ca62977743c8f6220060c4c7616a312b22e2b14bd698bc18c683e3e203b14ba5943bfde850e1c0ac23fae9a2c1555ba3d

memory/2864-86-0x0000000010000000-0x00000000100A7000-memory.dmp

memory/2764-88-0x0000000000260000-0x00000000002C0000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 eb9361ba715c9931e921808548e25395
SHA1 41965eee94d13973dc04904d5ef59f81390a776f
SHA256 11900b6d9a0bd72fcb5a200894d5f48fa9aaaa1da4fd50cac81a2cfaa04d3359
SHA512 2f5f6151d966a11ed21ffc311b2aa5020f87d43dae4ddd63fa4ba9a71c7962ba8350b212dfe25e569617ce2b090f8443a343d5e715fb67906395a7f635b3640f

memory/2764-92-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2552-90-0x0000000100000000-0x00000001000A4000-memory.dmp

memory/2764-96-0x0000000000260000-0x00000000002C0000-memory.dmp

memory/2764-97-0x0000000000260000-0x00000000002C0000-memory.dmp

memory/2540-103-0x0000000010000000-0x000000001009F000-memory.dmp

\Windows\System32\dllhost.exe

MD5 fcc12dc0cdeab0e3d5ae08e5e603b60a
SHA1 1c76a606c5a04125339909cb45c0587fdf3abaac
SHA256 02154fb52686f9bb0f4e0832dcecaac53aa122bff4b6dd3e0387ac48017cb90a
SHA512 d89deaafb5fb387c5c671180a395a615c09ce24d3e82cc8d7af250fae642089c1361cadc718e550b88ef4d2b4468e5d5c4d17f07a1faa6a73d0878eeb7732957

memory/2228-110-0x00000000008B0000-0x0000000000910000-memory.dmp

memory/2228-111-0x0000000100000000-0x0000000100095000-memory.dmp

memory/2408-109-0x0000000140000000-0x000000014009D000-memory.dmp

memory/2228-118-0x00000000008B0000-0x0000000000910000-memory.dmp

\Windows\ehome\ehrecvr.exe

MD5 1d8b7e4c8d71d0d20a650c2a8bba2037
SHA1 7f633a1bf0874e878a6a6616e4566a6bfddf48a6
SHA256 dca0d5bffbbe5d51f393f892edf42ce3c3bec418992db4df0909b1382f1cc4c4
SHA512 1c8332dc8d00d52fc56bda9a7d7ed4c1bdb547fe2e8a988fee10c96673a6b526e4738f34abf60a596f413f89c9e5a25d9a4e61a0896b86184c5b7897da4c9df8

memory/2220-124-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2220-133-0x0000000000880000-0x00000000008E0000-memory.dmp

\Windows\ehome\ehsched.exe

MD5 d0a52e9de51d1c266b4bb891184f1aed
SHA1 d32b7f1e792ff6887bfafe906b2cfa0d608a8cc7
SHA256 61b5cf89f76eeb4279fe291e4a58102051afc14849d4730d62a0e756010cccd7
SHA512 8bd2f6c7d30d7b68e1227e2fb69c56769b572ce82ed6489fb087af6bbde61959259e4d83913239569817a4e64dd18804920a776c595d1b4c8d9fed5ed9de8032

memory/2072-140-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2220-143-0x0000000001430000-0x0000000001431000-memory.dmp

memory/1508-148-0x0000000000400000-0x00000000004A8000-memory.dmp

memory/2072-150-0x0000000000170000-0x00000000001D0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 db4f93828a819d56d0314d676a12fa62
SHA1 b749868895e12741322b55ed03febc66c4ed8fbd
SHA256 3ec7e0883b71075c3ab7553038dc4e976c6ac7a0a260250821d84b15c9c609ef
SHA512 efce1d86235ab6494198e8ff626eccbb281aa9ea903d91194e2d68a35180abe6156482483abdd6e8583216375ddf4c46ced933ac78b4c04c28a5617fd831dd47

memory/3012-155-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2764-161-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/3012-162-0x00000000002F0000-0x0000000000350000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 b829ac0fc1063e9e9d015efcc9ead7b4
SHA1 1a957a3a8e7fa41fbbf5a68d5d2b774affac4501
SHA256 8fb3cdfcf6ca2912411a9320fa9830c2bd91560a8c3aeacb1bedcd836b4b52e1
SHA512 9204f52949a3d6ac517394a6b09eb6c96746b3270b0b6fd9346479f43aa68b2859d94a23fe130f689bb5aff4e25337b6cdd69b9629dc8ec5d4ec346f02f3de90

memory/1064-169-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/2228-176-0x0000000100000000-0x0000000100095000-memory.dmp

memory/1064-178-0x0000000000290000-0x00000000002F0000-memory.dmp

memory/1372-179-0x0000000000CB0000-0x0000000000D30000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 81d57cefc9b49a534f8baf87dc0421fb
SHA1 b868870b4e0ab0218a0223b98b54e227c21559f9
SHA256 ef0a2faa42df7dcf51ade2d05e8eedaa765cd4ecd92d48fa1320e064766a060e
SHA512 452c54daa5123e40ac779e86519e2613e7bf4a3795d589fb26226a59333aef7f9b6728f49fb41da6c62b71b64b62ede9f1edcff2521f94669e96d83a5b877af6

memory/3004-191-0x00000000002D0000-0x0000000000336000-memory.dmp

memory/1372-190-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c553cc3c615f33e1a1c07f59123425e8
SHA1 3aa7bd6d6e8824e434de8ef82507be76405ca600
SHA256 dda163e676c696a2ea3d352f9a11cbeb91779c60e8800a58027c4a0e9904064a
SHA512 f104e4bc354cd71823700c09f8f96744034e04002f5fab78eb5fee9e2bdfebe814b00a711993ef4f4c54db6480f055506fb730392ad9ff99f4b0cb8077583c81

memory/1372-196-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

memory/3004-205-0x000000002E000000-0x000000002FE1E000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 0b734dbad3696e6575910e8cfd4e4238
SHA1 b6560b9bd96281564a70ebaf8e007642aa1fd838
SHA256 d1283fbc816d3d906a6a9f7004f07d35033c863a69f9565806e470f1302e6e8c
SHA512 a5f32036ca4c151af7260f6472c3e9301feb6be8f81bd9e5ecbc29a966e382d45bc2dc69144c7f27dfa90eae131c5940a1d6108f84fadea1e7b3fb38dce6fc92

memory/1740-209-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/2220-214-0x0000000140000000-0x000000014013C000-memory.dmp

memory/2912-212-0x0000000140000000-0x00000001400B6000-memory.dmp

memory/1740-216-0x0000000001000000-0x0000000001060000-memory.dmp

memory/2912-221-0x0000000000B80000-0x0000000000BE0000-memory.dmp

memory/1740-225-0x0000000001000000-0x0000000001060000-memory.dmp

memory/1740-226-0x0000000140000000-0x00000001400CA000-memory.dmp

\Windows\System32\msiexec.exe

MD5 9afec9dff49b2f6e1e5e2e4b9c62df91
SHA1 56ad450ea9654297a5e2eebc9f3e2b256c756f4c
SHA256 87297bffd28dec115c48348dc7351131a57c01a6b3bb05bacf78667bffaee36c
SHA512 d4a7e5fadda3f14029c989c15e7b25e8a56a1814ff3b632b244cd993e9add25d2d5a44e868304bef064035d17250c43cd21fa09c09fa71f2060d4e56a8431fe1

memory/2072-230-0x0000000140000000-0x00000001400B2000-memory.dmp

memory/2688-231-0x0000000100000000-0x00000001000B2000-memory.dmp

memory/2220-236-0x0000000001430000-0x0000000001431000-memory.dmp

memory/2688-238-0x00000000001E0000-0x0000000000292000-memory.dmp

memory/2688-245-0x00000000005C0000-0x0000000000620000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 25690827f3353b92903f19cd8ad01b09
SHA1 7e30d9a2dd1b8d3909fb42cc4b1d17d2903330a5
SHA256 b2f46fca860ddf44c52a76f05df91903b84ae4f215e4f0c7ae787f437ede6224
SHA512 1b209f6ddad26aa99db7c787317a78f21496dd223dce52973752726d3bfaba7cbbf815534aaf246f3548a5aec157c03a3eb86af9e5b2acc13a72eec17329bcb0

memory/3012-250-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1496-252-0x000000002E000000-0x000000002E0B5000-memory.dmp

memory/3012-257-0x00000000002F0000-0x0000000000350000-memory.dmp

memory/1496-259-0x00000000003E0000-0x0000000000446000-memory.dmp

memory/1064-262-0x0000000140000000-0x00000001400AE000-memory.dmp

memory/1372-264-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

memory/1372-269-0x0000000000CB0000-0x0000000000D30000-memory.dmp

memory/2752-271-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 e17be1a616254471e9ab89c58d62a783
SHA1 fc38c9b5f548df69ef79541659f2316d6e8771a2
SHA256 0c9528bf6bbc848f205120121fabbffcbb88881b2751eee92bf0275d6d25d84a
SHA512 fede34415aaa4e745c8b053f94da7d98cd40e145b07b4e2bdbb779e48eec35063ebea7f490a59ae14f00b2d69a0043d7cf6051f1bb7562e787986aa7ddbad484

memory/1372-280-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

memory/2864-282-0x00000000004B0000-0x0000000000516000-memory.dmp

memory/2752-285-0x0000000000870000-0x00000000008D0000-memory.dmp

memory/2752-286-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2912-284-0x0000000140000000-0x00000001400B6000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 1ab87160c05ca41edcdddafb33f03508
SHA1 38d1bac95599b0f0321d0374bebd1d43f6f188b8
SHA256 eea16af54f8363aa8714b00517f0cba984d7f5a75eab36924abcf4b5f6382b52
SHA512 03eed4b23ae7aa1dc616fcf232d8a01692f2c02eec8b2816c4d926240cfe860181ceb8c240a7e219578d48a9884f5dfd08d847c7941eed522f23eccb4ef92cb3

\Windows\System32\Locator.exe

MD5 b30338f54c712996c0a566b096f0da1c
SHA1 92cdd0edc069411189ce6d9b902c776e83d3d36e
SHA256 d114cd88c730ed91e753d6eba8e28a1b80981d19a069b5c0a72d87379feb840a
SHA512 cb126b30adc22c29041a9e845b82ff06b4f76ddf7859b27d54b22eca88bec7e4d5357c987862bf1fcc335bf19dca195a2ecb6073af24e3a3fd542bd1c186ec68

\Windows\System32\snmptrap.exe

MD5 443d2d2e5ca1452e5b843ccedfa9b97f
SHA1 60e41afdc6b9c76a53edda61da7cc2a37a501fcd
SHA256 b77794f1d0019b7784bda193eb79849dc3bd3088fa1caea086d7fac2edf09fb4
SHA512 1eb3fef8bec3a5a26c01a33f96db27562e187cad54201ddec7230ab0a3cf65f8f122d70c013db9cab413a2b792ef699c0291eb3ad22b52e0e6bb9024054ef00c

memory/2864-320-0x0000000072750000-0x0000000072E3E000-memory.dmp

memory/2036-321-0x0000000000240000-0x00000000002A6000-memory.dmp

C:\Windows\System32\vds.exe

MD5 626f4b19a9bd4a80f734cb63da1b358b
SHA1 5fc9405b6fc3d30824ce96668181d5f2eb09c5e6
SHA256 8ebcfb5943868cf74b0757947631b2703151f58b0aa7eabbfb6c58fad1397196
SHA512 605281109b8a56e5bd0d07bab8ef3602fa8a955524e7b9c19d56f73e64f668409a69a9bccdbf9f9208725f37d54ab5f2481e0f03fae1210654a2fd85abdca217

memory/1624-323-0x0000000000420000-0x0000000000480000-memory.dmp

memory/1624-322-0x0000000100000000-0x0000000100095000-memory.dmp

memory/2996-326-0x0000000100000000-0x0000000100096000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 d36d364f84db78d28288500e1556a1e8
SHA1 625d572f3ac8fe1153c4795d6289b14d704c8a4d
SHA256 9200828c89d1a9f5ac682cbe2c2ac1b2f78740e209214f2d79422c72b4aa850b
SHA512 7fbc6c2a621caa0275cea32a96a5b91176ecbf31306833350b6cbd0b4c3e58f2636899e351fba9459461c7dc581cff87a21bafc688af85e07f9f6a9fb63f7338

\Windows\System32\wbengine.exe

MD5 baf5cf1b53bbc8b2af90484228b9d2ae
SHA1 36cda3fc14160e9c54ee44a38209595b2d82a1a2
SHA256 c4fab25edec93af7dfe43773445fc28440d6c8dc55b5487c5255eef971ecde2a
SHA512 71da084ca92a0511f7eca917feedc6f6b648a9fdbfa7b35e83aa6d6b93c4fbedb244999b8d03ec418fd748efb038a5377b5348ac6786ba4d8fb108ea9703f3da

\Windows\System32\wbem\WmiApSrv.exe

MD5 1760a5ca331e0e987f482e189b7dd9f0
SHA1 26c1d2c0052d8ddfba8dc6728acf33d514b768b2
SHA256 da379944eb8f7f5c2d27cbd37c36fa9406002310f67a0979c9ab507d940e2901
SHA512 d543abcc6666703f6fc328f18c320c74701c5fbd8bf1a6f30bdc2308b720435f84f15e81eafabdac3a146609006fd00f0b97ae8c7687d86e57f395d694cf777f

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 660b22edc672be226f28d3c0d9634be0
SHA1 0c7a4df01c5905f69c76bffeceda872661595bf5
SHA256 2959d0b0cb64b35f4efcf5be978ff4f5fe9bfe4acec96ce59e1b1367a1ada13d
SHA512 a5af8988e847671f01386320b4bc4a93b1353f40c3155269d9fec98165209754abde4949289a9aeda51e172fa11483bdae763814976fefeb088cf29bfdfc7598

C:\Windows\System32\SearchIndexer.exe

MD5 fa0063c09856b36b878234328103fcb0
SHA1 1cbe6710514e899ec3935c2078cc9f724f78f5e6
SHA256 bcc27c4f97da27ed8175112485ef5958ac56385bf1a5cd34a07e56a9bef2a38d
SHA512 3d45fca2acdadebf65e6c899ff51b3113d9a2bf47a6612a2bef6b9e9dbe319e3b246dc5c55c74e4a318e419f4c7048c9e878c8d0b86dd30a67c09bfc8ef4af94

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 40077e58c61fad92519e140e0dc34022
SHA1 2cce66177530344f88e37eb84f0043be701bf444
SHA256 6e3868949a3dc1443296f14a96c93c58e3b50bfc4b177f37ac0b233ed8baa1f0
SHA512 20e5128d8533a27568aacd900a58a947cbbce92dbd1bac8dce44871d1f7edb57b8d303c21c1b9945e386bb42265c48ed32347b3f4b275e0dd835c30eab2f662f

C:\Windows\system32\fxssvc.exe

MD5 cb0c4400d317eee4cd37d38499b229a9
SHA1 e13618597dc41f64a2f79cbdc29d485b7d0b72c0
SHA256 166224f821b15a4ad25dd2d28cff3923afa2555f3dc56cfb0e50a85984158fa5
SHA512 f2f8e337a3da9aa985aee22ba946b8f09d911c5995a4788265cdf4035c6ec93a1b67e44e15195d7a5d6c1b40ea7b870985750d7cd44b1bdfd68ad61e6869f52e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 233731fc18a4b0d0f2111774eb6f79be
SHA1 1d2da5e011fec5f7ca6e4947c14b3f8f90eb852c
SHA256 e288ef0e3b5f87224bf2c36060561ae63d565a5b8737498959503d3018784afa
SHA512 af46f29732d71480fa0f4ba1a7b9afffea0f8d368a485259c2852d6957589188fdc5f7537400ce2f9fe3e2072896754c48e7f0d5c64f396c9d56fda29e9a2381

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 22:59

Reported

2024-04-07 23:01

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c75772238ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_ml.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\java.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_sr.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_vi.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_lt.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_ur.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File created C:\Program Files (x86)\Google\Temp\GUM49AB.tmp\goopdateres_mr.dll C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdf3053a3f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005178c6383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b89f8383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a015c4383f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002147b7393f89da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe

"C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp

Files

memory/3308-0-0x0000000000400000-0x00000000005DB000-memory.dmp

memory/3308-1-0x0000000002470000-0x00000000024D6000-memory.dmp

memory/3308-6-0x0000000002470000-0x00000000024D6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 9408cef52129faf665cd5e44ae250c00
SHA1 d53a47fb0cf2b67e60f29280f53faba0e5c526e5
SHA256 bf2da18c8c25a5484ac88aa07fe7d54345007d59ba3f94d04aae6090a126d1cc
SHA512 57558c81227daba0da298d22fed81c65803118bd8f69a0927ada03d538cfecc829dcd0011d0b9907b2e463f8f440a4431c6c8b82447022a8cb6b677ce8b557a2

memory/3324-11-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3324-12-0x0000000000820000-0x0000000000880000-memory.dmp

memory/3324-79-0x0000000000820000-0x0000000000880000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 676b37294303eba316c03ef7586498fd
SHA1 8ef5ff7ccce218cccceff2e9aa8845c89e47c278
SHA256 46d7aa1b3e9a47b616b966613ffa363af6f5a4d75f48bcd00c04c99383973804
SHA512 da256adb59f0b18dfd89d54da428c840444fbfdd3cc05f7768cd6948ce46fff2f180d5bbfb498fd911ca8ca8c58e4c2283fc42d69bee948877e99c2cb50d0d04

memory/2884-94-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/2884-93-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/2884-101-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/2884-100-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 8318fbd7f7a670cba75b68c6bc642ead
SHA1 4de10319c51b1854e6ccc7a7ad084834ba05aba7
SHA256 fd79292ef163ec61b621f62ad6970f9d1eaa196a50d1aefceda765d965f013ed
SHA512 d78290f7259e136c94b8df55c606bc378e01527a3c7a4ed65c6e20dee1780ec1ffbdd5eb1ac884f66b241c00b1c98d05a2a61b86a60a1fa6b35721476c91c3bc

memory/1840-106-0x0000000000E90000-0x0000000000EF0000-memory.dmp

memory/1840-105-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1840-113-0x0000000000E90000-0x0000000000EF0000-memory.dmp

memory/1840-116-0x0000000000E90000-0x0000000000EF0000-memory.dmp

memory/1840-118-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 7a8eaa4e1428fc78cb8062e83d0944fb
SHA1 588f971bb7cd5c19af48882d540acd60982e9dba
SHA256 49db7a9196ce4c164fba049e59b9e7bf3754b532f2470c8df06ab898a5795f2a
SHA512 f8e8fe44880f130b880074227ddb07758e6710a35c33e5d0283d2051fe4c925326dd63387cbc50a6dd94a5d5dbe01789033514a88f8add8225859c483ff671c2

memory/980-120-0x0000000000C80000-0x0000000000CE0000-memory.dmp

memory/980-121-0x0000000140000000-0x0000000140237000-memory.dmp

memory/980-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

memory/468-131-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d9facb5278d65b39c3678769390b5fd2
SHA1 68d583806f1e31821fbd2bb47573401c1b2998f8
SHA256 95763034295d6ab7accc0d4ccc5c7c5614b58657f85697ded54d9cad15c6053b
SHA512 1a6f5b8d5042a210b575d146aa6acab021ae604d5c93ac5b2b1e81ccf605f8c4d2aafc21d4b45ca27ee1c96c0bc79dd8946d4553a3dd17d89d82ff14d3704991

memory/468-134-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3308-132-0x0000000000400000-0x00000000005DB000-memory.dmp

memory/468-139-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 3e6271f1bc434f9a91a8a54577a98d26
SHA1 e3ae0c9a852bf506061d606d888a576826d33ea6
SHA256 b8a346cb427afa125830b8a12e2264f978f1cb0e3ed2f704d9d48d7e1b27f742
SHA512 4b2d0f3dbd4abf006b4dcfd51e982acda682f2fb23b7365de79d0daa5ecce02817373fde92af3927d1de090c04a5170884dc7e7d9377cf45dd368182f95621fa

memory/2752-144-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/2752-145-0x0000000140000000-0x00000001400CA000-memory.dmp

memory/3324-143-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/2752-152-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/2752-155-0x0000000001A90000-0x0000000001AF0000-memory.dmp

memory/2752-158-0x0000000140000000-0x00000001400CA000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 0cf0daaf7752903ff6ca3b4b07e69fe9
SHA1 6e955208b230827d61be59f354ea62629d55be40
SHA256 5e7773b21dcead082c8ca9e3a961288bbed931d6b843fb29cf3af886b4ce1ac3
SHA512 d71f003f986ee76c7658fb3597d0fb400cc7816771eefc0e2c8bb96e08eedb24ea4af97a1ffca6e14b49c69c0b32f6c0397b32fb3e8658c58a32a56e798fb652

memory/2884-160-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/636-162-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/636-170-0x0000000000D40000-0x0000000000DA0000-memory.dmp

memory/636-161-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 be8110d4be1272e513abe65873f3cfb8
SHA1 9ef86e6764e9d98029187717977e200e29d55a2d
SHA256 2af6a652717d79fed292e1958736166cafaf60e5a0c4d089bf793aaca8e7bcf4
SHA512 c353750a589983bb69f3d722a5c075a5b3ce3e5fb669e0748ba79e8df184e5f532fc0d1f05fb5717765c3c75879bfe889cff9d4703b45a60762f46550ae53a5f

memory/1136-177-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/1136-185-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 2daae0f2dad89acca08dda341a86ffdc
SHA1 ebbd2057ad33cfcb314029502156b21dc98b55d9
SHA256 fe48dd7696b1ea5d5ea97a9aaf34310e907bbfad3fa7ec50910c1c930e10681b
SHA512 6c1f45fe6903f44c5d095df981d1dc78e6901a4d1659615bf60244b169e4b8c77f465d3719055179a29b50572e9ab092c940ac899196f018ae36222d325e3b17

memory/980-189-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4676-191-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 fae49e076b3327c1c49a4775c8f885ba
SHA1 a7478a23f4b7bbe0fe801cbe080405d495af3f35
SHA256 0d63993a70a9270c5e0ac0901a0eef4f2d04a0e3c1b2126e32bdd4b99a5d9d2c
SHA512 5c92cac5e4f9049acfcd1c139060f3895c811891df2e9efe0457740b05217cf8daf14bb8c7aa7b7b1c2fcd6fe5cd142fab623266e256bfc3bfff8de3113a5336

memory/3780-205-0x0000000000400000-0x0000000000497000-memory.dmp

memory/3780-211-0x0000000000620000-0x0000000000686000-memory.dmp

memory/468-203-0x0000000140000000-0x000000014022B000-memory.dmp

memory/4368-214-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4368-222-0x0000000000790000-0x00000000007F0000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 18e3b0c4de603315b10c5570df006c56
SHA1 0fd467e3f0c79ea7fc40a612998b87658e8dabfc
SHA256 3d9425db16952a5c75dff63983dcb42f95829db7a9a162a0e837aca8779e3c0c
SHA512 09773a1ea309fb37aacd9dbdf8e09cf61fd8e0ff31017e2b16c0ad32bd20870d2eddf5c4066be6a23eb93852a98c2ff9e3361401009bb5fce1e540792215b88f

memory/636-226-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/3948-228-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 443a1ef6d5d9ce3ae8f67fd926ab56df
SHA1 9af6eb6559733cc2d318b3196cc138e19889cf82
SHA256 42a530b7abeff19324d8114d47abdc175feffdfbb1de8dc1d62bc542d2ac4dd4
SHA512 89010dcb57b07fbd62001034f955481d3274ef444550c96f8d148221a0040f8a56caceb5dc514920313d22b812a2bf139b10a8b5f8d844eccfd1d72366379654

C:\Windows\System32\snmptrap.exe

MD5 1fe5cdd3dea67e7140710fcd22cfad74
SHA1 7897e9e4b69e6497b6c6db02329f522c730f4dee
SHA256 f80d7348e1602770f37b4ff5c73ee82e0f06ddd4c69eca63285da5ce9b1cfe53
SHA512 58a0bb3004e431cc2721b29d05e7490dd6ff94af3ea7069565836d89d770caabe60a633a0fb54467bdccec640f43cdd92bef2257069fc036a2b14eddd3391453

memory/1136-241-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4760-242-0x0000000140000000-0x0000000140096000-memory.dmp

memory/4760-249-0x00000000007C0000-0x0000000000820000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 1cb78ed38bd5a27bd35db0b3484618d5
SHA1 320e48756cc8956704b4157452bcfbb8ae21704b
SHA256 5e9fba67ca3cc032907c826bf823aa1cd829115ce6b69b54441162701886019c
SHA512 c256d69208f9b5e1461073ab9e58635e4dbfcd7726c726ab473b3b2b9cf1e3bd6333f169a1b98d74632c40d1c9f679662156ae1c26ef6df35ddbd359da9e07df

memory/4676-253-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/3152-263-0x0000000000740000-0x00000000007A0000-memory.dmp

memory/3780-267-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1140-277-0x0000000000A10000-0x0000000000A70000-memory.dmp

memory/1140-268-0x0000000140000000-0x0000000140102000-memory.dmp

memory/1572-281-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/4368-288-0x0000000000790000-0x00000000007F0000-memory.dmp

memory/4368-280-0x0000000140000000-0x0000000140095000-memory.dmp

memory/1572-290-0x0000000000800000-0x0000000000860000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 5a7c4c58e79fdcd7a1f97f7f23a23a77
SHA1 5eb0f8fb17ef905a3b1953f28aae364f87a5f4b0
SHA256 16d7b3b1021ca103321e8dc5ceb250320ca4f79861fa77baccce973ced902a92
SHA512 2d34f7d33e9e31104d5a062d556f6490a145b6caba8e9e7dc7e5eb0d5148c3b3989464b3c0d1a85e8611a3b4a3e3091467b98978eeadfc980d72c93e3468540a

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 ba24a87c1994ac2b31f62d3af56a7506
SHA1 40945bf2ca9991807da4946500d1241b9904ba72
SHA256 e5b676b927c92bfb644b35f34311d29cb8de8da3af7e7fd6ff40b0088181f760
SHA512 f8463c1a35de92d7e9de633b2afd2d001dcdbf4ab2bdd431f52ef54acf3febce65e7bdc4ab60406baf40ef662ca45ccc173cca56011f23a689541ea6f077c31b

C:\Windows\System32\AgentService.exe

MD5 d5b07ff3b81fa5a5207c092fbbf8c881
SHA1 162580de161bb81cd27617571f91dc830a47885d
SHA256 78c0fb1914239e739216dd97aa3db3ab4096f80472750190d06fa404fbc8744d
SHA512 e20b33c280c025083323351cda1be0e36996fac21c521f34f5b17b167caaec82c188badb6cfcd03309a5414f7981dcc99710c3adb0487d44aedefe952e045b91

memory/3948-294-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2644-296-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 ca72367d3fcf2ebda1519391af233f1f
SHA1 8f30e1db7c3f78ce9a100f821cef4d47f1c49881
SHA256 365fb2ae2bb578c24ce9ff0b557b176f9863c39300ae64f0cf67996f925504d5
SHA512 7b70be78aa0c166086c05608feca61aa5965fa6fb8d20fd00d355d982323cb8690a502aab124f3bd22d2492f4530e83ba765971c7fc2d3f267dcacee2084a50f

memory/2324-313-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2324-319-0x0000000000C30000-0x0000000000C90000-memory.dmp

memory/4760-310-0x0000000140000000-0x0000000140096000-memory.dmp

memory/2576-324-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/3152-323-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 736289b72242e5cd67215c2bb734daab
SHA1 7a40631f688cb6f5b030cf55f9502fe31e01607f
SHA256 6bf89459165921670e57a941f67ee309635d064124aa32958360245a5c3316bb
SHA512 731191a89295de18c0b545c7b1db854dc89f92296ae1e297efe568697666f1ea2b75f43eb87b65fc9bcac24793fdcb2a6c7c882bec9edd306231153a0c4302e7

memory/1140-336-0x0000000140000000-0x0000000140102000-memory.dmp

memory/3688-339-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1572-349-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/2752-359-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 acd9935996394baa24997dcc76b6704e
SHA1 068c27d06672797b28863b8ddfc50342fdddd070
SHA256 4d9bb32ccfaea1665b8672f822bab90f07b8a3cf9e7ef65127e51c2f69302245
SHA512 4f22efed1154a2a94a16734b7583fe38f4ae79e0b2f3cfecf9d0443ccf4f69e46be6221b904223fa7b13a7e3728aae8e9bbe96eb34baaf6a1264b6828e50f605

memory/3384-363-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3384-372-0x0000000000860000-0x00000000008C0000-memory.dmp

memory/2752-350-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 6e404c8843696291741edb32c81e8885
SHA1 c412ae7e2921b3664a25488302d47c423a3e6614
SHA256 42a73406a23e96099d49e44049dcb3487ebba474138256f8737da23fb00a93b1
SHA512 f5bb9ac19c443f21a148f940bf5400f8c03adf5e009d22d8003438c081a3051da823af5a42b1f9e4a3d44a8b43de734e9186371ce05e0140b05c463dcf83f4d5

memory/3688-346-0x0000000000C10000-0x0000000000C70000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 7724abb27cf577235534c0d1f3d38138
SHA1 74dfe30e0d9f65ed1855ac5970abca3ac5f1e461
SHA256 ac6879bd77cb4ae46f540283194d45d114397ca993753369f5b964a8273273e3
SHA512 78c952bc02725246f1706d97547efe230f15a8007542ae86abee3bb3829960175c4445a36f68ff14ed07e8c8ab420e237b319709f4b4ffbe22be92fc34405691

memory/2576-333-0x0000000000770000-0x00000000007D0000-memory.dmp

memory/2644-309-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2644-304-0x0000000000C00000-0x0000000000C60000-memory.dmp

memory/3152-256-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3948-236-0x0000000000750000-0x00000000007B0000-memory.dmp

memory/4676-200-0x0000000000760000-0x00000000007C0000-memory.dmp

C:\odt\office2016setup.exe

MD5 587dfcc884e6c73fa38fac3537923ec4
SHA1 211916dc5f6c89651726581267ecddc04ab7a5a3
SHA256 6cb7fc2d49db6027af569daf1b30c9742ae9c3c4b764648ffcd1f2e857f2afd7
SHA512 3a5b6c08276fa2572959966ca312d956ae091794ab5b9bb0b06dde8e4ff83b353f06b6ab0f06c85b6299c0cb85625e06d4552588f171f21d100b086c26f9b5eb

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 1038c3578f0400a98ef69fe244a74fb4
SHA1 bbe8d752a88e643bba460e0b33d5ddb55dc3bf9c
SHA256 80a56a63adde9c9bb5b5c82c9255718d36b33fab8613125b6b492c46485aef5c
SHA512 147c93052a77cdc1045eb6c557c0fd26aaad15a0babac8ba1fcede536a4473b38ed523d58fdf606df8fa9b546360204a90f26a060c9fb2ffef11deb30accfb2f

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 7dffd6e3103a941df4eeb0119376ab37
SHA1 d812785ce869294698194866b387650bb07ff133
SHA256 b619c6b8f633b4401911d29fa0822736daebdb89e65472332ccb046e930e8252
SHA512 0e77d2c2a1745dd2391921e19969a2a212df7c0895ae41242ccc64561fc12f94e1cdeb2873497c26924f92f2c87be5d3a7fa5394c8b17c49f35d1ad7627d74d5

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 340116038d6b87190f11da7b04768462
SHA1 3f366a6f34f146eca973b5d3c04954948695d176
SHA256 b25d55f45e391e7c146ef938173fbf8e6f88cb781d2e89551791e7b1d46d2eb4
SHA512 2b72983dd95d0c801095a2c2a775ee280f4566c86792963c20d1d41cf3a1726c44c810bb648af6bc990fd27fb46f83b0f7786164544bce21e53c23c21d470492

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 46089d2cd189b23421f7feff1ce2cd0b
SHA1 652f7467472a61a784b8805462161b0a81f60a77
SHA256 dd6f2f51222d0bdf875778b8807eb93c757913ff9acf3f51ffb3c5dbf51279c8
SHA512 fa57cc7204af788a096845944d5f027d08af9f5cc60295e73d24a879240e16a352bf237d37976f6422584868b1fff5d5587b10df26e735b2e33321c7fb1c9734

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 56df0fd3117d6dbfadad9a3979b0b8e1
SHA1 5b625c33a022fd0d744811d1d8f5ebf6352e91d4
SHA256 eb24a6f8fceeb80532a5b776246458f77968c00d0ab33af139c6ce80dfcb01a2
SHA512 d6076b5873fd455743bf83a439b9a95ff9982d7c0f78bcd265bcb87339b2bb3b5192079fc47f7276da117f190575bf29e043714f96cad7c1c6801ce00a7c404e

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 2e183a32fbe497a84638d7cec926d1e4
SHA1 41a8bd6819f994fbaab7771e58afd63592e72714
SHA256 2198ee745ea77f3fcd82a9779b2fc60d7ac1e75404948991be782d3d9954d4b0
SHA512 7cd03f45644464ece66f238a47c296872b14672530545f50a47fc95fef32cc5407a11e8981b6eea72a3c0e15eb829b83b72a03075ceae1667dec7a1f3b2c7dc6

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 67d33fa6aaf65aa6eca505ce70468df2
SHA1 966167d5a9e39d2411cf94b2df2db1b2d362efaa
SHA256 add1f82bc36136d87fd7b5cb7235bbd31f0c19c78e0428fe79762c29a844a2cc
SHA512 859d0efe8706022a5b9121e5777ed2791cab5c78a328abb7b6c0d11dac3c22970d7fc9abb9d52b870a211e70fe6b07608f89320a463060c2af3e2786dde65b4e

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 3ded809575524476c821c6d6976877cc
SHA1 2cb15652bab2c44bb916d7fdb72438b2aa377c51
SHA256 9fe700ad5cafbbdb665337ee0bad6f307be41c41aded34a05efde6e81a41cb83
SHA512 1eee882d87b71e40f18ad3c24121362d9fea26627ac2fad3786087df5fd0546dbd9cc4c8abbce68023096aca599cdb08d3df9fe97f2d62a1f37bf653f1c8fec5

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 e727c67166393e40a670f78445829732
SHA1 cf7239a202beed7fcff5c7ebb89fb85292b6947c
SHA256 fdfff62324f8d1232c31149da75bd321ce99f7e1b868a3e88b4d4a1bad81c6cc
SHA512 819a564ae41282c6f1e1785cc45159c134c669778339e72acf0c1cb1f3549c03286e8d9c838a1e688f9125a554bbdb16113aa366092983935fc7e36362177f4a

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 a50559c50275dc968d4084ee4611c8cd
SHA1 f81a764240dfe0eef10b0228c81c5df9491c7866
SHA256 dffd64bb161cd3e316a1ad36f3dce561ea6f4b151845186371d7db455430cb46
SHA512 f2135c484520b8a2da7f586afaab2fe35f2279a7bb5f7ef8fb55cd9226524d44c17e4a3b45b803795fc1c9532197444164650d6b0a9ef843fdc62de92f1d7313

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 cf6a92977555bb617f520f8b123b6ff6
SHA1 3951f5c6e394e1c815f360dd30c07f80129b6b13
SHA256 651457da1321c5e6abe402b9b0610e716b1652b41fdeafc842d43d1937b0abb4
SHA512 7fd7a4a734c719a1a2b4eb2026bd11436faae77ea185e24726605db8667180a843c237c3f30fb4d3f48502c641691c610526753084778a24e271d28273889e5a

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 cf6d9ba0609189392c07151944a3b440
SHA1 b72d5aae476601b12e0267bf40842e52d7f22782
SHA256 b8581a82a14b2cdf47a951a142f02f965ec1059664e0ce4dffeaf4fab7688b75
SHA512 ac4743d7291ba2181e067d59c863e8e4548696b9fe81ffa5b09d53b888e9c1f48807b568f56166740f39887a2c6ca592293b5fc918229f41f6be5ec20eef0df5

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 52f41fc68b1eb583bbdc0e7e86f569ea
SHA1 0f6cd0fad4b26afaef9e14e900f4ae50619dded3
SHA256 409ad17413e2ec7f262ed72eb8b6c6e69e38f467fa14918a977d59a765e0c694
SHA512 af1ec4a8046da58c87eaf88807c54bf35fbfb400e2d869c2765290edf7b388e338cc936deb071cbbd947f1f5dec3818f4cdae87b72837bfa90211f66255a1c87

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 4cf3dea3883f8d05145fe8b55f35d860
SHA1 7f2dc26cf469a49d14154a1e37625f2ae031af62
SHA256 723b819502549a4bc184608e48d74f26e62f5d2d0d903cdc10894985373aaa05
SHA512 6fb85af0ff847e089efab5161389b8ef824681057ad8ec99bacfb4262f45d68374f51c1fb067230b14052b6e9f782551993dd9b50f0d4b8692d09d5753b06f52

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 00a87d3fd601616f0b7e2000883818cc
SHA1 733edfc00b05b0830f412616f8375fa619b8bd59
SHA256 621590466357dc6ea8a2ae7a8d4f430904819e22216a01e09016734fd94f1a42
SHA512 f2ab7e9be28b744c2619d6ca4081df3b479859f5196559aa52e9bd1289e0860180053d80c1e8d0400d4832c69f4c572c6c73718e41fac361d95510e0a1a96409

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 d86fb2e295378f8f3fb5d7a16378fd7a
SHA1 d5bf1cadea011d103c8161a71144f9fe7ac6ce42
SHA256 bd1d37d47fd3d9bb28b079a775c0ce8c4cf59240a8e9f75a1a8ffb6c7eeaf85d
SHA512 8aae26cc4ba6f404cb3814036cbbc1f2fea1595a9be003b8368fe334b3194e1009d966640a05c7cdf48b22d862d0859fbefcff76eb2d8a8bf72df50492cf5f24

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 890156bae739be47ed09832798a9c889
SHA1 dd0a6abc886378a326d8d54e74b455c55d92e7b1
SHA256 c1877c3d9e9a4a764d3b8da9ed5160467086fd6f02bd176fe7b91acad0e0899b
SHA512 eda98a72797b957f4b0c726ae7cd607af146a30899e8fc0e310da612f465642b7650a77148be85d81a243cabd383f55b39553928bcfd8df41b38f3315bd1a02d

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 ddb57e99ed332799f35f0611bf986e29
SHA1 bcf03de6694d38b7619eea3ae1a4ac3344a535d2
SHA256 e54d68d51a0f6230673aa126be9364dcdf4943b8e20961141994f6553ff9f0e4
SHA512 34ce621f1efaf59f9380f308145c2c136c414766596bfa062d3f461452ca4c257bf1d342f730b4f892affcf0a448c4d5d0c50d08e6f438d89985eb74f9df993e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 9569fbd9c1f3d2b6c7ed5ed2b7bc0c3d
SHA1 a87349b773c1785f56e522b10544ec4c700d7a09
SHA256 5c71515c6b0174e2b66cc98e89beeccd5a2e35a247774d4b3dffd3fe062326cc
SHA512 5f6863f89bbcfcda3aff2b7b8a117b79387fb19c92f0eb73a0d49db8cc2d7a86a5d7813278460dd6f55251ebb6a496bd6afaff12e806e09419c83429f4c0af96

memory/2324-686-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 181ebab494ada86f627d9f8b5dc607fe
SHA1 849de9c2565b16326e601e686aecc578192069f7
SHA256 a7dfea723601d73feeba3efcce73c35e6ad171494be742ded056704f12671fe2
SHA512 8b2de068a02536729497ae7d71b2e198afd294917fca0aea74a686f2a2890bb29d5ac231727119095d3df380f9580fc89b2cfc6efba37975ecc7a47506a3d3a7

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 c471377cd09a12bed953ca38b181f6f1
SHA1 16d9e6b20da18304cf2e8d3b7b807bc345b710dc
SHA256 893fc630bfa2764d77f0524cc6d2e3faf0fb2cb3924f43ddf819c229cf9c5497
SHA512 db7d0ec077002ae0ea025db3c9f4985132089c9752ce54327f04830c9a56f4b164240b7d126c5d48b686dbdc26ac5fbe35e22dd3f583e2b9c5c7521db452fcf0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 7268198c8c704f81b20ec15168c14e9a
SHA1 6abafa74472176e82bc39cc69023b9f7f5753fda
SHA256 10f9dc7e56677b448f2ec2b96131991df5d2f1272456833f4edb57ead0379d21
SHA512 cc989d6095a170327c7e528e4299515083eadd847386a3e921a287e2e26cabb3a14c086d25681983ca1d385faf420b02d28ffbd00eb7d27266d7c23e93f63928

C:\Program Files\dotnet\dotnet.exe

MD5 130f7d27dabbdfd1e65f4dc52f594189
SHA1 777e944fcde41bd5d0e5ce79d959450b5cc35d8c
SHA256 95cab08156d63c6f06ba604f6e8dd0ff3dfac559ebe236f36ce76f1728ece2b1
SHA512 47f0fa54cf2f1bd7aed8743e945bd5a660ba857b1a170466ecb232649a4a20c32cc9997f77728efea4d133193a3801d7a79e6f081f4bbab18f15ff67ab072c1a

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 4d60b547738fd8ad88c7e9342456135c
SHA1 f80248ce99df0c13e910c423854f46cc0411b84e
SHA256 fd3540f9378864eaf727494501610a52b4212edb60b6fbb3fa74ce45ef0c508b
SHA512 f13783a066d8dc827df57a5afb4d7dc545611e7578f9397f8ef0a8765b842ac32675ef894de8a4c8be2b45026854458e4f673c22b5110331947a5aa375566d8d

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 5e552babd7c623af6dcf54006db99464
SHA1 a3fe3cd372411a5a4ac926e5dbf14816489e9c9b
SHA256 84e36fa45b5b273b610302c45d4da387a5b910c306fc05cd1ea85f52b244445b
SHA512 2a183f8b5307d57adc2c2336a4635b3a7ebd557ad55035d71671714ed18a64e36b65f4550c10d44575d7f532b9e6f62debd3fe0a9aa5ad350db6519a1b104288

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 c263b0eb89b2077ff548dd405dc282cd
SHA1 4714b282456fe09af5df8b789021133e2d2c24d7
SHA256 50bd256f3bfb2bb5180bc9606304bdd70b27d3cd9df0d4d19abd98de11ca41e4
SHA512 3c48894bc9c883a4c8bbc9f0d9e8b21c4a51c625284181abaa60ae78db75cb36cb30313550ed48f9d86879401025697a631f451f45a54d2f8167c2766b7e20ff

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 69561f257e31aade8812e0cb2a0ce83a
SHA1 f6b62ceea14ff43cadf303cac5ed8900eecf4044
SHA256 354bcb1628a8230b15b59b3dac9bb1581bcdfce2b8cd47df115c95d517605014
SHA512 3191dfd16e857c928f627694dcecfb2f8b5597f2e80229b19333fa31a5c2a08b52b96a637d629260482eb7b5f0681ad61e1d9c23e15b99dd7e14fcf67fc561fc

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 ea4c63eacdbfe01e38714ca2f3de3911
SHA1 63f551f9aa4633bf984c7e2325b38c6b2a62ebd9
SHA256 95d5ac6e2a688826727225b7f998bd182c0aefc7b70fbedaa451cc1b1c6bc349
SHA512 9a96d0ad58d11543885468174352468069f5a640926550ad763551f84e1f0c8d92b7a93d689c7a99c2d7bad653ec70873e282613e4bf513b074842be1f94c321

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 3e8aab972600c5242886f5cffde8e467
SHA1 ea7b7b08feb39f46e653759f0cf8b66fca43c34b
SHA256 bb09dfe9f4e85ba604776fe47f6721290dace14224084a13e2c12f667b7aab8e
SHA512 5ec559207c2bb635836624d389c067ab085a6224239eea9abda502a93fb2afdc63cec5840d4f9b1cbf5c8aa22f9ba92d9f225f2e977b274e292fd597a11acbbc

C:\Program Files\7-Zip\Uninstall.exe

MD5 6ebc19fd23e99bd55dfd4afd26d96bb1
SHA1 a5ca5b0c7a05041857eabc1b7bcc971bc2fdfe1d
SHA256 ba2cf7b2d3df393c6a93b01333fc878a7ee2589181359c1bb4fd67daed0f771d
SHA512 bfd759419a2399bbf232777b749f2e5498316edb867dfd6dd99942510755706a3310a4737a577419766a02922558cd959d6845bc051449a931ab5a749b9f8f6c

C:\Program Files\7-Zip\7zG.exe

MD5 ff8e1b2498930caf488bab520484049f
SHA1 3adc1793d327c68537ad4df3e95288bd61486f36
SHA256 b6a8e6624c91281a12dbce45e0007294100a95b94bf5426401764a18733a1147
SHA512 7d5b7ad17f4222326c8eb3dbc571399c4f69063217291d4739f56a4f4a7d5f303291c06d49bcb3a2e44971f7e641a074100f15d101c23edc053d18dbad47ea02

C:\Program Files\7-Zip\7zFM.exe

MD5 adab910d7bbf99a50f2a659ba81ecfb9
SHA1 06008c19c1d09e107f3dcc74ad105401b63d22ea
SHA256 4ae9f044089396ebc7d8691828fcdc79541417ce147e89fbf1947d80f8861031
SHA512 7be76b7a5957906f19698b81db11ae454f94a60763cb95972c06c6ebce867be36146e5b7dccc73af41014a71486922ef7e4d7dae87683163f018afd41f5ae581

C:\Program Files\7-Zip\7z.exe

MD5 0ed7f3ea483887544578fcc04083be0f
SHA1 129f8e608fd6c05e35ea2d85f99d33cabaebfe97
SHA256 5e08d29a9b198619d8b98a2e48c044e867dafd1d14b6bca38ce318142c76759b
SHA512 93e76246a264abe9713a727b7a3ab7e908539cef412ff7bd2e0995b4abbc87b1cf20149292868f5039f7a1b713836fae26a0b5f37e12b57d2005b9d04ba7c0ca

memory/3308-649-0x0000000000400000-0x00000000005DB000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 93972009e9a532db19479450ecf2187d
SHA1 02d565226c2f2ec205bfe20c8e9acc7fcdbe7768
SHA256 e62dc49c06c85c940f6d89412ada7568817568752ce7177a0a6bb5cd8a60b36a
SHA512 16aa58e96eb5c5b564d1b58eb2e776e0830ca5d79c3925b96b7d596594642841620d9888946015e49ec3f4f161e4cd8436eaa4c5cb97026cf43066673c9765b7

C:\Windows\system32\SgrmBroker.exe

MD5 26db91acc9010caa5d978a13a6ccecc1
SHA1 b3907ed9c57da146a4bee9ea14ba388676b0d161
SHA256 8d6487f25adbd03b49815e64dddf57b321f598cf195189a16b59df7cb1fff1c0
SHA512 2c829edca537949f1c838b7e8105a921bac56d9d6359387a047ee07e5f4484d568979b9a9da204e521798c318b4fc88892d136723c821d6645c1ae47fb375d1f

C:\Windows\system32\msiexec.exe

MD5 75fff23fc43487e71e0e3bae1d575975
SHA1 77b668e7013aad8c8c8193576ad75fa0110aa2c0
SHA256 230e2b2cd42a8a4e68b570fe04b57b6d8bca6554e71d443bd1a9e98addca42c8
SHA512 2d67526c3e93fd5433a59109f0a721a39d307b77594176f93fc0df8456825d0a85cc765ff05614ff7f576cd6b9ab2b8b84370f3eac8cb2cf36d588383775c58e

C:\Windows\system32\AppVClient.exe

MD5 0e2391171ec7a20be496195c18ef7467
SHA1 eb53e63eac1e527ca683a0942990f1f4d791817a
SHA256 de3f4f14620e03d667bd028e290569acca33d9837d0c4b3b84ec3f1b117d6a96
SHA512 3450e341e00ae322b91eca76de7ce6946bc72748e00fa5d44c895a8530c04983d084b16a5031163d027b3171ff061c7d23484f7458a5a09d63459f22be7e9882