Malware Analysis Report

2024-11-15 06:11

Sample ID 240407-3npw4sab89
Target 97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4
SHA256 97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4

Threat Level: Shows suspicious behavior

The file 97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4 was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

Uses Volume Shadow Copy WMI provider

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:39

Reported

2024-04-07 23:42

Platform

win7-20240215-en

Max time kernel

104s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\ehome\ehRecvr.exe N/A
N/A N/A C:\Windows\ehome\ehsched.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe N/A
N/A N/A C:\Windows\system32\IEEtwCollector.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\system32\dllhost.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\IEEtwCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4234b7c0bfe435d8.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\system32\SearchProtocolHost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8E0D.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9444.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File created C:\Windows\assembly\ngenlock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehsched.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B882B0A6-820C-4CE1-A816-6350AA44275D}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B882B0A6-820C-4CE1-A816-6350AA44275D}.crmlog C:\Windows\system32\dllhost.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File opened for modification C:\Windows\ehome\ehRecvr.exe C:\Windows\System32\alg.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
File created C:\Windows\assembly\GACLock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\speech\speechux\sapi.cpl,-5556 = "Dictate text and control your computer by voice." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wucltux.dll,-1 = "Windows Update" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10311 = "More Games from Microsoft" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\ShapeCollector.exe,-299 = "Provide writing samples to help improve the recognition of your handwriting." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" C:\Windows\ehome\ehRec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000 = "Sync Center" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10300 = "Play the classic strategy game of Checkers against online opponents. Be the first to capture all your opponent’s pieces, or leave them with no more moves, to win the game." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10303 = "Enjoy the classic strategy game of Chess. Play against the computer, or compete against a friend. The winner is the first to capture the opponent’s king." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\SNTSearch.dll,-504 = "Create short handwritten or text notes." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102 = "Windows PowerShell ISE (x86)" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10101 = "Internet Checkers" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\XpsRchVw.exe,-103 = "View, digitally sign, and set permissions for XPS documents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Disk Defragmenter" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005 = "Desktop Gadget Gallery" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Windows\ehome\ehRecvr.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\sud.dll,-1 = "Default Programs" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32" C:\Windows\ehome\ehRec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-105 = "Koala" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rstrui.exe,-102 = "Restore system to a chosen restore point." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Defragments your disks so that your computer runs faster and more efficiently." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10055 = "FreeCell" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0ac60f54489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\rstrui.exe,-100 = "System Restore" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\recdisc.exe,-2000 = "Create a System Repair Disc" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" C:\Windows\ehome\ehRec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090f9ddf24489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\msconfig.exe,-1601 = "Perform advanced troubleshooting and system configuration" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10209 = "More Games from Microsoft" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\migwiz\wet.dll,-590 = "Transfers files and settings from one computer to another" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10058 = "Purble Place" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-588 = "Windows Easy Transfer" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10304 = "Move all the cards to the home cells using the free cells as placeholders. Stack the cards by suit and rank from lowest (ace) to highest (king)." C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\ehome\ehRecvr.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10308 = "Mahjong Titans is a form of solitaire played with tiles instead of cards. Match pairs of tiles until all have been removed from the board in this classic game." C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\ehome\ehRec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ehome\ehRec.exe N/A
Token: 33 N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\eHome\EhTray.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: 33 N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\eHome\EhTray.exe N/A
N/A N/A C:\Windows\eHome\EhTray.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2580 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1992 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2828 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1368 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1848 wrote to memory of 1872 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1848 wrote to memory of 1872 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1848 wrote to memory of 1872 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 1848 wrote to memory of 2392 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1848 wrote to memory of 2392 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 1848 wrote to memory of 2392 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2580 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1472 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2656 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2100 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2420 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1720 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1408 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 528 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 528 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 528 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 528 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 1888 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2580 wrote to memory of 2468 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe

"C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehRecvr.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\eHome\EhTray.exe

"C:\Windows\eHome\EhTray.exe" /nav:-2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Windows\ehome\ehRec.exe

C:\Windows\ehome\ehRec.exe -Embedding

C:\Windows\system32\IEEtwCollector.exe

C:\Windows\system32\IEEtwCollector.exe /V

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1dc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 254 -NGENProcess 244 -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 25c -NGENProcess 254 -Pipe 24c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 23c -NGENProcess 250 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 234 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 258 -NGENProcess 250 -Pipe 244 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 264 -NGENProcess 23c -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 234 -NGENProcess 26c -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 23c -NGENProcess 268 -Pipe 234 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1cc -NGENProcess 27c -Pipe 26c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 280 -NGENProcess 268 -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 280 -NGENProcess 1cc -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 280 -NGENProcess 284 -Pipe 268 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 280 -NGENProcess 248 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 290 -NGENProcess 28c -Pipe 284 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 294 -NGENProcess 27c -Pipe 23c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 288 -NGENProcess 28c -Pipe 248 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 29c -NGENProcess 290 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 29c -NGENProcess 288 -Pipe 238 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 278 -NGENProcess 1d0 -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 264 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 27c -NGENProcess 2ac -Pipe 278 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"

C:\Windows\system32\dllhost.exe

C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1e4 -NGENProcess 2a0 -Pipe 224 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 254 -NGENProcess 298 -Pipe 258 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 244 -NGENProcess 274 -Pipe 234 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e4 -NGENProcess 1e8 -Pipe 254 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 250 -NGENProcess 274 -Pipe 1f0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 274 -NGENProcess 1e4 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1e4 -NGENProcess 25c -Pipe 214 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1e8 -NGENProcess 1bc -Pipe 274 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1c8 -NGENProcess 26c -Pipe 25c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 26c -NGENProcess 240 -Pipe 250 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a8 -NGENProcess 26c -Pipe 1e0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 26c -NGENProcess 1c8 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2d8 -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp

Files

memory/1728-0-0x0000000000400000-0x00000000005DD000-memory.dmp

memory/1728-1-0x00000000005E0000-0x0000000000647000-memory.dmp

memory/1728-6-0x00000000005E0000-0x0000000000647000-memory.dmp

memory/1728-7-0x00000000005E0000-0x0000000000647000-memory.dmp

\Windows\System32\alg.exe

MD5 18f9b71f9bb56a848e0c9bd6be9aa80e
SHA1 38b519966f6cc3e8d8b4d17dcc4342c130ebb42d
SHA256 065217ca9b3e6b149af0236381841111deed2d4bb93c04dd33fd9fc5f4f49257
SHA512 1a8c9bc6f3954fe933e390132bc0e68f1e85efa8789720f11f45248e9a252cbfb3d3ae3f5e6417809eb3ad0f02f0fc7fefc2ae1ab389bf790557ff994976866c

memory/1724-14-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/1724-13-0x0000000000930000-0x0000000000990000-memory.dmp

memory/1724-21-0x0000000000930000-0x0000000000990000-memory.dmp

\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

MD5 88bbebcabb42762e3879078b32421686
SHA1 4529d27b195a0709ffb18851ef29ac78a4314b32
SHA256 9e4195958ef86288739606f9f179d7d344fda5fde13792b2fa7dae3663e395da
SHA512 e7fe43b3c3d5f4c507198d635a2e55d66abcd0118d93d52093cf37caae79edffc3605a3897a54f83b6445b505198e2edf92671ca702670222d25c792e2010678

memory/2772-27-0x0000000140000000-0x00000001401DC000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

MD5 1f9f0c1265fc40a4ce98bd63d01f13fb
SHA1 39f6cf28b701a5816a685a5ef7cbd070b4d91e06
SHA256 b43badd2692c9cfd7a2b5ae84b14a70c56e7d7df1e4ce47132d0e81e738dacf6
SHA512 4f59644e62b934fe4e74fe14bbf6adad88be402d5e7d5b432fcf78780817a150b6c33f20e122d29284139236a12dac1b63d5ef74381dd2a09a1fdefaa9a1afb5

memory/2420-30-0x0000000010000000-0x00000000101DE000-memory.dmp

memory/2420-31-0x0000000000540000-0x00000000005A7000-memory.dmp

memory/2420-37-0x0000000000540000-0x00000000005A7000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

MD5 140619f4c260fdd89da7689c01d5e93b
SHA1 15f9117f9e2a432320768ada82b7544bbef236a6
SHA256 b6100121507b53b83255d03f4980ddcab667eb5ab4fb5a8d4df8d9bf10925f17
SHA512 3f722882e38069e2bf39efa455adcf3c93cb054e27acd01dcdaa5aaa6546edfeefb719df7d13658669202d6fedf5fcc7e378ffcb36ddd67f2df34dd9677cabc1

memory/2388-47-0x0000000010000000-0x00000000101E6000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

MD5 eb54ea05910768c87b049a7732a904da
SHA1 bf6ae1789b032004fb14a69a0fe4e5fde1e5842b
SHA256 c7a4b08088dd7ad548f54e8978cbe76a5fdff5da1eb0186db0185e2a13d024f1
SHA512 4c8a5eece2e37b6b2abff80a0e1a3408cd51e944578405704e79ee0189255e8e024f867a37baa53bcc77690a7162a6fc7b1d3e1eb72ddbc02d6acabb2bc018c2

memory/2420-57-0x0000000010000000-0x00000000101DE000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

MD5 6b1d1f9935c3f7e929705121c556b75e
SHA1 551118fc9a8d51ad5994613fdc60d0fe7495bc03
SHA256 11c1b3998ace6445632669caa0aca7466817a196f264f6feb7dbb072f82641b4
SHA512 54833930daeccabc43e66c1ef5cfc47d1526b4e96a94876326cb4e2a4a1706f591222cf76c06f036876dbdb6062115f281d5ab07901bff709280a1a25032afcc

memory/2580-60-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2580-59-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/2580-65-0x0000000000230000-0x0000000000297000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

MD5 605a0546ec029e4264933a21953f43d7
SHA1 a931fc56fbb331b27dcf6811c8681e3fdd6defd7
SHA256 7a643d57d9eed51bd1a381292879c66d47e77fe596adc15efa7e45d13b4960dd
SHA512 c5db6456074114162cfd81e37bda3056e73ff7935da781e0dbfbffe88d6cdbd86f6cd717efd6aeef4cd76b78c58c0d3ef31440c15a611d544fecfbac7eef857d

memory/2388-72-0x0000000010000000-0x00000000101E6000-memory.dmp

memory/1728-75-0x0000000000400000-0x00000000005DD000-memory.dmp

memory/1300-76-0x00000000002F0000-0x0000000000350000-memory.dmp

memory/1300-77-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

MD5 b09d5490cfa629fc0d4ffddff21027a3
SHA1 d2ac52211a798f3c30a875c78dcff96d438e08df
SHA256 9ebc4f824406ca969577788a05202fd385c3543c3af730325629bcf69b146223
SHA512 ad516e35f3d713f48cadcddace18590e58cf4155c14b16a0cb27ddf4f1c54e1d39661a9bfa2222917824e13d336dfd215377e1d75fa5979ca3fa515e89d56f49

memory/1300-83-0x00000000002F0000-0x0000000000350000-memory.dmp

C:\Windows\ehome\ehrecvr.exe

MD5 326785c42e2520b031b318cf0fc8fdc7
SHA1 a1622a1a36d170add238525f633c223285891d0b
SHA256 65ed0b6beba50509956d2fcfade6f1f52af8716e12c4bcd2419a6ef0f9678de8
SHA512 582ca974035494c4a209cd16b7de104fbb5f3350ba0ffe3019c8d2f3f067b0977bebdf977241838ccb19bccaaec52545b84bf206dbdb351cd25098708ba8f229

memory/1584-92-0x00000000003B0000-0x0000000000410000-memory.dmp

memory/1724-94-0x0000000100000000-0x00000001001E3000-memory.dmp

memory/1584-96-0x0000000140000000-0x000000014013C000-memory.dmp

memory/1584-100-0x00000000003B0000-0x0000000000410000-memory.dmp

C:\Windows\ehome\ehsched.exe

MD5 d2e906e355c7286be11866dd917296ed
SHA1 fd02475bb354b59e043bc39e29efd1460d86ab38
SHA256 e74f6f6d940c6a57ef998cba163bd6906a10a6ff38a2786f1d9f9167666dfbfe
SHA512 b3246351c9a3a293490f8b6bcbb459a8408b931f2eb0703cd4d78e07b301ce420efe1d14274f2c26e74fbfb5223e195a4c78b451a1e504f21fa16eb6f117e2f9

memory/760-107-0x0000000000290000-0x00000000002F0000-memory.dmp

memory/2772-106-0x0000000140000000-0x00000001401DC000-memory.dmp

memory/1584-108-0x0000000001990000-0x00000000019A0000-memory.dmp

memory/1584-105-0x0000000001980000-0x0000000001990000-memory.dmp

memory/760-110-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/760-115-0x0000000000290000-0x00000000002F0000-memory.dmp

memory/1584-116-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/2612-121-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 9178146249ee0d46c2c1c946ef357fe1
SHA1 bfa256e470912f668d5bd8b365338760830475ea
SHA256 f44a84cc748c65f5d178b2bcd50289a5445e5b4055dd4001838e0460b0b39986
SHA512 1e936c09b8ae1c2048c18eeea42c75414ab62fc999e0bca27e6918fa12937ed63b636c1d2da116a5b46fc34487b90fbc99ac2edf50dc6af3466bfd1b8e2f37b6

memory/2612-124-0x0000000140000000-0x0000000140237000-memory.dmp

memory/2612-128-0x00000000001E0000-0x0000000000240000-memory.dmp

C:\Windows\System32\ieetwcollector.exe

MD5 2bc90cd7b647707bf8e131008e44e212
SHA1 b315a5f8d6ed5ab6776c9560b4aed1aa3133a4ed
SHA256 61cf2971cc68bb948900e3c0e9658375931897c6530d12aa74227f52cc19f4a8
SHA512 4da1981f81a0abc1b9387967a66b12792a068390e0d430610e1e822ab63c27ec060ee66b1f7d29537cd5277b360c0649a59db959192de5f24803e5daaeae97b6

memory/2580-131-0x0000000000400000-0x00000000005E7000-memory.dmp

memory/768-142-0x000007FEF4880000-0x000007FEF521D000-memory.dmp

memory/768-143-0x0000000000B90000-0x0000000000C10000-memory.dmp

memory/1384-144-0x0000000000230000-0x0000000000290000-memory.dmp

memory/1384-145-0x0000000140000000-0x00000001401ED000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

MD5 5cebf419867c1f3f3da85f73c7e228b8
SHA1 230cce0623d42b18a65e36145b70047e609587ce
SHA256 6eb3ba782f74cfe0c30988ba26c610a8d56a94ddd2253185618c30abd78e34bd
SHA512 0291e6ee6611fa2295daa21716813e6b1b883c29da2351459bd5135e63f1533727d765330c94bd9cbadb7b462b194ad725c917949870d46c27521a957640488d

memory/1300-150-0x0000000140000000-0x00000001401ED000-memory.dmp

memory/2176-155-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2176-158-0x0000000000570000-0x00000000005D7000-memory.dmp

memory/1584-160-0x0000000140000000-0x000000014013C000-memory.dmp

memory/768-162-0x0000000000B90000-0x0000000000C10000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c7507d8bdd98481e355742551bde8cfe
SHA1 4b50492e5371b5bc35ff8049b90e196f5c76904a
SHA256 cd5f5ac9ab7235d89ff0031bda140d79f8c6e363848dfd23cb022e93f5d473f4
SHA512 02d47458f97900d98dffced1ba6f2631d5a57e1fcdfe20e80990d799224b33097cf2ff9b68b69f9078d2d94d0b83e8dfce92fa327edb1d58dababea27b17e1a6

memory/1680-165-0x0000000140000000-0x0000000140209000-memory.dmp

memory/760-171-0x0000000140000000-0x00000001401F1000-memory.dmp

memory/1680-173-0x00000000009B0000-0x0000000000A10000-memory.dmp

memory/1680-178-0x0000000140000000-0x0000000140209000-memory.dmp

memory/1680-179-0x00000000009B0000-0x0000000000A10000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 b75095980a3c3f3d24eb350ca89186ea
SHA1 361dec5c42ac2026564bf55ea40e548ec92a0990
SHA256 0fffca959882b16341c404e1a44ed622700cf8e7b2c6f3572755c0ccb489acc0
SHA512 2a24a2455a00f2c002081b338d43bf9895fc84d19beff862db78eac752152abc063c28e805d374a1fe76ca1792c42b29982cacee96441ec7864095ced6fd2646

memory/1584-182-0x0000000001A30000-0x0000000001A31000-memory.dmp

memory/1424-184-0x0000000140000000-0x00000001401F5000-memory.dmp

memory/2612-191-0x0000000140000000-0x0000000140237000-memory.dmp

memory/1424-193-0x00000000007A0000-0x0000000000800000-memory.dmp

\Windows\System32\msiexec.exe

MD5 5fcedab78a8b07da157260a79f357e86
SHA1 ff9f920e68dfd5e07bd6d6933284cc4ea7b81c69
SHA256 6f73f13c4e635153fe47acc1f270a88c4cec9ac38a24db2d815ca6ec3527c921
SHA512 e81da7af560f359ea6aff9ca5b7b39ea2bbd1d6d9535f89d6c3c30ca00bcc4ec4750e96dbd80af14cc35edac0e67b7a81dc32d0284297be631d124c6a860882f

memory/768-204-0x000007FEF4880000-0x000007FEF521D000-memory.dmp

memory/768-206-0x000007FEF4880000-0x000007FEF521D000-memory.dmp

memory/2140-208-0x0000000100000000-0x00000001001F1000-memory.dmp

memory/768-209-0x0000000000B90000-0x0000000000C10000-memory.dmp

memory/2140-211-0x0000000000500000-0x00000000006F1000-memory.dmp

memory/2140-216-0x0000000000B30000-0x0000000000B90000-memory.dmp

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 ecb2e9629c9341e231558500eb5e6351
SHA1 e82f010c203b8e9b865f1cfcb355cd801f971dc6
SHA256 efb88ed42258600a3449bd93d5db2e4a199181b35e2c103dd6338dc430aba19f
SHA512 858965deef02a694e2ca9dd31dcaf92de8d69b2e285117e78fb1e84a8d8ae326042a65d176b0ec7bb9a7c88166b45e0198defdea1bc11eb909a3f15ffc4d74e9

memory/2176-223-0x000000002E000000-0x000000002FE1E000-memory.dmp

memory/2668-226-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/2668-229-0x0000000000230000-0x0000000000297000-memory.dmp

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

MD5 ce3eb89543d3a3a5a889b628178a1ea6
SHA1 355f7cc698035499e8927b0a6d79b57e5d2449c8
SHA256 eb1bf9089ac8d12317ba359c631398c19a2c68080ef783ba0644bf49fb70573f
SHA512 a8ca66b6aab76c8fe8c2db154dcb5b70b76b5a58117db7ea998aef2d2227ee8ddd14fa2cfb1be3bbd47499fd54b003624406ade6ae3ef1ac29cbb2cc91c6240b

memory/768-233-0x0000000000B90000-0x0000000000C10000-memory.dmp

memory/2440-235-0x0000000100000000-0x0000000100542000-memory.dmp

memory/2440-241-0x0000000000390000-0x00000000003F0000-memory.dmp

memory/2440-244-0x0000000100000000-0x0000000100542000-memory.dmp

memory/1424-245-0x0000000140000000-0x00000001401F5000-memory.dmp

memory/2440-246-0x0000000074288000-0x000000007429D000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 83a04c43047120ab9173c2b8b5f92c48
SHA1 3ee9d584249e14d58b777ce9bfc601e2189762c2
SHA256 01098c770700fb462815a07d61644acef7f7dcc00b06c23692145bf93bbaf749
SHA512 b9e3d457eaed5c5cb1fb9bd570161a6568782da43ab64b57c256a3aec3610777b4d0c7b02dd0d43ee9b474784750171231781136efe213f4f0074069aa98fe8b

memory/2876-250-0x0000000001000000-0x00000000011D5000-memory.dmp

memory/2876-258-0x0000000000390000-0x00000000003F7000-memory.dmp

memory/2140-256-0x0000000100000000-0x00000001001F1000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 7f06f45e5baae7100d3ce0448e6d9918
SHA1 a6774007a04cadcab60ce10e614d451057ca2799
SHA256 f9f26a09af0592b18a98bd0fbdde6d312dd1872cc2087ab6e1a023dca793e597
SHA512 565eee54151925b79f1e6cb2edf792650804eac173bfcdfda7816edcada227aa33f8ca10bd2e375b9e17d3900574ff37c8830c0d0fc3ef011dcd85a1040973b7

memory/2140-262-0x0000000000500000-0x00000000006F1000-memory.dmp

memory/844-264-0x0000000100000000-0x00000001001D4000-memory.dmp

memory/844-271-0x0000000000290000-0x00000000002F0000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 4644e96766c5f78d240dea141661f08f
SHA1 8e96ddf784e3e32e89e0717d4e6e75d9105134c6
SHA256 76633429fd1198eecf8b868394720d713d0ae915a0d7f338194dfa16eb8cd4aa
SHA512 070f71e812607faee69617943561b8759e13949f9957f887afe48e3650f92ef4f2b4a2e13a980282507b9bd1b6269041fe41c60b7cf68d435bdee18768b681e9

memory/2668-276-0x000000002E000000-0x000000002E1F4000-memory.dmp

memory/2732-279-0x0000000100000000-0x00000001001D5000-memory.dmp

memory/2732-284-0x0000000000150000-0x00000000001B0000-memory.dmp

memory/768-288-0x0000000000B90000-0x0000000000C10000-memory.dmp

C:\Windows\System32\vds.exe

MD5 db80d06cf8d9c82e23eaa1ea3f190cd4
SHA1 74131f5a77907796dd18c4988b6e5bb110194a0b
SHA256 bad966ce507b7f58aee9145e819bc83bc22becff277be3eebac9e91fff4da007
SHA512 9ab83fd8048a14fbd85a5aa8f24888cf0e97c76e7c54aa3f560d6b6e7e1e0f34ca81e14a7ce798ab24dfee3d48ac8b5dc965d67ce10cac12e579b1ff4dead718

memory/2440-287-0x0000000100000000-0x0000000100542000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

C:\Windows\System32\VSSVC.exe

MD5 17e964916b410a68ad7e336ea2e5b1e1
SHA1 de7a4372a17683d9e445993a4a165e428e2761ed
SHA256 d2fe4aafd5febbcd2482ed206e5e1b7c9e8b6923f18ece47681d7a5846d7d387
SHA512 edd9ec1828038970a95e94aa39b9ae98ddfa773cc64c914053b51204eba9981a702af975e7d95e45b57d55ff98f0fd09ce0e7fd3b76281bd07e9df0507b50a0f

C:\Windows\System32\wbengine.exe

MD5 2878cb65d4c3929c80ea9b3dc3a2b566
SHA1 9aaa9e642890b99b047d9281c2d108d9efbc8c1b
SHA256 9bd97eaf53be40f073af47f7af51311e3b5b16473ebcb5801a8ec34bec69b7b2
SHA512 11c3b7d57b78e4564d9a44f05901ef1d53ea625f8433564f24b551f2e068f860d218d50d53855e017095823c7bba83bb3d9896bb6d2f1c407ccf714ec0a1bf89

\Windows\System32\wbem\WmiApSrv.exe

MD5 8dc4df4828a38676825262552e7f6a55
SHA1 9056250ad04431ab2fe8420151c29806e12729cd
SHA256 3e41945b6e6ab26628bafcc44690af32a9042114b798250568f43a9b74466cb5
SHA512 6954106436798d03e5fd0d239ad87deec77728476089d638a9748312c918effc5fabec9f2863c549e51cd16b0bc1cc9bc40877226cc860a9267a67ce12cb6f58

\Program Files\Windows Media Player\wmpnetwk.exe

MD5 1fecb0a1cfbff78fc286e70c042bcc69
SHA1 abb91f7b44f26e57c7c27e7fb016ee53b2c6156b
SHA256 c80be808b03557a623b063a1c9bcbded26607144ab1af98e7aa0e5226f0b856e
SHA512 775275e69b6b5ad80ef902a90e3d397b13d0131144f12046327948c9b8801ace4e6ab5d543c0efad34456cfa02986cae3257d331e8e8bcfc24e54ae13d2f2cfc

C:\Windows\System32\SearchIndexer.exe

MD5 ce2f0544e51a81a91dd388829e02f970
SHA1 984664ec865c1c68675f8857f0d6d72d700de2cd
SHA256 9d87de6d06dd047d2558fcbb69f3983cb11fc824df091e7a69370dbf9fb024ae
SHA512 6f9f07fdbe778130c753eb3f3ee8c6c82fff574682f2271827d04530179d9aa94c39bf42ab1b709f9acf7726c9ff128593d4d5fdd82fa13da7cd11c0a482cdcd

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

MD5 86f9ea1f543ed9ad5c957988a75bfca9
SHA1 cf70699e5d2d14385b9e194ed8e4d97ae9fae718
SHA256 fc48be2f19f2a58f4628ceed62e509aa14a84cfef15a9f3170e85202c9f96001
SHA512 24066285e1fa84bf59b0a4a6757660c102451a525edf057c28415f43f7abec2fde2b30346a661e19fdc4f83468c85ee43db80a196b2ed452b58e259f53984b94

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

MD5 8c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1 b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512 825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

MD5 4f40997b51420653706cb0958086cd2d
SHA1 0069b956d17ce7d782a0e054995317f2f621b502
SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512 e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

MD5 062dd1948e3a0768f936b04a40102e41
SHA1 2e0ab9904b76b8759eadbf66ad5030930cc231a5
SHA256 38737330ce592e9049d61eec3b95486a9bf20a3c2a636744ebc599ee6573d7c2
SHA512 1b039cf4b9c5f25c002825294d9832c28121b8864732a781922de8976bf109b142d0ea9f3fe81adb8793deacebd10672d42287063d5863e85cb2ab7422aeb446

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

MD5 71d4273e5b77cf01239a5d4f29e064fc
SHA1 e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA512 41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

MD5 3c269caf88ccaf71660d8dc6c56f4873
SHA1 f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512 bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

MD5 ac901cf97363425059a50d1398e3454b
SHA1 2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA512 6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:39

Reported

2024-04-07 23:42

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\653456e28ed1090.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76312\javaws.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cde7de84489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7b8fde94489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe2527e94489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024b776e84489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012e4a7e94489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d12c3eb4489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a28829e94489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5c989e84489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058fa7ce94489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b8f8ee84489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f20d71e94489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fcb6ae84489da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe

"C:\Users\Admin\AppData\Local\Temp\97eeb568cd8ea3a12e47f88f677e033e06574ca68e60c0da3cb3b644aa7e6fe4.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
ID 34.128.82.12:80 ssbzmoy.biz tcp
ID 34.128.82.12:80 ssbzmoy.biz tcp
US 8.8.8.8:53 12.82.128.34.in-addr.arpa udp
US 8.8.8.8:53 cvgrf.biz udp
US 104.198.2.251:80 cvgrf.biz tcp
US 104.198.2.251:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 34.174.61.199:80 npukfztj.biz tcp
US 34.174.61.199:80 npukfztj.biz tcp
US 8.8.8.8:53 251.2.198.104.in-addr.arpa udp
US 8.8.8.8:53 199.61.174.34.in-addr.arpa udp
US 8.8.8.8:53 przvgke.biz udp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 72.52.178.23:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
ID 34.128.82.12:80 knjghuig.biz tcp
ID 34.128.82.12:80 knjghuig.biz tcp
US 8.8.8.8:53 23.178.52.72.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
US 34.29.71.138:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 34.143.166.163:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 138.71.29.34.in-addr.arpa udp
US 8.8.8.8:53 163.166.143.34.in-addr.arpa udp
US 8.8.8.8:53 saytjshyf.biz udp
US 34.67.9.172:80 saytjshyf.biz tcp
US 8.8.8.8:53 vcddkls.biz udp
ID 34.128.82.12:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 8.8.8.8:53 172.9.67.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 34.174.78.212:80 deoci.biz tcp
US 8.8.8.8:53 6.218.225.67.in-addr.arpa udp
US 8.8.8.8:53 224.32.91.34.in-addr.arpa udp
US 67.225.218.6:80 fwiwk.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
NL 34.91.32.224:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 8.8.8.8:53 qaynky.biz udp
US 34.174.78.212:80 deoci.biz tcp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 212.78.174.34.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 34.143.166.163:80 qaynky.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 34.174.61.199:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 34.41.229.245:80 dwrqljrr.biz tcp
US 8.8.8.8:53 245.229.41.34.in-addr.arpa udp
US 8.8.8.8:53 nqwjmb.biz udp
US 8.8.8.8:53 ytctnunms.biz udp
US 34.174.206.7:80 ytctnunms.biz tcp
US 34.174.206.7:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 34.41.229.245:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 7.206.174.34.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 jpskm.biz udp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 34.41.229.245:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
ID 34.128.82.12:80 wllvnzb.biz tcp
ID 34.128.82.12:80 wllvnzb.biz tcp
US 8.8.8.8:53 gnqgo.biz udp
US 34.174.78.212:80 gnqgo.biz tcp
US 34.174.78.212:80 gnqgo.biz tcp
US 8.8.8.8:53 jhvzpcfg.biz udp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 34.67.9.172:80 jhvzpcfg.biz tcp
US 8.8.8.8:53 acwjcqqv.biz udp
ID 34.128.82.12:80 acwjcqqv.biz tcp
ID 34.128.82.12:80 acwjcqqv.biz tcp
US 8.8.8.8:53 lejtdj.biz udp
US 8.8.8.8:53 vyome.biz udp
US 8.8.8.8:53 yauexmxk.biz udp
US 34.174.78.212:80 yauexmxk.biz tcp
US 34.174.78.212:80 yauexmxk.biz tcp
US 8.8.8.8:53 iuzpxe.biz udp
SG 34.143.166.163:80 iuzpxe.biz tcp
SG 34.143.166.163:80 iuzpxe.biz tcp
US 8.8.8.8:53 sxmiywsfv.biz udp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
SG 34.143.166.163:80 sxmiywsfv.biz tcp
US 8.8.8.8:53 vrrazpdh.biz udp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 34.168.225.46:80 vrrazpdh.biz tcp
US 8.8.8.8:53 ftxlah.biz udp
US 34.94.160.21:80 ftxlah.biz tcp
US 34.94.160.21:80 ftxlah.biz tcp
US 8.8.8.8:53 typgfhb.biz udp
SG 34.143.166.163:80 typgfhb.biz tcp
SG 34.143.166.163:80 typgfhb.biz tcp
US 8.8.8.8:53 46.225.168.34.in-addr.arpa udp
US 8.8.8.8:53 esuzf.biz udp
US 34.168.225.46:80 esuzf.biz tcp
US 34.168.225.46:80 esuzf.biz tcp
US 8.8.8.8:53 21.160.94.34.in-addr.arpa udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 8.8.8.8:53 gvijgjwkh.biz udp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 34.174.206.7:80 gvijgjwkh.biz tcp
US 8.8.8.8:53 qpnczch.biz udp
US 8.8.8.8:53 qpnczch.biz udp
US 34.162.170.92:80 qpnczch.biz tcp
US 34.162.170.92:80 qpnczch.biz tcp
US 8.8.8.8:53 brsua.biz udp
US 8.8.8.8:53 brsua.biz udp
NL 35.204.181.10:80 brsua.biz tcp
NL 35.204.181.10:80 brsua.biz tcp
US 8.8.8.8:53 92.170.162.34.in-addr.arpa udp
US 8.8.8.8:53 dlynankz.biz udp
DE 85.214.228.140:80 dlynankz.biz tcp
DE 85.214.228.140:80 dlynankz.biz tcp
US 8.8.8.8:53 oflybfv.biz udp
US 34.29.71.138:80 oflybfv.biz tcp
US 34.29.71.138:80 oflybfv.biz tcp
US 8.8.8.8:53 yhqqc.biz udp
US 34.168.225.46:80 yhqqc.biz tcp
US 34.168.225.46:80 yhqqc.biz tcp
US 8.8.8.8:53 10.181.204.35.in-addr.arpa udp
US 8.8.8.8:53 140.228.214.85.in-addr.arpa udp
US 8.8.8.8:53 mnjmhp.biz udp
US 34.29.71.138:80 mnjmhp.biz tcp
US 34.29.71.138:80 mnjmhp.biz tcp
US 8.8.8.8:53 opowhhece.biz udp
US 34.29.71.138:80 opowhhece.biz tcp
US 34.29.71.138:80 opowhhece.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
US 8.8.8.8:53 zjbpaao.biz udp
US 8.8.8.8:53 jdhhbs.biz udp
US 8.8.8.8:53 mgmsclkyu.biz udp
SG 34.143.166.163:80 jdhhbs.biz tcp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 mgmsclkyu.biz udp
NL 34.91.32.224:80 mgmsclkyu.biz tcp
US 8.8.8.8:53 warkcdu.biz udp
ID 34.128.82.12:80 warkcdu.biz tcp
US 8.8.8.8:53 gcedd.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 8.8.8.8:53 gcedd.biz udp
US 8.8.8.8:53 jwkoeoqns.biz udp
SG 34.143.166.163:80 gcedd.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 8.8.8.8:53 jwkoeoqns.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 34.41.229.245:80 jwkoeoqns.biz tcp
US 8.8.8.8:53 rynmcq.biz udp
US 8.8.8.8:53 xccjj.biz udp
US 34.162.170.92:80 xccjj.biz tcp
US 8.8.8.8:53 hehckyov.biz udp
US 34.174.61.199:80 hehckyov.biz tcp
US 8.8.8.8:53 uaafd.biz udp
NL 35.204.181.10:80 uaafd.biz tcp
NL 35.204.181.10:80 uaafd.biz tcp
US 8.8.8.8:53 eufxebus.biz udp
ID 34.128.82.12:80 eufxebus.biz tcp
ID 34.128.82.12:80 eufxebus.biz tcp
US 8.8.8.8:53 pwlqfu.biz udp
NL 34.91.32.224:80 pwlqfu.biz tcp
NL 34.91.32.224:80 pwlqfu.biz tcp
US 8.8.8.8:53 rrqafepng.biz udp
US 34.29.71.138:80 rrqafepng.biz tcp
US 34.29.71.138:80 rrqafepng.biz tcp
US 8.8.8.8:53 ctdtgwag.biz udp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 34.174.206.7:80 ctdtgwag.biz tcp
US 8.8.8.8:53 tnevuluw.biz udp
US 34.94.245.237:80 tnevuluw.biz tcp
US 34.94.245.237:80 tnevuluw.biz tcp
US 8.8.8.8:53 whjovd.biz udp
ID 34.128.82.12:80 whjovd.biz tcp
ID 34.128.82.12:80 whjovd.biz tcp
US 8.8.8.8:53 237.245.94.34.in-addr.arpa udp
US 8.8.8.8:53 gjogvvpsf.biz udp
US 8.8.8.8:53 reczwga.biz udp
US 34.67.9.172:80 reczwga.biz tcp
US 34.67.9.172:80 reczwga.biz tcp
US 8.8.8.8:53 bghjpy.biz udp
US 34.168.225.46:80 bghjpy.biz tcp
US 34.168.225.46:80 bghjpy.biz tcp
US 8.8.8.8:53 damcprvgv.biz udp
US 8.8.8.8:53 ocsvqjg.biz udp
NL 35.204.181.10:80 ocsvqjg.biz tcp
NL 35.204.181.10:80 ocsvqjg.biz tcp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 ywffr.biz udp
US 8.8.8.8:53 ecxbwt.biz udp
US 104.198.2.251:80 ecxbwt.biz tcp
US 104.198.2.251:80 ecxbwt.biz tcp
US 8.8.8.8:53 udp
US 34.162.170.92:80 tcp
US 34.162.170.92:80 tcp
US 8.8.8.8:53 udp

Files

memory/1452-0-0x0000000000400000-0x00000000005DD000-memory.dmp

memory/1452-1-0x0000000002350000-0x00000000023B7000-memory.dmp

memory/1452-6-0x0000000002350000-0x00000000023B7000-memory.dmp

memory/1452-7-0x0000000002350000-0x00000000023B7000-memory.dmp

C:\Windows\System32\alg.exe

MD5 9b5da50f65a108f11807553549e468bb
SHA1 b9928a1f03b6c81c3dc247d036ead4b88b3494de
SHA256 5b04aca8c35f2262845afe384cf93b01fb41cc9975a629d564fff84c31d3a1f7
SHA512 a3d1a8ff1e0eff90c2d54425afe3944a7e284342de7aedbc1761c458cf7a06ce0dcb2865a46e64295b11754e4e918aee2fa5472a3c9372861c2b77790fa22a56

memory/1256-13-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/1256-12-0x0000000000700000-0x0000000000760000-memory.dmp

memory/1256-19-0x0000000000700000-0x0000000000760000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 d981a2bcbc428331c723ffa13af9a138
SHA1 a2ed5900f3d9932f95d382bbc82621af0a1e1156
SHA256 7c5865e49e9e89f64ec42595185b1dc6560fd916a30b424386b11ea9b0cc85eb
SHA512 5d517c8ffc3be41e215ecda88eb6c84fbcd674ddc56739db3c9aa3f82a5f587da6abf5fcfcd6a4e2c6b719e3030d175f4de919cc3c6e0d2592698bdf066a0538

memory/1912-26-0x00000000006A0000-0x0000000000700000-memory.dmp

memory/1912-25-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/1912-32-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 41b798ded1dd310be7836cac729f960d
SHA1 11cb422068d7cd67ac62489d99322a58520b2630
SHA256 ebc4ce03d7c62091cfa43b5da6f0793d99c1e68bd335e68c43222ea493edd180
SHA512 30e27ce8125c4189563cc8c193120c451d8018478cf819631ae8ac139b0f445e90b0d17b97326e05b53520b4157f8aa34663180fd42d14a3aab3d0478b6e308a

memory/3708-36-0x0000000140000000-0x0000000140135000-memory.dmp

memory/3708-37-0x0000000000930000-0x0000000000990000-memory.dmp

memory/3708-44-0x0000000000930000-0x0000000000990000-memory.dmp

memory/3708-48-0x0000000000930000-0x0000000000990000-memory.dmp

memory/4888-50-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 e8faec8523126a92a910108ea0daa990
SHA1 53ad0f3c2be573ee5bafb42e770cd22966a155ef
SHA256 6b0089f13a9775d2e4c95ad9010e33ae38df6ec2a9c2b484e4c837722ec43bdc
SHA512 f31c2799c210f1a3e261b6c609a1c8b8c136df4238f22d1fe554818d32adc054fd38095a7c63e09f6478dc260fed63b1509961c6fb1a24689312562086940d03

memory/3708-52-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4888-51-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4888-58-0x0000000000C40000-0x0000000000CA0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 d012f7c9872a127a29d08711ab137f85
SHA1 572ff173cf1ed821a950778ca3d931a4a7f499b5
SHA256 6d3e9838061e740101a3dc12ecdc005965653a210fde5df5e394a7dc88277740
SHA512 9d948bf29853613ecc40e374a73aafc497f45ba2cdbf32d8141bfada1e051d29ea8f92bd4b4f699309ea9eb45fd21609500ff84b7d80e8ae0973777493a68aaf

memory/1452-63-0x0000000000400000-0x00000000005DD000-memory.dmp

memory/3092-62-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/3092-65-0x0000000140000000-0x000000014022B000-memory.dmp

memory/3092-70-0x00000000001A0000-0x0000000000200000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 d52e60d7d4be370c994d9c0d36e9ea90
SHA1 258dfd2a941299c2812c41e713fd4794638d056c
SHA256 128f9af6a316d9326dff940a9e8f2bacfe89bb564c1a016367e9dfa60e87792b
SHA512 773e002dbb2fd05a2b8465bb59d37318c00e3f5faf9002eda328124df13ab3964c265b302eed1d870061baf6b21e5f3837c344978cc2b45706c426291b8f6740

memory/3000-75-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/1256-74-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/3000-77-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3000-82-0x0000000000D10000-0x0000000000D70000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 9f43cc419f6c7c119e1834dd14566f59
SHA1 b3ac0adeeab954cc88b4c8b6df195883ca85cfff
SHA256 407c08beea8def4f847f5150729e0143811ee18ea9969e4cac57fd18fbbd7550
SHA512 1dea94d1c0f9f2271ed424ebaa8dfcca0578e91e7177f3d46948aef38692b6c18ce2a9425562cf1b72d06f0aa27a0d47141de76f2dcc2027c6f6ba43980c82d4

memory/3112-89-0x0000000000720000-0x0000000000780000-memory.dmp

memory/3112-94-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/1912-91-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/3000-93-0x0000000140000000-0x0000000140209000-memory.dmp

memory/3000-85-0x0000000000D10000-0x0000000000D70000-memory.dmp

memory/3112-100-0x0000000000720000-0x0000000000780000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 ad698fe37693e515c0ebb2e00597aa75
SHA1 953f3fc30e777ec07b23c358eeacb5d2b4881629
SHA256 9fa790776dbf1e6a6c5a90a05b601f8219252a61131f177b2dcfda37fba5b375
SHA512 e594c8f58e337b10302bed5c181db45e7f31698454ea909215500c76d57c5dac8b2780934f66ee24ba7d7a13facc2d41401d195062668b5178a02e9234080409

memory/4504-107-0x0000000140000000-0x000000014020E000-memory.dmp

memory/4504-116-0x00000000007B0000-0x0000000000810000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 d7ef4f29199e11e3d838909c248c6f70
SHA1 78f1bb731fd6be072c3682c34acd0b5ebfe8dd7f
SHA256 d0674312ed974cf23a43aa5be85f1f7ab40c05275cfd2d17fd5c28d6ec6a5b55
SHA512 d4123dd2c845d3cc76154a3182d53310dd0b99094bd5a718b69660a0278892ca1ec8850ec5448efd29bc8681328688bcac9dbcdcc1c338957348f677ac4a7fd8

memory/4888-120-0x0000000140000000-0x0000000140237000-memory.dmp

memory/4120-122-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/4120-129-0x0000000000BB0000-0x0000000000C10000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 65ffe3d6e9b119af11bd6cce103edf3a
SHA1 9c183ef0f4ba5e95639c94abc4dde0a1c4f851c8
SHA256 54eaafb6c27424d8d86ffb331b2848e1e8b6ae93348f1b7f4e8e56346b50053d
SHA512 09375a9c87b8da0756be0da56ee69611e3c418629c9a97de0e6309a37a55db7e35b1bb5c6d7ff3c0d1d2da0f0521d124ed7758ec23d07594aacffcd8b2125175

memory/3092-132-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1968-134-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 0865603de8569e49390d6678f7eba04f
SHA1 174c97297b0792d6cf63bc26676cb734c87b5386
SHA256 fabfefe1de9d3c4ae381b0bd3858e968c2d94a7b85196416e4292c6bdaa319a7
SHA512 4d2b33acca62de3ddfcb0e8ba0708440c6b8a0eec3f401f35eb8fe241050fa331ef9960614fa1978cf187d47d7caf98d40856056d8f76aef7dacb468a1003219

memory/1936-136-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/1936-145-0x0000000000530000-0x0000000000590000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 59d0222f027792878e16f8e22a727b90
SHA1 29a0ba7dc8b8fd85eca31109b4336265ab662069
SHA256 9d6606a240cd732febdb906f4a22ed4a8aecbb48b321052a35e2e4e63443d38b
SHA512 6506a8680d31188afa32693cfe3d55e962fb3d9b9a8d51ce0ca352c314a1d8976b81beea34093e305084dec88d86b70968068e465d834649351ac988c916ea7f

memory/3060-149-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3060-158-0x0000000000720000-0x0000000000780000-memory.dmp

memory/3112-157-0x0000000140000000-0x00000001401F8000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 76aec7b89cde6c37dc55d32c3eb4d91d
SHA1 610f6e44000d0b49602f00ff563f96e487c4c3b8
SHA256 a3ed7d2a21f62aac02dd88527fba87e091a8c4b7fb4992eaabedd0bc73174792
SHA512 971dec8f44a94435f2c6eade96ffb63c0a3c893bfb07371701668e158008744597d8b218deade7f64bb6083f0ff09381bebaa426f0db3c4d9ad8226f697c27c3

memory/2812-163-0x0000000140000000-0x00000001401D5000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 a1fafebebed940b404a88c9af7e280d1
SHA1 4e0142193b0f33e182c1117ff4ff81c85f63e3b5
SHA256 d2c524fbab8a74bb283a07da7319dc80b592e9faeb4365d0ba2f8d680b05ee5d
SHA512 b777c1516acce541d5723b2f880b411691bc33c38e459bfe6870914878b76a2d1fc86e3bd64a862a25918caf0785965f33c5465eb183b3a6fe5fa3924fb597b0

memory/2812-173-0x00000000006F0000-0x0000000000750000-memory.dmp

memory/3524-176-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4504-171-0x0000000140000000-0x000000014020E000-memory.dmp

memory/3524-185-0x0000000000560000-0x00000000005C0000-memory.dmp

memory/4120-184-0x0000000140000000-0x00000001401EA000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 f12659a9cba9a6a021daaf2fd1e53e95
SHA1 23f5a990f3c3994637303ac8789a36a46b7d502d
SHA256 c1e77953464423b8e0537793532e57833a624a9749240d311fa82fa17cf48aea
SHA512 ab52e78487c9ceab8e6072daf1f595735d420fd2713038e41bb0dfba4ab6053b541dec7a213f3758da1f3a55d4380e112fb9f1c54ad44578ba738f9a07d204e9

memory/4400-190-0x0000000140000000-0x0000000140241000-memory.dmp

memory/4400-198-0x0000000000440000-0x00000000004A0000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 068ba94684458d8afcd2587d329381ca
SHA1 497e7a9128b180d3d384800e9cde7eb1a830e195
SHA256 c74fb64f70188d962136b56ac0b60354c714811e545fae1d2a389d51a43cf0a4
SHA512 b910e9adc6a30727581fc9933a6d397077ee79433c9a2c4465765c04f1e3b080ff357efbb5e2445c29596a094c10f4aa5f9eac8656a8fbf589f33d6d142b687c

memory/3804-203-0x0000000140000000-0x0000000140221000-memory.dmp

memory/1936-201-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/3804-211-0x00000000008D0000-0x0000000000930000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 3c426488f3500118da53cbb49534f169
SHA1 21385333634a6e4d4149d2909d63ad2683d80328
SHA256 c99c20396603232c990d19d5bfaaa733de59588d534204f2d7687842eaf8464c
SHA512 20f27d7a2c66da39a60d86a1a9cbe2b56748f4e6b8cee67555938fa5cf4133fb22fa235ef560ac6e0b8a69f7f37a2c45985242842f63ca3d661c2c0d79f3abce

memory/3060-215-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/456-218-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2812-230-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/4340-232-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\vds.exe

MD5 f4c7b7c372ff7f29ff03ddb863aec6e5
SHA1 99b62b8f3049649f82aa014dd03d0f96faa7af27
SHA256 fb3286c8623fbdef84afe76f3878269dd71cd68c160687cf37f378e55132c8bf
SHA512 a7abd1455294e390bce41680d480a498b897796f7de2931465f96dd3a2c0907e4f1040c8b880116e1e08543c0d6c3346879096cb13f505a35827abccfdb59d4e

memory/4340-239-0x0000000000BD0000-0x0000000000C30000-memory.dmp

memory/456-226-0x0000000000750000-0x00000000007B0000-memory.dmp

memory/456-228-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 6497165637e1190cb5bc6282f96b6fd6
SHA1 0b11334a18b5af00a7db186e03ec399ca25d566b
SHA256 cab0863cf3a577de61c3d63f11df1a10c6422cc935f7cb9789785ac569a5aa38
SHA512 3ea7d254c484b18ac42b750294b24add7b591a4d03ec4599f78d78b83e1b6f0d4ef756bcceb0d81f4610fcff6bd0cd6b404155f6d9a8cbd45343cc79395f399d

memory/3524-243-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1472-244-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 2ed9504ef75777b5538102e59a5e3575
SHA1 7d1444c7597884e6baf874b079a9a8f68e57df4f
SHA256 5eb899baf9354a3c862dd3874e21fb1913cb69586cd453703a4758dfa7e7586f
SHA512 24de2f181c18f8267e0ddaae0f864e2cfeece0a207e758af874a75e4a9e2055427847b1483fdd849a02b3073d63e63098487c2d06799a5802d151ef969f61fb8

memory/4400-256-0x0000000140000000-0x0000000140241000-memory.dmp

memory/1472-253-0x0000000000690000-0x00000000006F0000-memory.dmp

memory/4896-259-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4896-265-0x0000000000C10000-0x0000000000C70000-memory.dmp

memory/3804-269-0x0000000140000000-0x0000000140221000-memory.dmp

memory/3008-271-0x0000000140000000-0x0000000140205000-memory.dmp

memory/3008-279-0x00000000006A0000-0x0000000000700000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 f12944841ea0456729eef76fdeb0a0f9
SHA1 6fc58c13532243085f2eb572eaa59f1dd873a392
SHA256 864540418dae2dff14f482186917dfdb1e64ee0126042082b6369e92f0264987
SHA512 e8b28483b1ad2a3d03f2b09c618875beb5bab2ee751d58b6d9f357cc6a7f048dea4b7bbe435a5e2d559d16e77bdc3ee6338f6d269fc46592982d44d626e5eb90

C:\Windows\System32\SearchIndexer.exe

MD5 ae8cd713fc910952a4286c239521981c
SHA1 baee9cc6d7b01dd01c0a3529640414faba2b94d2
SHA256 1b02d6e346c61dd39842b3c43e3fce3f3c5a4ace961db0dc2f0de421f0e03fef
SHA512 f1a049fa98dbb2fd68a674b2959df16957cce69c4dd27865bacf2051740a2866fee27cc9feb392a780e22b2ad20b838c6b7378db4608da826b9a71a4af48023e

memory/3968-284-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3968-292-0x0000000000810000-0x0000000000870000-memory.dmp

memory/4340-432-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2260-436-0x0000019F796C0000-0x0000019F796D0000-memory.dmp

memory/2260-434-0x0000019F796B0000-0x0000019F796C0000-memory.dmp

memory/2260-443-0x0000019F796B0000-0x0000019F796C0000-memory.dmp

memory/2260-450-0x0000019F796B0000-0x0000019F796C0000-memory.dmp

memory/1472-448-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/2260-460-0x0000019F796B0000-0x0000019F796C0000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 d922a211c2cdf4c1f5d04679d7fb83ed
SHA1 74a87ecb01d9ad38106e90694cc90355d5f04694
SHA256 091461e22c5a0e9e4692f98febd7f7b299b2b80dd94a1d8a553c2de3f58a6f85
SHA512 51020a55e61b2e4c2a4475924e2b7a9ae4ce100fc5000c6213e8b0c1b892055616edb78c88de8a28dbe1a5b7354ffcb04fb4074de9db41fc7d04805a5605104e

C:\Windows\system32\msiexec.exe

MD5 073d30caa7f68056e2b9bf2e8ab739a0
SHA1 653d9882966cb3a17b83e0c9aea8d44c1a904ec7
SHA256 f70b183fdfd520ed2bb87d88df79976c4e99d8125c4984a627e1ceb482e56924
SHA512 82c926831ff78eb36cbef42ed79365eb16e7b8d01cea915aeecdf85baf3f8e24c1a7847efd12cbbd029712e01d92385a7e75e7a0ff78c5fb1f865a7389a60f49

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 c145a5ab44a5aa6ccaa48102ec9b3267
SHA1 b264b4b05d2760697c960c89e5b1ed9b6a1a6903
SHA256 26178ad4da35f58c1d13528a06f5964083a5003645724c2526ed3455ea9171ae
SHA512 fb5b3935372dff90560884ede7f017a6e16f688f3a06a18aa75b063fe5a17e045c8508fa0e8aedea9214f9a8487ff6e918f11e7bc228215f321215901ba7e6cb

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

MD5 ecf53bf66dd7233c42dfa1dc4857986a
SHA1 981fd0bdde60170ef3d2a2c28b31f2c32160bcaa
SHA256 ff1f1e1879f2065de3aac32efafea5a7d485473bc56f9718f1caa4e71003349f
SHA512 4ff9a395382818df373370f39abd1a5b2d08444db2094c60e957abb5265d77aec3c394c81f191a744d086fa179b0ea44b4206183cc0fc42ecd0d879b781d5c0a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 4fd54544666a37131309dfb56736d5f1
SHA1 97783373424eb15b5216d18fb34decfd7ff8e462
SHA256 3a1cf6555f373edc3dfc13fb21540903aed37172c6b23c0a0c3c57fa1cb5a2e0
SHA512 e98582f7225af81280552dbbdf49133f11b6891073b4d5d455b1807c73f54c6672a7b3114f52c98bdeadfb4284a1483fa2dfdc617406533501f1250b46f71e01

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 eb0ea1dbf1f9986e0af6c1895ec010c8
SHA1 c19ed9adc1be141161fc8fd13225617080be4524
SHA256 343ac3b9ca1c5d5c1b0653c400e2a0c75a00c5302275e39f688317f0893d3968
SHA512 9269d58ecf9459f4af5556bbb29b49c6c39d239bf3741f6c6bce4fd0109c0299c8476023ba53d87f048eac1bf664abf49291ba899603892aa191fbf938c287d3

C:\Program Files\dotnet\dotnet.exe

MD5 bea620492c5642c09f0cdc204567fe88
SHA1 901e2f6e16ed00086eab9f75b45456341abaf486
SHA256 57b1a69d88381e3555324b9949049324df19d396255adb2e4d32d6c0679b9958
SHA512 d1f69a2f5a12636b8cefd8ee8004eac321bf27d6e74ac809d262cedcb3d8e630752f9d67c7c2db5160f619477110aaa0d4b8f1bf45e0c710dae9c4643ac511bc

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 8074385a443eef49db3df43049b936d2
SHA1 00a19810aae9d2a3ada1fbeeffbb28540283d278
SHA256 adc8a8d849bf0e2054626222986bae628581be4abc30b3b8a6b2ec7e9b6cde80
SHA512 5977f20cb599c95fbfbaa45060d18a9e77babe0fc639b57d02254c2e9eeb6bff83320fd1ce73689cc8bd8d2057546e4ad4d775e98ddc422a17bff65d6fe8aebb

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 0cd93e76d8d8853124f948808b07250c
SHA1 1228f827999a6beddcdc7b49b4e066fb1e731a3a
SHA256 679d075184d99ba8ab710a77f71e131b89c58a0ed7259fa1ea7d2e6d2e4d8412
SHA512 830ebd65bbbacce506d0d44865155432d7b8e709498cfef8a2d43c56edc3b59e757377c037100fca11fcca671dfcf4fef913b221a6a2bbe161fceb1fd497a234

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 a3c56028ddd1ad6e60da78ae56cbc9c5
SHA1 e76e025eab0a5743cfa49e4a6db26ee4768b7889
SHA256 f356c2bcc78adbd9d21f6eea4328f336b507d8484fd92611e7e6cf39e790145d
SHA512 fad1d5f7e93c3920b4c5193b564222ab02dc53fd9a86d39c24a185cc63b79c234402fc9328c4365268b1e60af149498aec878cb3e17be44eb9db8d5b9a43e24e

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 7e6982b0b7c2c1b6a244c93aee1b9892
SHA1 99fc2c25218c687035844cd83b653d07916bc7c0
SHA256 d81bba3144a0ce1f8a032c0bb7e3b1faa069bfe75135a2ddd7cdc2802dfe04ca
SHA512 e7934e3ec8f3eba2e1e75068d83d144a7f0e73c8ab90c11fdbb0fabc3c67dc2c19d49482db21823703e965e19b8d5c1549348cb476b3ee631eefe86c92acfc65

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 32fb66b22e82c1c04a409ad3a3d2ff68
SHA1 7a895b4c6ed25ea42fe6bfe3b88fd3a1ee9925f4
SHA256 17cb3c2801de9b9479ae84aa49ac314634771bfd5af38d62fbc53c80492ea11c
SHA512 6d8dcfc2a50185f369578b857ddcbab5af4c2af03a83c4dfc16198d86501804a4a747fcb0d776eac1c7195826a0d8a089e0ec801fdf47682be7d3c4c2973e160

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 96251562c1fcc10649f792ecbc015197
SHA1 482c6d425ee87ea730e5310fe0d1dbb0ee180d06
SHA256 74ac4ead2746c175a6a9c2d4e68624e9900eb548b3d3dd9abf941ee5bea311f0
SHA512 198a0309007c1a42a68cfb9c7b4cdfa4bcd0d623132e03109b16aded5cc19860c1f917cc03d6040cb924c3bba0de42d6aa395a3529e2885554f995bfe9519965

C:\Program Files\7-Zip\Uninstall.exe

MD5 68512b2bac2c4409726c210f3b0a7499
SHA1 1e10ae10bb2b07665187ebe0a86f2655cfbcc675
SHA256 25df3d21962a9c84855ef26f5d3afabda20d1da36c8e00e5a5b5a701986308fa
SHA512 fb25e27158e53240f2fd0c216a781dac50a695555d76fb2ce59413ebd301181ee563c8bd4223adcd563df1cf21bfa3f70c44e6a6e7bf37bdb2b047e518e836bb

C:\Program Files\7-Zip\7zG.exe

MD5 8fc9ff5171863037f6a47c1065f1fcfb
SHA1 e3ff481defa986657df0fea89bbac74ba73fe2d5
SHA256 17a9c29708a963115d278849ff78604aac3114d870e7c3123603d3ca38d5e4b4
SHA512 4a2225f1e7fbbcecaa99353a2e18f3a2b532034b29225de0018d732d5c6fd572abdd8d28ac38b356292eb0de455c71fc4877c3e527002d6b593a990932eac87b

C:\Program Files\7-Zip\7zFM.exe

MD5 732e41e03b44260a9d8632edc662bf85
SHA1 263e857edf589deb60a6b681e0b2ff7fcef96b7f
SHA256 a36f8d14aad1a39d3e5b7e893303fc17371de9488ad98b09d1b9a63657634ff7
SHA512 be606fd9dc2b1627a095ab5c59fa226e8566f5e2ab557db5a5f6e85360aa13fff61d79bcf4b1945ad39d44f534f18c490cecb3e40dd7a74c8c4cba080dfa7a0d

C:\Program Files\7-Zip\7z.exe

MD5 f445e1163671670fe8fac3d5680832dd
SHA1 25dc714afce0fb573ddbba06bfd7f4cf30798dfa
SHA256 c36d543b82c9ba33399cf2cd266716a324e46d37648b09ffe905a7a51ac00096
SHA512 ca9e05e8d1174dd03d23f11aeff09a12dff8ac1f54fe43884df7a09eea9ec868382516f5172634b7f8c879b227c4e7faf58ff7788e816916b6e1d938621679ec

C:\odt\office2016setup.exe

MD5 49ae01e4ae34a00baafa28a9985a1520
SHA1 33d274ffd96f7764cf0ad4eccdcd20196bf3d56a
SHA256 0c6a8cdf8495d46fbce462ee1b8966142500c70293fd5e590131b7af875ba0b2
SHA512 7210b7eaf9fc2403af652dd2293f311329a5d219ff3f69c38ff8f3d90ca3897c8e7918ce5d2f3dbd7299484814b11d51834fd207c0fc04df7a02217dacb4dc55

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 b8b4f03375c689658a32724e0f0c6594
SHA1 31803d9db0f971c87ad10fc440e62638bce65e67
SHA256 017d9c93cac9ea77ef9c62f2c6743a9f4102667612a547eb1d41d4507b54ebec
SHA512 b4b65dd204818db393fcd6347575b2fc6f51a49e2e97627617ee07c3377003f1e7a6cc94037cdd066fa0ed00bae01681840422e5b1736aaaa5e1051501d79d17

C:\Windows\system32\SgrmBroker.exe

MD5 4fa71c1d64b309133c4bb288d98af26f
SHA1 25638521cd2872491f3df79aff1cdece18632d3d
SHA256 30bca0d63f7458dff57cd168aca00ec1828cbca713f4b013eb6b9270c95ee554
SHA512 344b58fa9ba239f4186a18bc8a3a064785b0fc7caeb1195fde51220cb4e03b7767c958aa517a33623af9d3232f478d5a89b62cafdb18be6a8137ec3bb438548f

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 6e5a2e35b018b60bd27e327708784eca
SHA1 4b4ab5baa13ebd4a39b78a3bdd1b6a90e2ac5d73
SHA256 0b1dd4dc1f2850eec262ab0414ca5c75056ee282972724d4f34b4af5c96a4927
SHA512 93542e65c37202362b07c73e52c272b6a234f9ed5e888fe38906178aa7fe6f783c4885a051edb9d045ebab769ca96847927fb5ddf85d61e6c151cc17ea05a87b

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 20946db5022abcbb7a936214dccc134c
SHA1 a5e7917890da7c1d44b72c86f9a1382d98aa5e43
SHA256 cc982f15980acb18d5a1f2d032754dc2deb4e7e9cb00cd5264f894e8bbdc2423
SHA512 52d1e093fce4ec1f30b682e009ecb6f9a3ae6b37350fbf2fc7b7d24c15f244dbfb08cba01867edbbc26c8d2a4be5b470bbc98fa5050fa33293615596323d6162

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 40fbed27884ee07c24ac1031518d082a
SHA1 28be48c59addbea9c8c2e831bc1b42b613dff302
SHA256 4e944890d1d11f7c77ef38e05a4b28429256ec31a157e676b6e3dc04fd90d55a
SHA512 0756a2fa4edc77714e99101879b8275842e34d1ed862a81a7490ee1d81c2d80b2a5063cf830228ed06aeb95e36f6f06046a9baff3eda0ec6fe0cdcc4fb600e06

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 2e7eafdc3e68272bb394f5a32ab89a66
SHA1 ad7a386712a8f0930a0511a66c419777d442595e
SHA256 c82698b86c87fc400a0832fb198abccd235af87081e7d89befc8f109e667513f
SHA512 e49e5de64594bea7ff35a70132d3b51ea677a9abd8ef972bc91d13e5848d75882af321120920cc513e0d22af6dc4bac77cf5dbf241c5723179e28ccd12da1f41

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 00e6f07629ba1b165f7be5c46ed283e9
SHA1 02f2d60c5c1e3144de256d59998cc265d92b0bc5
SHA256 1bc0d0e735ae520c2fd8bab6e8197f2d15619602025c43e7c6b7874335af1122
SHA512 c214ea7796bb4e3e251f96916c15955b1a2f2b67b18ed7b610d2823f2f81ef6ee91efb50febfc5c28f6240e072517eae56f007ed3f722df4b19ac8aa984d2a67

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 5aefd09c0ff8126f8c72fec487c27157
SHA1 2923f0abe02ecf211a0cc290aaee11ae76d0a8dd
SHA256 0d912a8947eea76f52cd2e63b4e1200dbe077764688af28963f9a3e49dc1e1ac
SHA512 d1fd6bafb037b42189c4b890b4e74078a4d7e587d325ec46de85537c95a2a1992f40d56e2a86e7f75e7d84d20ad4372904e7b0b7526ed3f96114df218389de5c

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 cfc8dd3388feb72e70f4e7a93c484cce
SHA1 0a2c39bf867348c50004ac240a0f73ba45913ef9
SHA256 0e9cd93b7ae2efff731548427fa43fed647d19af3b807de66d2c13cc4915c1ab
SHA512 710499e3d901a7e27bf5fd32b13b2f00ec33bb7804b54f0fe062e50a633de01c63756f2e30a0bea13a2f01deb762dce590df132251ba4dac443966cf3c071d06

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 a51f1c76c4c66e881672622edb7fac74
SHA1 860f1024db29963125df8727fa72dba1e221c7aa
SHA256 a85da261dae22ac5194afbc748be712ac2d94bbe052208e6b91ef2efdf06f7ca
SHA512 3da2f8d36bb342b27a21e084773184e6938854c78ec254052cecfb25fd8ec08882d1fd904fe71312efbbfae916c86f4b7f045f535ee09c3e22510e13a53c606c

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 8ee5a52b04ae35e0dfaa890f805875ae
SHA1 8ede623553090dca13d599460c000581cc42e482
SHA256 8a97ffb9baba7a36f84ecfef1cec888debdffc6c4e504d177e93d9fa461ee554
SHA512 d8167a284745fe2cf317c25ec68ffd45153a25230459e2bdcb0abf0ac8cc4f622cfb3850e1a71f52673ca9a97232cbe97ff39dd995facc3bd80efc2dce7faa4f

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 bd122017eaea9c3882bc19169feb0e99
SHA1 a932b23d7b3c77a0ca2baa76ddc212c31aa1fd46
SHA256 78612658dc75ba943ce99f8bb5bd3d4e2f4c8d2808b0f52f7ca91584c729b35b
SHA512 e6e3caa77a19705d3106d75bf553066f4c49942d4fc7edb9a526255e3fb3244b876dc3d38eb281ad97031b95aef3dba60327e3e1ec426a3f5778990990fe488c

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 a651c952617908a1945e07854bd75c55
SHA1 2393ad64f972b9c4a0bb16108749e4a38ef2bfef
SHA256 27bd2405ff1f576f52eb98eb35fbe8f5597d9bcdf6bb1b1efb7405227ff95398
SHA512 efbea55a40c6c67106f3d027c16ae6f7885ab24ef8bd7719aacebed447dc65840ac98a3f07cbbffff9843fc6aad33de52be6fd2d581b38af153b78eebeaadbdc

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 5784ddd21f4afa25bd339138c7cb5231
SHA1 857de2878d6227657d8635a20d76a5e1194a4005
SHA256 c6d054733af4e5edb5b8257a2432ee2fe19e0317da595b94f65dbf54e591e033
SHA512 65ff9ed7459658f13cb0228b8626d0e86c3ce261bef2ccbda3bc89f30c26b7f94c8bfbc31efab14711b18d901ff2a853141ec794e261fc1f02d0ab848a2aea35

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 9a0092082c16b542bd7d00b189ff31b9
SHA1 f92de52921cf447b5cc5a8ec3076b2530ba900ce
SHA256 ea9b8022a4f530b20533494ea098f2c6f184bc2adb823f2e90c96e07e65d6572
SHA512 11d9125de4514e23fcbfb71c79021b2ca719182a1a36f6a08ae20341f181c19e9da3b00360a64ba28c15fb30d87b99da25954d5888f5500bd87994c3e3630282

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 3a9ad25bd418d106604c10a0368713b0
SHA1 9000eabde480c266fcf89d14e45690e0ced1ffdd
SHA256 760d160e049108bdddbb2379aeade70fbd94b152bfbd722f48da15a4e2f4f951
SHA512 121f8b366c0ed5a70f12c3df7e0bfa1c1b5428dd41878fd5b061179ea0bd789edad3e6e292a91fa941950e794840af4512a952a4c4fa9077450c18115d1b1b6c

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 12dbe3bb00d4a359fba13b0f308d636e
SHA1 3d07c28443c24580fe7715d31a7060109343b1cd
SHA256 d82df731363a3d2e2abeb1b03528aa62f5abe33053eb76383c56da9ba858bba2
SHA512 e288595874b2852fd0e39f5b2185379cb3bb3d25c127035ae7809556a5f21ebb46ae8dbcd4a5c80082ae4400b7794320858ea58e586695c46343d4ae3dcc51b8

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 5807411b145156054be83ddf844bc676
SHA1 8c4862a64d30a42b53dcedf39137f1a7cb37be79
SHA256 e6a3e89e9e44c656ec4ae894e60dbcf76f75ff66650ec37103ea96bfb82c3416
SHA512 9068d1b597aa8a4fbf703abc7f36d4e224bc5a5ebadc7607c5264d694b999d6d9b8ca1b602a58173b8bde2d231c47b244ef402a5817680ad3e2e9326f6689b35

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 3bbaa558b36aec48e8f2cc08c95b248b
SHA1 811ffa75c7333687761819b4a899987e1100b946
SHA256 d454f77196fa2290872a11b8e0fdb587295ad6ae565063fa0467f5cb099c289a
SHA512 6e8e51a1f9f27bc60e98ff39937f3036a038eac6b93a3a094466a8a5878ade88d69c5ba1f32cb809bd836ef3c25c53327146375c25fd9baa6c57d81e733930a0