Malware Analysis Report

2025-04-03 14:10

Sample ID 241105-bt1r1s1kc1
Target d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461
SHA256 d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461
Tags
agenttesla xworm collection discovery execution keylogger persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461

Threat Level: Known bad

The file d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461 was found to be: Known bad.

Malicious Activity Summary

agenttesla xworm collection discovery execution keylogger persistence rat spyware stealer trojan

Detect Xworm Payload

Xworm

Xworm family

AgentTesla

Agenttesla family

Command and Scripting Interpreter: PowerShell

Reads WinSCP keys stored on the system

Reads user/profile data of local email clients

Checks computer location settings

Executes dropped EXE

Drops startup file

Reads data files stored by FTP clients

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Program crash

System Network Configuration Discovery: Internet Connection Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Script User-Agent

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Suspicious use of WriteProcessMemory

outlook_office_path

Scheduled Task/Job: Scheduled Task

Checks SCSI registry key(s)

outlook_win_path

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-05 01:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-05 01:26

Reported

2024-11-05 01:29

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Agenttesla family

agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Public\Libraries\ljmijamD.pif N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Public\Libraries\ljmijamD.pif N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk C:\Users\Public\Libraries\ljmijamD.pif N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Public\alpha.pif N/A
N/A N/A C:\Users\Public\alpha.pif N/A
N/A N/A C:\Users\Public\alpha.pif N/A
N/A N/A C:\Users\Public\xpha.pif N/A
N/A N/A C:\Windows \SysWOW64\per.exe N/A
N/A N/A C:\Users\Public\pha.pif N/A
N/A N/A C:\Users\Public\alpha.pif N/A
N/A N/A C:\Users\Public\alpha.pif N/A
N/A N/A C:\Users\Public\alpha.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe N/A
N/A N/A C:\Windows\system32\fxssvc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe N/A
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
N/A N/A C:\Windows\System32\msdtc.exe N/A
N/A N/A \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE N/A
N/A N/A C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe N/A
N/A N/A C:\Windows\SysWow64\perfhost.exe N/A
N/A N/A C:\Windows\system32\locator.exe N/A
N/A N/A C:\Windows\System32\SensorDataService.exe N/A
N/A N/A C:\Windows\System32\snmptrap.exe N/A
N/A N/A C:\Windows\system32\spectrum.exe N/A
N/A N/A C:\Windows\System32\OpenSSH\ssh-agent.exe N/A
N/A N/A C:\Windows\system32\TieringEngineService.exe N/A
N/A N/A C:\Windows\system32\AgentService.exe N/A
N/A N/A C:\Windows\System32\vds.exe N/A
N/A N/A C:\Windows\system32\vssvc.exe N/A
N/A N/A C:\Windows\system32\wbengine.exe N/A
N/A N/A C:\Windows\system32\wbem\WmiApSrv.exe N/A
N/A N/A C:\Windows\system32\SearchIndexer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows \SysWOW64\per.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Public\Libraries\ljmijamD.pif N/A
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Public\Libraries\ljmijamD.pif N/A
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Public\Libraries\ljmijamD.pif N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dmajimjl = "C:\\Users\\Public\\Dmajimjl.url" C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" C:\Users\Public\Libraries\ljmijamD.pif N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A checkip.dyndns.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e1d937933e6c0d63.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Public\Libraries\ljmijamD.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 512 set thread context of 2172 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Users\Public\Libraries\ljmijamD.pif

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\javaws.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Public\Libraries\ljmijamD.pif N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Public\Libraries\ljmijamD.pif N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\System32\alg.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\xpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\Libraries\ljmijamD.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Public\alpha.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\esentutl.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e6912f6212fdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007eb8c6f7212fdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e57077f5212fdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f132baf5212fdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007d7e1f6212fdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e62088f5212fdb01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Public\pha.pif N/A
N/A N/A C:\Users\Public\pha.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\pha.pif N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeDebugPrivilege N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A
N/A N/A C:\Users\Public\Libraries\ljmijamD.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 512 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Windows\SysWOW64\cmd.exe
PID 512 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Windows\SysWOW64\cmd.exe
PID 512 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 2736 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 2736 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 2736 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 2736 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 2736 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\esentutl.exe
PID 2736 wrote to memory of 3980 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 3980 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 3980 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 2620 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2620 wrote to memory of 4672 N/A C:\Users\Public\alpha.pif C:\Users\Public\xpha.pif
PID 2620 wrote to memory of 4672 N/A C:\Users\Public\alpha.pif C:\Users\Public\xpha.pif
PID 2620 wrote to memory of 4672 N/A C:\Users\Public\alpha.pif C:\Users\Public\xpha.pif
PID 2736 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \SysWOW64\per.exe
PID 2736 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows \SysWOW64\per.exe
PID 1464 wrote to memory of 848 N/A C:\Windows \SysWOW64\per.exe C:\Windows\SYSTEM32\esentutl.exe
PID 1464 wrote to memory of 848 N/A C:\Windows \SysWOW64\per.exe C:\Windows\SYSTEM32\esentutl.exe
PID 1464 wrote to memory of 3900 N/A C:\Windows \SysWOW64\per.exe C:\Users\Public\pha.pif
PID 1464 wrote to memory of 3900 N/A C:\Windows \SysWOW64\per.exe C:\Users\Public\pha.pif
PID 2736 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 4056 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 2736 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Public\alpha.pif
PID 512 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Windows\SysWOW64\esentutl.exe
PID 512 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Windows\SysWOW64\esentutl.exe
PID 512 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Windows\SysWOW64\esentutl.exe
PID 512 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Users\Public\Libraries\ljmijamD.pif
PID 512 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Users\Public\Libraries\ljmijamD.pif
PID 512 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Users\Public\Libraries\ljmijamD.pif
PID 512 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Users\Public\Libraries\ljmijamD.pif
PID 512 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe C:\Users\Public\Libraries\ljmijamD.pif
PID 744 wrote to memory of 4364 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 744 wrote to memory of 4364 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 744 wrote to memory of 3980 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 744 wrote to memory of 3980 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2172 wrote to memory of 5032 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2172 wrote to memory of 5032 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2172 wrote to memory of 5032 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2172 wrote to memory of 3028 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Windows\SysWOW64\schtasks.exe
PID 2172 wrote to memory of 3028 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Windows\SysWOW64\schtasks.exe
PID 2172 wrote to memory of 3028 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Windows\SysWOW64\schtasks.exe
PID 2172 wrote to memory of 1792 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe
PID 2172 wrote to memory of 1792 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe
PID 2172 wrote to memory of 1792 N/A C:\Users\Public\Libraries\ljmijamD.pif C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

Uses Volume Shadow Copy service COM API

ransomware

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Public\Libraries\ljmijamD.pif N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Public\Libraries\ljmijamD.pif N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe

"C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\ljmijamD.cmd" "

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10

C:\Users\Public\xpha.pif

C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10

C:\Windows \SysWOW64\per.exe

"C:\\Windows \\SysWOW64\\per.exe

C:\Windows\SYSTEM32\esentutl.exe

esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o

C:\Users\Public\pha.pif

C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe /d C:\\Users\\Public\\Libraries\\Dmajimjl.PIF /o

C:\Users\Public\Libraries\ljmijamD.pif

C:\Users\Public\Libraries\ljmijamD.pif

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 01:33 /du 23:59 /sc daily /ri 1 /f

C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe

"C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 gxe0.com udp
US 198.252.105.91:443 gxe0.com tcp
US 198.252.105.91:443 gxe0.com tcp
US 8.8.8.8:53 91.105.252.198.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 54.244.188.177:80 pywolwnvd.biz tcp
US 8.8.8.8:53 177.188.244.54.in-addr.arpa udp
US 8.8.8.8:53 107.10.141.18.in-addr.arpa udp
US 8.8.8.8:53 ssbzmoy.biz udp
SG 18.141.10.107:80 ssbzmoy.biz tcp
US 8.8.8.8:53 cvgrf.biz udp
US 54.244.188.177:80 cvgrf.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 172.234.222.138:80 przvgke.biz tcp
US 54.244.188.177:80 cvgrf.biz tcp
US 172.234.222.138:80 przvgke.biz tcp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 44.221.84.105:80 npukfztj.biz tcp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 138.222.234.172.in-addr.arpa udp
US 172.234.222.143:80 przvgke.biz tcp
US 172.234.222.143:80 przvgke.biz tcp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
SG 18.141.10.107:80 knjghuig.biz tcp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 143.222.234.172.in-addr.arpa udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
RU 82.112.184.197:80 lpuegx.biz tcp
US 212.162.149.53:7071 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 53.149.162.212.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 s82.gocheapweb.com udp
DE 51.195.88.199:587 s82.gocheapweb.com tcp
US 8.8.8.8:53 199.88.195.51.in-addr.arpa udp
DE 51.195.88.199:587 s82.gocheapweb.com tcp
RU 82.112.184.197:80 lpuegx.biz tcp
RU 82.112.184.197:80 lpuegx.biz tcp
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 242.44.101.158.in-addr.arpa udp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 vjaxhpbji.biz udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
RU 82.112.184.197:80 vjaxhpbji.biz tcp
US 8.8.8.8:53 xlfhhhm.biz udp
SG 47.129.31.212:80 xlfhhhm.biz tcp
US 8.8.8.8:53 ifsaia.biz udp
SG 13.251.16.150:80 ifsaia.biz tcp
US 8.8.8.8:53 saytjshyf.biz udp
US 44.221.84.105:80 saytjshyf.biz tcp
US 8.8.8.8:53 212.31.129.47.in-addr.arpa udp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 vcddkls.biz udp
SG 18.141.10.107:80 vcddkls.biz tcp
US 8.8.8.8:53 fwiwk.biz udp
US 172.234.222.143:80 fwiwk.biz tcp
US 172.234.222.143:80 fwiwk.biz tcp
US 8.8.8.8:53 tbjrpv.biz udp
IE 34.246.200.160:80 tbjrpv.biz tcp
US 8.8.8.8:53 deoci.biz udp
US 18.208.156.248:80 deoci.biz tcp
US 8.8.8.8:53 gytujflc.biz udp
US 208.100.26.245:80 gytujflc.biz tcp
US 8.8.8.8:53 qaynky.biz udp
SG 13.251.16.150:80 qaynky.biz tcp
US 8.8.8.8:53 160.200.246.34.in-addr.arpa udp
US 8.8.8.8:53 248.156.208.18.in-addr.arpa udp
US 8.8.8.8:53 245.26.100.208.in-addr.arpa udp
US 8.8.8.8:53 bumxkqgxu.biz udp
US 44.221.84.105:80 bumxkqgxu.biz tcp
US 8.8.8.8:53 dwrqljrr.biz udp
US 54.244.188.177:80 dwrqljrr.biz tcp
US 8.8.8.8:53 nqwjmb.biz udp
US 35.164.78.200:80 nqwjmb.biz tcp
US 8.8.8.8:53 ytctnunms.biz udp
US 3.94.10.34:80 ytctnunms.biz tcp
US 8.8.8.8:53 myups.biz udp
US 165.160.15.20:80 myups.biz tcp
US 8.8.8.8:53 oshhkdluh.biz udp
US 54.244.188.177:80 oshhkdluh.biz tcp
US 8.8.8.8:53 yunalwv.biz udp
US 8.8.8.8:53 jpskm.biz udp
US 34.211.97.45:80 jpskm.biz tcp
US 8.8.8.8:53 34.10.94.3.in-addr.arpa udp
US 8.8.8.8:53 20.15.160.165.in-addr.arpa udp
US 8.8.8.8:53 200.78.164.35.in-addr.arpa udp
US 8.8.8.8:53 lrxdmhrr.biz udp
US 54.244.188.177:80 lrxdmhrr.biz tcp
US 8.8.8.8:53 wllvnzb.biz udp
SG 18.141.10.107:80 wllvnzb.biz tcp
US 8.8.8.8:53 45.97.211.34.in-addr.arpa udp

Files

memory/512-0-0x0000000002440000-0x0000000002441000-memory.dmp

memory/512-9-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-8-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-11-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-23-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-26-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-25-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-24-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-22-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-21-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-20-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-19-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-18-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-17-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-2-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-16-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-15-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-14-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-13-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-12-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-10-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-7-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-6-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-4-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-5-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-3-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-1-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-27-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-30-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-32-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-31-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-33-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-63-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-62-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-61-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-60-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-59-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-58-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-57-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-56-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-55-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-54-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-52-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-50-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-48-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-47-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-46-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-45-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-44-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-43-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-42-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-41-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-40-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-39-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-38-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-37-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-53-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-51-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-49-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-36-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-34-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-35-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-29-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-28-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-64-0x0000000000400000-0x0000000000543000-memory.dmp

memory/512-559-0x0000000002440000-0x0000000002441000-memory.dmp

C:\Users\Public\Libraries\ljmijamD.cmd

MD5 b87f096cbc25570329e2bb59fee57580
SHA1 d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256 d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA512 72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

C:\Users\Public\alpha.pif

MD5 d0fce3afa6aa1d58ce9fa336cc2b675b
SHA1 4048488de6ba4bfef9edf103755519f1f762668f
SHA256 4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA512 80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

C:\Users\Public\xpha.pif

MD5 b3624dd758ccecf93a1226cef252ca12
SHA1 fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA256 4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512 c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

C:\Windows \SysWOW64\per.exe

MD5 869640d0a3f838694ab4dfea9e2f544d
SHA1 bdc42b280446ba53624ff23f314aadb861566832
SHA256 0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA512 6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

C:\Windows \SysWOW64\NETUTILS.dll

MD5 6d23fe871b2064c6d13580a5745f23cb
SHA1 50e113c0e2269cf7972466a828822803537a8f6e
SHA256 c835f2a1234b62ab7684694af378f62770903d07d6fdfbe3a371509e2b4ccc67
SHA512 1244be1ab0a9cabc0eb02249d4b083939e3f088ebda4b58dc03c61618fce56f27a3f58cfd74d39fb06010db7515520307766c16815f6700507a0371d03765e1a

C:\Users\Public\pha.pif

MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

memory/3900-864-0x000002244CA10000-0x000002244CA32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1cafgui.i3t.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Public\Libraries\ljmijamD.pif

MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

memory/2172-1097-0x0000000000400000-0x000000000054B000-memory.dmp

C:\Windows\System32\alg.exe

MD5 e8a94236a22bd5f9475f4eaac9f7343e
SHA1 a58d5045a17c7bb3f8c4ff31132f2d4cd899e741
SHA256 8f220e1d4f8b9c9a5940a980d0da0e85225458db9e280b62b5f6bf5412c5ea94
SHA512 cfd3b3b6cdee187f3f18b571ad1f2c5a197faeae5bd220c01c56e70a382e000924e2aa453b637d287cc22c28a108e7cddce5e78f27040aad1f86d25c3253c2ce

memory/1492-1132-0x0000000140000000-0x0000000140130000-memory.dmp

memory/2172-1136-0x0000000021A90000-0x0000000021AB6000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 6b64d4baf4d810d652d61a6e49fc8e27
SHA1 aa6fb5a9aee5405b75870cfc93a1208d22c3816e
SHA256 4fd23caf529fed0e548048bc43ce83709708477da332868ae81d46ce25094888
SHA512 198ec150ce147425a6379461b635dffcdb1e8b5f39929cb7b4127b576a820dfef4bb17d90d8fbbbd31d94bc56846b581f0092deac499cb5851ff26d94e6e2363

memory/2816-1162-0x0000000140000000-0x000000014012F000-memory.dmp

memory/2172-1176-0x0000000023D80000-0x0000000024324000-memory.dmp

memory/2172-1178-0x0000000023CB0000-0x0000000023CD4000-memory.dmp

memory/2172-1387-0x00000000243D0000-0x000000002446C000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 d334efd7b0dd9bdcc131c7949b536354
SHA1 1fec88af376db93c9fb252f12598e2542b572f1f
SHA256 98b028a242617472926c95469db7e90a8fc68f15288d22c386c6b1a4891eac1d
SHA512 c56ca1b550745af11fae716105057a8a103937f703da3214a59881f813adab9b5bdeda58d5aca52ff16fed169c5e35abc567d7bf645faf3aa8cb47f0b40baf36

memory/2968-1389-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2968-1401-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

MD5 e19186a4ffbb887adda2c790b85fa713
SHA1 118d1586172f4f01d65c5cdb0664896a9efe4adb
SHA256 df698a51b0400e0d43c5f8ebb44e70f1ca8155eb6efc673c456ba41a988ada98
SHA512 1d593730a63638baea3b13628b7574c6dc376612a69132d2a67b6160418a8b21dc9470aa8687985b3fa39e1bad12538bbd12843652300c533addd424923a918f

memory/3744-1409-0x0000000140000000-0x0000000140234000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 6c249df8e469bcb860a69cedae2d79e2
SHA1 7eb7b89c71b96d4cea0deb85dc9d164288f3e587
SHA256 ec4956a9d71bd1e6743cda975d4468be975a9ad0ee9cae2b9314b846d394887e
SHA512 b4057d02f4e092663e6f4ca8e44d71277c2a87a27e7551f26287d3914db20ba083d8287bd366abe26ba511b3a7955cd15fb2c8a2dd7e205074de47893722f104

memory/3428-1422-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 f08683a01d0a96da432a3a8e8be75653
SHA1 457479e768e15f9798163d725b47ba77541c0039
SHA256 d4b031613b49d3c2df1a6dd15756b4bd22b6cf3b5db3230e41d7f15d435f2834
SHA512 818e0c503d089c3e0f64a96f892f9e421ceb44c1bd8f8fedfd98c51b959b2ff83fbda9fc4bd117633ba2b4fa5c8e6a5e6839c79644c18e53dd4e5473fd354d06

memory/2204-1425-0x0000000140000000-0x0000000140155000-memory.dmp

memory/2204-1437-0x0000000140000000-0x0000000140155000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 0b82ea0ac3f908cd279ba87b12ec4416
SHA1 ef1f3d2a678cc7c7d379d3db56dd28215713d9e0
SHA256 ab28e439466fa792f909d38bd305cb6477c73955427fa2f6114776c0def4fb05
SHA512 af8b82caf9eabcb2d961944e76eadfef4a7227b36a6dea95285b8d25a5af75b09ccf5e66d04ba7e4fb14f2597240a2d9f2664b1feaf072d0aad0abeab7ece459

memory/3960-1440-0x0000000140000000-0x000000014013F000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 80542e6ddacf095e2cfbc42028984b11
SHA1 c92828774fcc23e7f58fd4680c65ee29453aec97
SHA256 66e228197875f448ccb764b1644311925d9013966e26a816ae1b8dc9272cef63
SHA512 451a2d3fc36c9fca14ebf16ae98dd9b21a2397e5c626ee0aae152cbd1285075afd9d5ee50b514b7dc129b54ad145a62d2d1473bd69ba361e49e6ba64bb753a65

memory/4340-1452-0x0000000140000000-0x0000000140155000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 6884cca45f61c8732a2661558df703ed
SHA1 9929c314dee59facd9457d3d83425bde44a63fed
SHA256 4da0c206774bc75a860700ba9988e9ec5ff5998049bdcd183ebe217dc52c0216
SHA512 ba150034836ef34eb4e4a00472684afa242e0420c9bc5598b0a129865f3b52da5bc10200e968d29b2c59535f297a74ab563f10c83b5deafaa45fdc3288d75ffc

memory/5112-1467-0x0000000140000000-0x0000000140131000-memory.dmp

memory/2172-1466-0x0000000000400000-0x000000000054B000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 99116cb86c0b4dccf362938bfeb1135b
SHA1 ad7f0376e4d602ab6338197233d44e509ffc9527
SHA256 7d53185df32363955823bec5be4728ec655308d153bec2089cf4e20668317276
SHA512 51837565b117f40a151cf759c06a6fb1d9a24f8424c899f0e829289d3dd40358608891546965d3cc14ee960686a861f86dc129da7250827cc6ed9125755bd706

memory/2200-1478-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 8f97544bc70778a0e4a2744e963f4fca
SHA1 95c3c78560ed7b812e52a379cdfa6ee6ec4a22f0
SHA256 7b23035186d15b78920f90f5a9790497d3e26ee7088945b8e91a788bcf76f65b
SHA512 028cffeeb152db0cf2644782dfcc25604074dcf3e1ba63b28d67b45bac911dbfc7224c672ecfbdab801dfff7734e524c0e37b4e92ce791e0ac970d3065313eae

memory/1616-1482-0x0000000140000000-0x000000014011B000-memory.dmp

memory/1492-1481-0x0000000140000000-0x0000000140130000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 44d308f9af98d828aa26f9251b7198ed
SHA1 c49df7340a748451aa572fb86a1e900d6584a1fa
SHA256 63f2aa2bcbe2ea5308554cce33908b4d5ceee4345c4670ee317ec843c484030f
SHA512 078c21dbb4ad53f16c77c6bbc7336a217b02f4cd85f0a21cbe70251e9b19183d853058e890589d1b156a07926c7329668b73150a0318640c395dffc98b36e278

memory/2816-1493-0x0000000140000000-0x000000014012F000-memory.dmp

memory/4368-1502-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 c42b8ea0fd8003708fa27c886bf7c7da
SHA1 f1589d90b197a6a18332860d22d25b6fb9619dd4
SHA256 d21a9809bd9fa5d4d67cbce0b5a8d6b7a395d26394cf26e07f11da9332a44922
SHA512 b58da802d370fdc5714678ebf7140cb7df282f86e5b8fc60d4e7bd0f28610e82099a18505b56ebfbc8c24fd7dd24b353b24516b2d6f27ec995c6a049db15f1c0

memory/2080-1506-0x0000000140000000-0x000000014011C000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 ab7253e112c1dee7e1d354313065ab53
SHA1 96de2269b1573a7c433801c9479e29a99f3e6b65
SHA256 bff2f25dfa54b6f4a7d493b2f632517873fd8d33f18f7a6063fa7fc3e86271b0
SHA512 6a43485b0a142779498dd4ac0760ed753416f930bdb70752cd5a2874522224edcae9aa18d07438a22755148029bc6d5827ddaf066f5b06815d187ed55d6948da

memory/4072-1518-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3744-1517-0x0000000140000000-0x0000000140234000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 cd31813d2d0be3f4112aceb9d776e6f0
SHA1 87f795bb02c51e72496574f70dd7ea08fe8945db
SHA256 f339af5c18274aacd53efdd2373f4de2298bd9562828675586092cea7a54ce58
SHA512 bb9b33be46f24151b0e04f335b6b7b62e3b9c90452616cb82c3310f4cedf22bd7a80c3a93f0b61b8016a3075f8836aa44a6aac5ed502e71773120f14a6f3ad57

memory/848-1531-0x0000000140000000-0x0000000140188000-memory.dmp

memory/3428-1530-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 ae891135e57eca6a638afece649182b4
SHA1 1783a74884b5d6f8df1a05d0605a5cbe217c75a4
SHA256 4a625e9761d021d4dea690a263dc7f9657e77f0e03f4166542192022049ae552
SHA512 b4afd220fa7540b56e1d2c1b8257326d3a006f68ace12596a6285516a7d5d1dd537cbc0dc657479260ea199a5b5402d68c1a55229d5f2736068f1498420de9ff

memory/4044-1542-0x0000000140000000-0x0000000140168000-memory.dmp

memory/3960-1553-0x0000000140000000-0x000000014013F000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 c7b1c66bdb3e4d6d70bf4f2c3a710be2
SHA1 19602eaa90421c61950de9a5202d9b8096da9d77
SHA256 487bd5f41942cecc66c3091234e7440eda1fc5e9edeedccdb65e459d5f57706e
SHA512 d077e69557f4869973c3f68d27c6aa3ab69a0f40e5bd5332b10d7ac5abfe45ecffe44be6fbf4ac489c10d946d27ce63a83ee23340d00daa24dcf131520f00a5a

memory/552-1560-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 8b943777bbbbaf1e6e5f1520af5e1ce9
SHA1 2656d9d4b23b9dae43d7f153278206525620623c
SHA256 f457ee97444a157005f9cfa54bdddbd4e11681c3d65fabce0250f74403ec4c46
SHA512 b5617429e9bdb19d38680ba3596c52f441654553c7a4741336229b01a5bf76fe19a134408f0c8065b97a9a5844e5968013170a8fb6b721f5139dcce3bc15466a

memory/1404-1577-0x0000000140000000-0x0000000140147000-memory.dmp

memory/4340-1576-0x0000000140000000-0x0000000140155000-memory.dmp

memory/552-1566-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 178de827c270f70fa4a8b5c2f14edcc7
SHA1 fcb21b6a0305bb769556d6eb28bd96dca8815b5f
SHA256 62451b0c2bf5afca4e841dcd1acb2a5e3c3c38f71c87a538a105b82821e70e0c
SHA512 d70efa5736f09d431d161f3b7f4d566dd91baa681e1aef363f2ea614dfd4fe0cb259158487327ae56a9815c87392a7cdaee1472177a033b2986ba6e94cd7c19e

memory/5112-1580-0x0000000140000000-0x0000000140131000-memory.dmp

memory/840-1581-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 fd1cc7062ec185c228650e31a1b03173
SHA1 bb6edfd7006ec654274aa14f1c14bd08fcbf08d8
SHA256 a747a3de6e83a571ac05725f625b7bf70f6729c512376d30367f3ab4b46359ae
SHA512 faaca70da631dff15a36823d3b3f32444da85f2131c7e2a70e6e8ab8e7ebece8914b66c50758c2856541ceb9fcf14817af6449b704b56dd52607262fd1c8aed3

memory/2200-1592-0x0000000000400000-0x000000000051D000-memory.dmp

memory/2352-1593-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 73e60d025c69934aa47e536a2bfb6eec
SHA1 9f8d13a1dc775355238b533e8d20e6dcb316ba8b
SHA256 61adae6c46bfc2438b6342cf1cf6db173fbb6d7b5d94b44a480efbdcf08f079c
SHA512 934cdf78e9672103ebaab634f4b370f204e3e4f976ff0b2dc485b50ff17c516175ff1ebb1ecae169e6ac7cea9798397af643aa45ba14791b0e3e0eee1d7cc250

memory/1616-1605-0x0000000140000000-0x000000014011B000-memory.dmp

memory/1528-1614-0x0000000140000000-0x000000014014C000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 098fd02d6d97077d93209f10f1e103ae
SHA1 c7a9e7d2ec1ab355ef80a422b5ba33415f8f1646
SHA256 570c42a7de3364618c6ac799f049d2e70f1aab0fe0236793e7c86421a54f9029
SHA512 7a4f00f30e9db68ea5633d3585e372ec8250585b3fcdf7a3ed1102b4edfb2bf6664f4cff00823b6f68531fb7c20bff121f91ab838bc6d319425b68dc42e310bf

memory/2172-1620-0x0000000025340000-0x00000000253D2000-memory.dmp

memory/4368-1628-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/744-1631-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2172-1632-0x00000000257C0000-0x00000000257CA000-memory.dmp

memory/2080-1704-0x0000000140000000-0x000000014011C000-memory.dmp

memory/4072-1737-0x0000000140000000-0x0000000140169000-memory.dmp

memory/848-1774-0x0000000140000000-0x0000000140188000-memory.dmp

memory/4044-1808-0x0000000140000000-0x0000000140168000-memory.dmp

memory/1404-1873-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2172-1875-0x0000000026310000-0x0000000026376000-memory.dmp

memory/840-1876-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4368-1887-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2352-1916-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Users\Public\Dmajimjl.url

MD5 597d7c7bb34e78f2bb95c2b964b8e8db
SHA1 ed20e2b4a574b88aee4bfb2bbf4072fcc27c52f0
SHA256 f450b5a3ad6e96192bf6b44e8bb796a552a37742d4bef6ce7acd63c359ffcdf9
SHA512 4c9bcd21f7da56bc3b10c455ca18ab9aab405ea5618856c4d0c65eae5488c197d3d7fd66dbee5b56a2341fe63d6ad77c2f0af5878477d9634cd7345aa9e0f265

C:\Users\Public\Libraries\PNO

MD5 809f68abc37251a8a63a05ffd8dbc7d5
SHA1 31db8f8e97948d142bb8c8ce32e07a7121866dc9
SHA256 a0ec0460fc75a1eea654e7a06b4b6addb3a2f8a4dfc8cd3ea9f2356d644ab44f
SHA512 c16adff55135d34367a4f8d4af021d79bd7e8ff291b10734aa92dc83d57716681b28ef726697a57560d363f8e0f82abd95ad5dcf9cd9ffd7f87c81ba8004fec1

C:\Users\Public\Libraries\Dmajimjl.PIF

MD5 156fd655d4aa8b31311d089401226a42
SHA1 319ffb454a5dec4fb59fca008171f38a808a8291
SHA256 d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461
SHA512 7dfb1815df7338142ca2c9d3873086f3e36206090b2197ac863c5c18e9dcceca160c8724fa84bbf5e8adc42e9b34d7c5877a1e7b783a8dce9185fc335fb73214

C:\Users\Public\Libraries\Dmajimjl

MD5 f25963b148fc1f30363ba66517209671
SHA1 b002c9046452c9a2caacc51751e24bf7968a7bea
SHA256 267b19dd34a745f5078b639151c4a75f302cca8cfd79b6a7ee8555e4d45198eb
SHA512 b8d4f5e3d9862f03c5b0bee2e08b487218fb17d56fbc65931e0b5931b9310eaa027eff219b281d857330dead62818ec721dd6dcdfbcec9a2facce3285c9f290e

memory/1528-1927-0x0000000140000000-0x000000014014C000-memory.dmp

memory/744-1929-0x0000000140000000-0x0000000140179000-memory.dmp

memory/2172-1930-0x0000000026BE0000-0x0000000026C24000-memory.dmp

memory/2172-1931-0x0000000027320000-0x0000000027370000-memory.dmp

memory/2172-1935-0x00000000273A0000-0x00000000273BE000-memory.dmp

memory/2172-1937-0x00000000273F0000-0x00000000275B2000-memory.dmp

memory/2172-1939-0x0000000027710000-0x0000000027728000-memory.dmp

memory/5032-1941-0x00000000028E0000-0x0000000002916000-memory.dmp

memory/5032-1942-0x0000000005500000-0x0000000005B28000-memory.dmp

memory/5032-1944-0x0000000005410000-0x0000000005476000-memory.dmp

memory/5032-1943-0x0000000005270000-0x0000000005292000-memory.dmp

memory/5032-1945-0x0000000005C30000-0x0000000005F84000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

memory/5032-1957-0x00000000062D0000-0x000000000631C000-memory.dmp

memory/5032-1956-0x0000000006230000-0x000000000624E000-memory.dmp

memory/5032-1959-0x000000006F060000-0x000000006F0AC000-memory.dmp

memory/5032-1958-0x0000000006860000-0x0000000006892000-memory.dmp

memory/5032-1970-0x0000000007250000-0x00000000072F3000-memory.dmp

memory/5032-1969-0x00000000067D0000-0x00000000067EE000-memory.dmp

memory/5032-1972-0x0000000007570000-0x000000000758A000-memory.dmp

memory/5032-1971-0x0000000007BB0000-0x000000000822A000-memory.dmp

memory/5032-1973-0x00000000075E0000-0x00000000075EA000-memory.dmp

memory/5032-1974-0x00000000077F0000-0x0000000007886000-memory.dmp

memory/5032-1975-0x0000000007770000-0x0000000007781000-memory.dmp

memory/5032-1976-0x00000000077A0000-0x00000000077AE000-memory.dmp

memory/5032-1977-0x00000000077B0000-0x00000000077C4000-memory.dmp

memory/5032-1978-0x00000000078B0000-0x00000000078CA000-memory.dmp

memory/5032-1979-0x0000000007890000-0x0000000007898000-memory.dmp

C:\Windows\system32\SgrmBroker.exe

MD5 3ba4b47a38f52c494133b33eb6629f02
SHA1 90f1bb0f8afa029224179169f7a62be42e191f96
SHA256 ff8a97cc5aaf9cf6b529f720924b2ede4e096c28a36b4cad8d4ede7b5977b9f1
SHA512 a5c5eb28d932af34238da778670ac438feac6bee5edd9bdbdd04cd4f1b655db42290be71952a410237b13c9f104fb86384cc5208751841fa569850f7ef72d362

C:\Windows\system32\msiexec.exe

MD5 12dc013071d0be73d0bfe12de976d77d
SHA1 33c40f1495a11abe28509fad1ca45d3c2699e529
SHA256 cae78d929e622eddcf2c84e1e55e068ab66aca274d4a2a30e828719f00cab135
SHA512 eb095304a61ac935fadf01967a75378a0e538d37c04d678b719df97b188d748180a6f9cc138aecfd595124b79dc3d7ea07a5afa3d03cc8bf48e30ab8086e1031

C:\Windows\system32\AppVClient.exe

MD5 f94a2864fca60339dab33c73c7e797ed
SHA1 1202dd7f49a71ed9e2f2c00762ac660cd203bb00
SHA256 b9b6a6a474a3907985d2747bd87476fcc6769d1d3678eb7168e11fb6ded656d7
SHA512 a7c72896c827fcc96e8d5a66a3f335dee31f305ea9ffc4b411b7f8780644566487e36497d2a76a4e038f44fe19e292341ad133ea821d415cc7514f8a2ca01cc3

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 5b1d6ffb4c789c3d390f5ab9f133ab8f
SHA1 212a51e4c9eea3529e140043f0bb76c0ef25b7b9
SHA256 2283418a3d5c4b515b0dd3065a9ff50d0eea0d92a21ccbe2926942958773d4d7
SHA512 4c6faebdb7ec8bd1e96c4c7a4470bbd0e80a6c48a213916451c0c0ab1b82a89e7c335099fb290607d587343f6e75fa9909a1f3ef7325b1f3ca33343c81645da7

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 d402266ded335b2411d717cd49f7369e
SHA1 90429eed69c54b8bd47188b7a928b8dbcb06bb19
SHA256 b9762cda27f913d4fd16d712ce85c904284497a2be0621fe50028cce8fc07e7d
SHA512 563a2facd41e41253ea5db1df01ab0ce6fc20e944e756cd2fcd0d4d90c94525f97b522c6ef31fd5c64241ccceb42ceb0a2721dab6c9a1655ed56ed157cc57c9d

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 59421d5d38aedadc94a3d0a0257d9d38
SHA1 cbc88f961dcf0b45608bbe3b7195284f6c1d0851
SHA256 521a5ccf6fb46e7b7be9b5f40fb7d5bd2eef6df6ad7a5c86127c529e648d46ab
SHA512 d33d72bafc68a76b293836c4fc4c483b13836e30f83f108a6fae1d2a27e8a3e4745a265b10cdcd4a1bf74c55e0a8caca2d65be64c74652acf407ed1468a099dd

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 b62b787fc07b81df63fe97fe066678f2
SHA1 7bb6a633bfb7b86d301daa81b0f8f6f60e5cc27e
SHA256 6b6a38d4212e726a5222e3f458f36785f6d22fc807aebd5be74f3772c4c624ce
SHA512 63cf196d70220ff4004aee6b4a76c77057faafc5527f36330d8e44a88f7c8b75cc3046044bd844d6a0704003d316deb073714ab0c4cd5b49e58f0625e89186ae

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 99d7812c716a14dd1055e6f5416bc0b1
SHA1 189c240759cf7744bf0afa76d6f75e0f23ff1e09
SHA256 db5d436739bb40b0e36f238f4e54683ce86cba30ae274cdbc154f442e0bc276d
SHA512 f1441defd6cadf86657ef838452f1c09d99066d2efa90fd412ea54fb9ca85ae5b06bee4545d0f1750411723aae453c0a8bdca533a6c2d546b3ec36d07f2ca2a9

C:\Program Files\7-Zip\Uninstall.exe

MD5 bf90da3d0af4e1221dfcc5f5d5b53ef7
SHA1 74a7e0e542b7b2bd1a46fc1e8320ab55888b56ab
SHA256 403e5dc8c7c5d92136a015c0ec70de8c252278d2389beb6e1b58c86c44b4ccf1
SHA512 42c8bd4b150b95f3e6bb9f32436029752e0a36c73cae1d5af7c4411390dd00e2b2330e70dd137ab08ad822cc60d5f65cc23d48305e400c0c220878b089083f6a

C:\Program Files\7-Zip\7zG.exe

MD5 0c6b2b387ba59956f06da44c6ab14b29
SHA1 6e3a8fc54e2f7f2ee76f1cf628502c6c70f93174
SHA256 90e4e72dca61ed4712933d269c4f8d6d80b671e27a4fa4528b0b95693de8be06
SHA512 dd0df2c9dd923ed259bbc53e2e3a021eb48863fb878dee1acc284983aee4953c9fdd73e6e41257451fdff02d6532cd89d9756b92e675ed5345dedc966495ce67

C:\Program Files\7-Zip\7zFM.exe

MD5 4486557b30fb35b86808ee7ba420fb12
SHA1 bee83d462b76953005b8b88dd7ca24a2dcd911bf
SHA256 a2804594c4a4542129e9620e54bf34490889838b6285428c00b92639ba544ba8
SHA512 13d800f06192a32db8e34266180c09ae75e43e091339cb4233fef4a3689a00d2c384126a960cbcedf7b5ce6ca277d81bf0201786b27677bf54aa596c398fdfab

C:\Program Files\7-Zip\7z.exe

MD5 18c631b98dce316d3ecd86586153d173
SHA1 68854e9aa788c641a0777f56b7bc969f3be120ad
SHA256 d855bae790dd48da108b1b35ebaa1cf9008dba5d0b32ac9a04675aac7e835067
SHA512 7e970db82dc7a6c7a2b010cf03b658ba10e594296b55353203a54cb85eae3a14aedf47bf1801b1547d5fc83ce1c6dd253b208f66ce84baa1ac78f3e2d425c52a

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 208b7eb0842754e1c318fd52eaf2aed7
SHA1 b902b06248cd5803043dd1a0d0a62c9ed3c1c38c
SHA256 877bb842a09011cd3f8b3d8bf6c6cc2f4a705e83db67bb46e2ad3e4cae1a51f8
SHA512 27f33fe7d5243906dbc59b91cde1713ccf687a414c6724895cea8bb3ae43c2042b4acc3887b8c525cfc049649052106ed8e5b827b7891469ae67b806c172db39

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-05 01:26

Reported

2024-11-05 01:29

Platform

win7-20241010-en

Max time kernel

122s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe

"C:\Users\Admin\AppData\Local\Temp\d4996cbfebc931df1511b6daa6f51d5623a41fd275b4022b99de34f23c1bd461.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 712

Network

Country Destination Domain Proto
US 8.8.8.8:53 gxe0.com udp
US 198.252.105.91:443 gxe0.com tcp
US 198.252.105.91:443 gxe0.com tcp
US 198.252.105.91:443 gxe0.com tcp

Files

memory/2368-0-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2368-4-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-23-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-22-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-20-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-19-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-18-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-17-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-16-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-15-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-14-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-13-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-12-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-11-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-10-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-29-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-43-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-54-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-57-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-56-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-55-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-53-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-52-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-51-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-50-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-49-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-48-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-47-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-46-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-45-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-44-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-42-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-41-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-40-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-39-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-38-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-37-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-36-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-35-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-34-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-33-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-32-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-31-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-30-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-28-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-27-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-26-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-25-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-24-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-9-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-8-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-7-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-6-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-5-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-3-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-2-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-1-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-21-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-58-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-64-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-63-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-62-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-61-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-60-0x0000000000400000-0x0000000000543000-memory.dmp

memory/2368-59-0x0000000000400000-0x0000000000543000-memory.dmp