Malware Analysis Report

2024-11-30 06:42

Sample ID 240612-vrxgcswgll
Target 2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker
SHA256 d70531be79d1efc327e50e40de3ed09bfbfd03d6db365f3cea11ff1cc2a78175
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

d70531be79d1efc327e50e40de3ed09bfbfd03d6db365f3cea11ff1cc2a78175

Threat Level: Shows suspicious behavior

The file 2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 17:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 17:13

Reported

2024-06-12 17:16

Platform

win7-20240611-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\Adobe\caps\hdpim.db-journal C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Adobe PCD\pcd.db C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\caps\hdpim.db C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe"

Network

N/A

Files

memory/2596-0-0x0000000000400000-0x0000000000554000-memory.dmp

memory/2596-1-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2596-6-0x0000000000230000-0x0000000000297000-memory.dmp

memory/2596-16-0x0000000000400000-0x0000000000554000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 17:13

Reported

2024-06-12 17:16

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b4e7e1bd1ed82f9f.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\caps\hdpim.db-journal C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ded3d81eecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001336db1eecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4bd031fecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3ba411fecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000842891fecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c21e71eecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3943a1fecbcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" C:\Windows\system32\SearchProtocolHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_9e9fca1b4d8db5e2797aa6f8c79418e7_avoslocker.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/4952-0-0x0000000000400000-0x0000000000554000-memory.dmp

memory/4952-1-0x0000000000630000-0x0000000000697000-memory.dmp

memory/4952-6-0x0000000000630000-0x0000000000697000-memory.dmp

C:\Windows\System32\alg.exe

MD5 f1b1ac426d87acc4279272ade15a3d46
SHA1 b195a000cf1121b1a8e1fa7002acf28f647aa70c
SHA256 6f3e24b06aad4314cd4331b7c261f493859c87e617985a1eeefbceb3c74ad943
SHA512 6e388e4ff87f8820859b743df2fc26006331b87ad4263e4914fa109ae1e57addde193ea40fca0fa35e8d3b4e3f7d4e2aa0ea32bbb3fb7eed2935efe70b13a075

memory/736-15-0x0000000000700000-0x0000000000760000-memory.dmp

memory/736-24-0x0000000000700000-0x0000000000760000-memory.dmp

memory/4952-29-0x0000000000400000-0x0000000000554000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 619cc813c564f2ec0e31a55a2f113905
SHA1 34ae8606b642ffa30d02d20cc734d1ff8af4ad15
SHA256 c68609bfade31ac2fa5604022b79d7866995468ac44fa1f5b2f7d904a9f5f5a5
SHA512 82ba261f740533da446e0f6ef25a0f740a2357ea8ac490b3f4afbb99fdefdb113ecfd54388f3e00586dc549f3ba5e68a985c4511116eb2d6aaf1d4c8a9465781

memory/736-23-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3284-31-0x0000000000C50000-0x0000000000CB0000-memory.dmp

memory/3284-40-0x0000000000C50000-0x0000000000CB0000-memory.dmp

memory/3284-39-0x0000000140000000-0x000000014024B000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 8b7a705c38b76328556857331035dde3
SHA1 b41d0d309beff0262138c4a9508a69edc2d52205
SHA256 2562af8e3336348adc46b88bed46ceabe3f195a6653224d70bc31748e841236e
SHA512 6282a1f5bf294c986bb3075665a3d7564887511bed934468ba0d41c156113c809ea1bb6a195b283552a6943b615c8732b2771cc07fcea29d374b67ed059e5232

memory/3840-49-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/4792-59-0x0000000001690000-0x00000000016F0000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 9bf7e8fe994f0f0f4f2e6e48815e7fbe
SHA1 a0a4a1cd3eb72455d0672c2739e8511048fb34a9
SHA256 437b85290df01623acb64b8afa19105fdef1dac6f214adfe6d502339359dc635
SHA512 7361f377eac6fcb84814b0f5a5a298999d6f4b794f9a9055d2791296037c06e55ab840719e4633c7576d81312c21b101f8b80cdfdf328bdb14d15241605a06a3

memory/980-70-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4792-75-0x0000000001690000-0x00000000016F0000-memory.dmp

memory/980-74-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4792-73-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/3840-72-0x0000000140000000-0x000000014022B000-memory.dmp

memory/980-64-0x00000000004F0000-0x0000000000550000-memory.dmp

memory/4792-53-0x0000000001690000-0x00000000016F0000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 0583303a98f5806a2763c7e05c4180c6
SHA1 7d8d83f0ea40e8783745e72a931342b58b6e846e
SHA256 b32ef09a31429d2aeacc27d103ef67726c5060308520a347121597924b1fefa0
SHA512 b58a553f324f33ff2e2c9f4ea7f1b43650193aebc4636a2f19a5ebe0baf03e8e79092bc2c3835c6c9dc66e22f8ed86bb299d50ad9fc82df8c5196bbfdd1a14e2

memory/3840-43-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/736-235-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/3284-238-0x0000000140000000-0x000000014024B000-memory.dmp

memory/3840-239-0x0000000140000000-0x000000014022B000-memory.dmp

memory/980-240-0x0000000140000000-0x00000001400CF000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 b037274636763e565d31cd4cf110308d
SHA1 9d0a5e2fa3a0c7d778ce2e1f5f91b3caa719e684
SHA256 e2f07f5567e949d6237f545061564d602fe5771ca3c0f771f86388493a29950e
SHA512 7168207bf98de9c99192853c43b13b67f4aca021bfb6de7d27d5ac72890ce34482238b436ebeacb2c43df5e57021316b4b6e785823a8ff4f00080bf8927d3963

memory/3964-245-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3964-252-0x00000000006C0000-0x0000000000720000-memory.dmp

memory/3964-246-0x00000000006C0000-0x0000000000720000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 86d6edaf0185fdc9e266c92b84a7a6bc
SHA1 2c34ebbbdc3b51b021c917cc55fb461007b88be9
SHA256 5e81389074b7d615ed9e67e2e34c8926b5f4f543c46c2a13105c5b3622839786
SHA512 6cb55db4f22f03ed0eb717fa34bf1f10e406221a33d36703d4a8b32200856df168f0adce15ff2bbd8278a89d609cfbffd17d5cdddf47a3850a5c43553ce5d6b4

memory/2384-256-0x0000000140000000-0x0000000140135000-memory.dmp

memory/2384-257-0x0000000000EA0000-0x0000000000F00000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 dc275d81c9bf3be7a25aa387a982874b
SHA1 34f5df857595c56994444d510cd2c6e292507555
SHA256 7a728b43f4e6ddf6f8670c4ee2a58fe9dc5baf6759da10d576ae3523c4afbd87
SHA512 4f335cd5a2e6716accf5e15b23c8e97709092c6512327d468d43ee70441118d3a9e733395bf5edc20dc42088b06b6d944a7f0f7ca0cb2f6849bcf42159ec659a

memory/2384-269-0x0000000140000000-0x0000000140135000-memory.dmp

memory/4524-271-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 1cd0c9b12f868ffbdaeb19e61ca2a5ad
SHA1 f2d98293a472be60618e81ca30c52aac54d01c87
SHA256 270db7315b3d1572c60e775c2c3b4362d987426c09a9d4d636895cfbe1e4ca0f
SHA512 e53a57e5e2538687d6dcfa48128ad75e947da0fc6e46999bd0400aa9fee98d627bd3552a22dd0ca7766f2583c449ea3e12e949a165c68e116decf13d9051b86e

memory/3256-292-0x0000000140000000-0x00000001400AB000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 9fcb334b41783eb850efeb0d82a20c75
SHA1 a6f748fa8034a929c4b0674025f19245d182d5e2
SHA256 5f88a65a0067916694dce61cab3f12fed2e40a85a53a5203e98507a9c0cd3b9c
SHA512 4d968ea6e6716e69e8e5082d493c7ab0852c29a490cc9cbb19519bb30ddd132060ca18d9b8afd2086cda93ab386d7a9160292dc44c9040578b4176b6b681df57

memory/4264-298-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 b65d720a3d31c72d2ce9a1cab751e975
SHA1 d2c37fa6dae8cc126ae802fe94441dcccd1bb373
SHA256 e0c9bebe6b4059fd12ff9f4e1f79f6be2d97eea791172d5654191ab8fb6ac8f8
SHA512 de5a06eeb54d1e7bb64877fcddfb202c40e64080866af2a9b59ec0647bc522425fa63c2f5d2d70fd44c30295f6f0e135e6f9fab86edc73dd3e95381a93aea91c

memory/1856-300-0x0000000140000000-0x0000000140095000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 2892062b3e4a1caa0e401fd2d957086d
SHA1 e8a1792848fa65c6ee4b44bbf5bc1211e581a04b
SHA256 e6205c2b103760b385b4b39e5ce7c236147a4e279663b704cd6a5b6699b0060e
SHA512 9fc0ce324495fadd470c5fc0cfb35020fb3ca1740a76e0182b4c346997fb505233c147d048091f55683b95a7b3d73bea8d2ccfc20a87919c1968e740c96716c0

memory/1492-317-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 ca017206d7c0d77a2a5393c5c158a6ef
SHA1 0e49b17a8bc5021bfddfc48bb0852d139fb89df7
SHA256 ac9324ce5b6bbfdc59c14b079e548529e5684ffb8fa4aa13478d89cce63e7424
SHA512 2e6cf2ab2c6490abe31911c36e7cb2adf1aafd777eb521bce833974d099bbcd93e3bab68e5c9a28fa93891e3d67510661197ae0ef9d33e88d4ce7e62aa3711c8

memory/2308-331-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 8ad13f13424d3d5b2e1ff7156dd3ddec
SHA1 9b5ab05c323c6275bac4627d1a95701425debf2d
SHA256 c8a2220949a4017604a40c1b75fb5ed43496b7b74f636185c40a5b61dd9156dc
SHA512 cdc087217c4e9c95cc8c61822a9661bb50c9c890bf29ec22307cbb2a35903aeceaf82e7d650a32c11fb627775fb24883be84399bc17d740810d85f11e91a4ef5

memory/1028-334-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 2ac570b3fa1121b38db17a69896ef366
SHA1 e834940c08072b2cc39a5b6d54a5346f79ebd3de
SHA256 ec044c0db78b5eb3e5e7e45910b907a1a64722f318182097bb965e2f835b3f4e
SHA512 fe1d1f2e3f38e28a6429b24c1c2451050bd2896e896d9a11b1b790c29a9d36a06aee22fbaccc3a42c48b02442db804fc91e1b57a9628e2ee02f611882badb5fb

memory/4084-346-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 fed0eccac441f63f087a1d23bca7c457
SHA1 f6a093a620e4a656115b18c2b913c5200465097c
SHA256 0cac897608fd955566305c2f7701667255536d6ea29db461c748870c1d788255
SHA512 2fee8675379c90d0539beb1bfa10ad5d3c9077538aadab0fe440ab8003be16e4c49704c8c97924239139adc4027cc5bd1d95ab0f8e9b555d889bee3f510185be

memory/3964-363-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/1112-366-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/3692-375-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 08ea5f6bb8208cca7a55e21ca24a2cf6
SHA1 3e552e77359da9e2a5b4a876bb20713801e504f5
SHA256 35b6aedd1e7bc8ceaa4f43bdf6460587852222dc3bb7259726c7f7aaa26f60ac
SHA512 0c0d1e05338513cf3d37d2e754bbd0f86f04f094f7c5794b228cc2b3cfa1cee52ddbd2d824281ea18e71e9a19c901b30eda83a488a6940b96907227239fad41b

memory/3692-380-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 c45ac4dcd0d99d5b9994bbaa38790cb6
SHA1 0f05a4ab9cf5922e8f27b9934ce8f9bfdeb199da
SHA256 0421f76ebb5a833707297cb752f667d4de4f5aa791cbdd04e69f306cc53fccbf
SHA512 dbd624ecd3782c04e9a75f1ccbc984a906df23bb83c79041f44e53f2c7ffde96c547042e3aa01a91ef3b0be6f6a46a86a1c7490eb05aaa0d462ec10bc93181f1

memory/4524-383-0x0000000140000000-0x00000001400B9000-memory.dmp

memory/1000-384-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 b18d5eb31ad432bbc434752017569265
SHA1 17bb45e7d86ca03dc1eb7584228917e45964598f
SHA256 f22e7eb6cf7fba24de6b9800cb50a3c8db2e533ee072b76384a2b56de2f0996f
SHA512 a0c049d478bbef01980eac4bf93f3f5cd7c4ff67b03e0a6cc65142a2131aac015f5731658f518e85ffafdfd82fe48856c1562b9d0a75ac9c442dd2a014bccef2

memory/3256-389-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/4648-398-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4264-391-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1368-390-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 f3fa4a28a552136dfc1bf64bd8bb0a9e
SHA1 f59aa3ca8767a240fb904ba265e9106b32671a98
SHA256 441c1c72b3312bdf83a1a6e265924e8d604801e69fe6d5fb741bc875f0a7be7f
SHA512 974c87a4855be6e3087ddb966b83654f71fb31783835d5fc356105f7bc388e3c67a55a76389d24c7a3eb1c20d1027b94187038fff35247351ec2ed35ece3ce39

memory/1856-411-0x0000000140000000-0x0000000140095000-memory.dmp

memory/2304-412-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 e834a3f8fabf70ce6c1df1a38dd99cdb
SHA1 4eca704b69a45a8bbf1fc0159b40b68e69280fa0
SHA256 01bf3383b4b284493e9b44cf2aa12bec81f2ab82e18a6b8f773434c412d12070
SHA512 1dc1291f4654ae4c542c6c24ffb903e639b75e86ef8264d9d75f4fb3dca35c243e473c125780315d40d2d297fd899ff986038ce7c064515c05cf6448c5082f92

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 156723145c886a8fd9bb3ab78b5fcd88
SHA1 9a53009c5aead584fdd1dfd61774e599bdea77fb
SHA256 ff3065efe705827e4ed6f346af33a401a878033e20ecc03b1164641fe6df1b6a
SHA512 28d281f06108df1accd0f15e9e1ddc4e20bd671b2a36a1eb675b08ead932d8f0a1d8ae5d2b70f554d9e2b2117621ace237a2261966bb30a352f59a74945e9e90

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 7a3621d0175b42817840fffc951464df
SHA1 ec78bbd5b369576020a986815d6354ebfa3e10eb
SHA256 c762752de2c454ef30813be3a70c3de3e2f1d06fdc6ac10529d7a4f573faf544
SHA512 9c9c2215bc2d6b4005b914c75a497fde1b8d9615fef0736ce540b690d975bb37b07892cd771bb763d117270995f1d1fee5b4157da93e2472f7784d0581b45980

C:\Program Files\dotnet\dotnet.exe

MD5 9da9b1e866688bc71c5954e027f9c47c
SHA1 113e5eb460841d88189c9634e4bce385c8b39598
SHA256 73fed9e411fbf27298b2571f680ec3d823ddbdf82eacc0761ed7d4957d997d98
SHA512 f6e1f0295ca4ae9dd38218fe5d95c725fa33c93f8892ed8b0933c98d7f5b14230e0973a8920a60ac6a5d7ac9cd1e5265f27c4f1f8d6bff0d85c72df6365d7c54

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 88dc063f4705f405cde8d0c875bc3968
SHA1 0e0c950906ee56de58ca29b5af9850db3130214a
SHA256 2e6ed1f5125a3d7ef790a0b03c1d921ec4e126bdae5ddd85115cefb633ba531a
SHA512 293e01a424fe7f6f3e7abe42b87a1d7a18884845a93b0dae8687b7668411744c6410a9d40d345e295244644b27d30e5fc39d700d5155d8753a15f132b33096d0

C:\Program Files\Java\jdk-1.8\bin\jps.exe

MD5 512090cdf83de9ed377245cc40f339d9
SHA1 1a36edb7670c860eaa2f900498e5802a7f5a0328
SHA256 8badd41e9354f3963fa88f37491fbc8e03e14d65ebaea85685536f6ba72b05ce
SHA512 7ba937e246f40e9ee3ebb02a7bedc2eafb0fe692ea7fa088807806f6ad08beefe1e6a716c27c5463b344bbf765728e119398d23cb1316a7bdf040157132f4957

C:\Program Files\Java\jdk-1.8\bin\jmap.exe

MD5 682a9c23a9e4034a32628c2a17d7eac1
SHA1 ff269703643da7a4ee64b5d468a3380582144b8a
SHA256 d0558392f79ba0a0a350ca5a9139510385a226992594cbcbdfa982dd3be66344
SHA512 c5e1624ffe8b4f80278d4471938e5b28c9f829603bd2942a91e4c0c536cf586d9b1da65ab2c4fc0432c94a2f3cafd1a764d77739e0f277cf01cf9afa7031f1f0

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 0263dedc2a2e974b4eb427be930e88ec
SHA1 f49417ca26ad37d52e907390ca36c9095653bdaf
SHA256 e137a54c29ae154bf84be3af93c5948dc11db09e6c5e1d86a40370c73346684e
SHA512 bb25f640d8e6c7aed4fc924980cee6d7242eeac1b686a847940c197fdad7aa963ad3e3b0dd6ee99c4ab1eb02eb56cd9a9afcaad7d54c73ca55328beee2c55181

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 fcc2aa70055ec3dafb951aa8edea908d
SHA1 d2cf19c34f9260ec3975893bdd88fc383b108374
SHA256 9605969b2e801723381e7e8957748be08b30913ab672eb4f0b61d97f9331389f
SHA512 d9430982ed0fdda3e1780dd817494cf8402a53ca45a8d0d135a7df0db903994e47d14dc1b84f0d8e428839a1900cc36526c563478b6e23c51c36127ac9dc87b8

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 6ce4a5cfd849d13e6463883ae975244a
SHA1 1942232cc0fc488f5386e597ef21ff8ef1656c2f
SHA256 eebe7894485fa8dd8ed0378d600db6d6699a95c2eae4860d1425071b5cce7a3f
SHA512 75a52c7dc1f873e6f64aa71c690452af53afd1e09b392be71458a0c8e67eeac892e1f8510eff07c59fd50526852a8283093b5ab113e91bbae5d7b9ea2a3cf945

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 aadfacf856456dd3fd85dc5f1cefc9d1
SHA1 79fe6f191670334654df55ac31a5c1ec26665823
SHA256 db723cb30b0e756d5559687d2a43c7c5a3ecf3de36300fc63f86ca2a375df545
SHA512 6d48b9176e3eab7b039eee4b2005217f9565c22aa50a8b5233ee792bb7251444e092d278cb95387607d4d2c546c743be82becf87f3adcbfc7e83c9db5d04e1ac

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 4417dddff4aab7bfd08ada285317879d
SHA1 1a23856dd1f6222d43bd7b16cd542f83bb6dff46
SHA256 495e3d169b33cb08bff41b371362dca84a208f3d07abac758b2c532a87e7ca63
SHA512 0b36c3c316bf474e47b4b0b8f0e9186b918d3cc36819c467e094ff921244f9957aa908d1bdbebfe3b10188570b4984f5094195ec05ed56f0b1ce816482423fcb

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 3851ba1d0e9ea77002225cce1ebc1997
SHA1 7cdd757e3b72ac93207264e0df45af751b553350
SHA256 5a208b699bb3b27f02c28bd8f818ada283a183446d0133aa00e111a74fe248f1
SHA512 df486068500fa8632900b960012d19c79f6962941431cede57df7d8daff0d3269ef95b6ce744e9354f0a4ffc2ad95fc5cec6471eafafa28f9130003e6cb36a95

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 2fe277d488ad05670106f3d99483453b
SHA1 cce7430abf8fa73eb7d0995ceabb80974a92b4ae
SHA256 818b9675f05688a77d549ba85f9083e2eb5b2d7b9a1c95fd73fc865542517cfb
SHA512 700acb280f3d2781326bd88761d2a396932462f22097e7c809d80402212fefe710a15e51989dc6e0d58e3df7882de93fe25a052b97d829b3a636e7f6ef8e4e43

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 2d03730944ee0209436edc3d725814e5
SHA1 d837279b27155efe4ca8935f26cb7d0d9387da7a
SHA256 9abeab024b42f41315a234ccdf2d5c536bf3638c7a10f1e4b0cb846d47fead2e
SHA512 ea6592d9544443b856d5e317974b3401adedef386be2087c49e3de8620d86e966f2b20f9ef3f2bf2bdca800e6ac1f7cb7f9d5e0ffecfc94dd45c8a860ccf9354

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 8827ad1a0979e3c27e18cdb71a1e9df8
SHA1 7157ec5f8a92e55d6c924364bbcb25bba855e673
SHA256 a53ba3496483c0887460ea284faebafcb40254b9e0a061273247b83c2967c95c
SHA512 885eadb2b19e775aaad900991e3787522d2aa727001f34e5aa9f45e45f12e1a692ffb00957901b4f9dca3d43ff83e59650f0dbb8ce7f58efb5c8460fc0ae09b0

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 849f939690583a95533eefc41ecaf698
SHA1 b1e31bb5abfdee6522d9eeb81ec61caf788413d4
SHA256 6771122b8991edb9473ef717b1248e56fc8804ef4f7abbcc16cc32544ecd0721
SHA512 2207cc0338ad38e726a201131b15842bc439819c69d4e170b33d978dfec33988030ba6158fc2090bfed3db8ced553bc3eb4edc9abc59dcb78fa47b4d65ca322a

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 f37bfc1c92047d52bff2a88984da7e18
SHA1 bc39ca637f7d9e32f004b5eda25cd7f326c90151
SHA256 bff9a012e9d7371dc33f9780efb09cce41ff544c6a8f593583b87567c0242a05
SHA512 aea61a58442fd07d3cdfe6326ff1eb145b1ec2624a1763ddbe1c96a7a0d2a68dc37a46a742ba873bb3c2b538dcdc48d255c59e6d3188d7b6f21851121ae5dc20

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 20e36f3935ca1347ddeebea9bc45f47e
SHA1 bb803707b83d5f720578aeb292b6777588552b39
SHA256 1e214293ef0bc5a04aeae5f3ea641c3200831a818805738c8f65f231ac5d3356
SHA512 e0b6e95f1ca2f5d65d57823a0dc36a0812b20fc5d677f503e5bd84e702efe28173cc914895e56ac00c31ba0fc29cfc3c0e7dbb7115bd503a386dc87ceacb742a

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 629bd686066f148dd735bf27bc42f1ba
SHA1 ae4b9d02488a5599044b6e932aa3a1990699da78
SHA256 de5ce1ed276d65a227bab08c215f380b69548ac012cc6ed396c80d0af881de64
SHA512 d0c5c8dd70cec9be2d1bd22b4abd7c7e27c74b129e01c6280e258424025cc571613205401b1992fa406d49ad68e29bd091500c2805ef795c6f11d7e4d7c031f6

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 05ebd27437c63fc95758c19226d1d3af
SHA1 c5eb642e8d29eef732d76655da1d0645e1d92575
SHA256 2017fbd7fad740c57aeb799434a6a75efb74dfbf251422b751a2619ec573cd83
SHA512 1d6e44414569d34ddb26591193d1c0b0bb50a6930e27bd41dd25839ac0d881b32cf95dcaace66c22fcdd41e0547bf1c3630d9c6bde8cd7865076ff37c23b0071

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 733c6a286ea9b643b66b96b7495d7dca
SHA1 70499a0d4547324699bf6e69e789068ccde04fe5
SHA256 54c83ecd1786e6d3623c1e98ca761c52aa287e41bdc62a30dbeb562106d35912
SHA512 59d567f895d8485952d333b7a41cedf64d373ae4346128486884f33a39b07e4cab07014fbfbe4cc62a0aa538534aeef4a246a2621c8f0c1c7f55a9ce2f9f9a78

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 b85090f56812468616a83b2c58e21971
SHA1 c78220563b14d80f932a94f410bb04d7fdecdd9d
SHA256 1cdfdf089698f817cfabe1d372b2cc6aede1669cd42523dec58d3a93b53f96a5
SHA512 8234038dd8c93399a46b80585e1eb53101c316e7d247131e89f19050906e617a0dd796e9d76ce9e7963f1e93de33e3e658421071c6cb1171facba734ca83603f

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 4b91670cafc812a81b6f339b8c13be01
SHA1 fd99b79b3dc4596a01448943d26b55af5255ff10
SHA256 ab1ea8330c6d6a9bb7b34aea98d9647a37b8904f276990b7d576a3c00dade67f
SHA512 a5a55a663f112a2aa6511cff57e507969eb4826396fb281b5d08b50fc31d51dadd532728b94d583c746c14b8a21fb61b6d7ba6f5c11b7d9d9c43ea3be55735a1

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 9075c545df4fb23d2269e46b40f60fe6
SHA1 70da74d34170d183c13704ee9de5965629bfd5d3
SHA256 6ce694f380001595a6d504c7eec6318f0945092ab713bff7482e3cb798531993
SHA512 8ac17cb79f681a4597850a232aeaf8dd9aab3cfd64af8ad7cef8d8bf157a2ce386c5b96da6451a040bb187244e4203f4da86e806399f339526aeb9070d967da4

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 6698a7312537c7225f1204cf047dd23a
SHA1 78f0cfb0edd0562bfe146b77ae6d31a21f342483
SHA256 d39e7ad6b713096f361e6a6ea09c80e5adc523cec59bf4f1d75270003c84d757
SHA512 bb3080ef8590a241b92123193350bdbe08ded53d4d02806d7e1a1b29dc722ebb5966aea82ece2a05c273062237a7a3b56716f601083d4483d6f20f742fe18959

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 49dc021c4ac28085461b1e92d5f1fe2f
SHA1 1fc732d83d1f68cb243cbd8871c92f0b2aa58720
SHA256 0ba5df865223f7a02194a6c60ab3d03b17694a8ae7964997c9d8e675871dd3f0
SHA512 3a8f8049d84d4bbe642b71ba0bbb7c89c78e0db266b22b11d87ae8182244d63abeecb790af35b8a7df0dfbf5c7bd8439fbbf7e7328bf4f3c203bea9b2b949e9a

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 511f22122c01ac2bdf57fcd9f9ad6a90
SHA1 307292a51a61fe93352c0888f4c9aeab47f56d94
SHA256 5f13b3da18d7491989edbd3424a43c0db01b7d57f5e44e80291b620037e6788e
SHA512 f18c614d67dc62591b461630aa06883ed191534955ea258b73c8c130c310173620f860e2b35708865c9f76df2a4d33fdd9e24771cee1b124ad043323ba3d5d26

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 97eae2e0f76e00d44d6e218f106d0a98
SHA1 8344e5d34eb8e93f73ee7bdd9182a185f3a2bb34
SHA256 f95894437f6c5eb6f7ed7b47486aabb87f46757f925e914aa1fbae79d7de3663
SHA512 bac09a1fe46da281236eb1679a2952a819a597740b4cd0bb2793d63a918d1b056b90fa051129e60c86ed62ab2bc0bacab5ad6456130f6f99979bb17a6d810d0f

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 af2ed775531cb61d49b981b1bd7409ea
SHA1 de6cf5e2f34b4b16c6362fa55565e41d838c7d7d
SHA256 6d457a18692d98c423c4af837da0132bc5965497280576e88e58a574ae141b2a
SHA512 e9e22fde94c1cdc92827f235ca79d76cbbc634d2e4b7e24f1cef631b43687f81d6bbd48765e0b67f7cf2c8092773d25feba12bc20c41cc066bc5c67adaf9fc26

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 716f824edf0bc4b8ff6c683d8c759ca7
SHA1 b77d632e3b32ab2b8f2f302c58a3c90f24f4620f
SHA256 481d5ec671420ef6a0a3f2c8080edf5171c2d953bcdb9e2ec13c996394ad023d
SHA512 1bd5466ea786f88a7280d97731a7ad9906c5e90542c9ef8f09e7027c418237d837583daeb33ffe45ed5c51a8fd941c7b5b9b67c05988855fcae9c605d10d84ed

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 f1beb067fcf355e02ba5031aefd0e2d0
SHA1 90f05f4c4c1785755bdf2e8bce74b4d4cfaf580f
SHA256 6516e69754cea01bc7532ee30a0c0de23f9c4469337a3dc877ab4c71d548acd7
SHA512 a39591c743258e14fbb675b682ef608ccf92b254ff6aed377ecd6457bc746f3208df0e7b280e905f16e17cd39b123fcf8eaa4c0690a23e69bc8f5ef4128f40e9

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 e028645704bfa69dc5c5665a3b2f0cac
SHA1 27b7b69fe91d251674c38036fbf3b0910a00d2ea
SHA256 661ee3c742e89d20ae0b1742e031d1d36b4e46bbab611ee9da054642d9b0d737
SHA512 ef26bef55c6f3b68e2f0ef91a63679a60c31b34fd1df6f140b006ebb2061497d1278f5736b479a39d3723bd7ffaec828603b66db9730ad48445b51f8db62475d

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 7c3f6d3610f319b238b200d2edd029bd
SHA1 4693453c3a22f65554184aab1603426ba672b6c1
SHA256 1c49ac4833e7053822175f16dca5301b327ebf7998e66779a541d7609029eda2
SHA512 8ce7db00a5c373e79d999d4afdc3648026c7c3c59cd97b181660cf999bf6a972d215409adbc35993438813fb2853cae81329bf1c8e190d09efbb765a26b3ce07

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 1113c7ff827b457c48871c8b07a6aa5f
SHA1 eca0ace648c123f12ed7a1b614453c32e5fa2bb7
SHA256 064eca120877b0f5860d4afbeb56359575ba4e23a6aa406f2bae5f4ef567b47b
SHA512 22b2e34f57dc944c8569368f270255fe0c721da346aa8bf1fe9d70c40948bdc05a941dd28b7727a03925297b6ca6fd883891b3fa50701ead014a420d921af362

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 462928224b490a0a0a729b02dd566f73
SHA1 53c913c864bf949a7c4c2a9b4e53afbfa7203906
SHA256 c5ee985f7e86ed3adebc8428251a91eb92b26f6a8eb0904ba2e9ffbbfb017fa1
SHA512 411fef7ffa3e115e0ae2b5e0d79d9a6fa7a3b778855883537adfc737e6176b58c6707743fe4bee8d2674e3f4fd161b1bfd79b6879076ab1f5304e7937bf4c437

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 104e174715e73285909b9272245d6ec6
SHA1 699a54efd848b2ada3592b2e595f8e15ebfd4bb5
SHA256 6edcf0f53a024bc2b3fd169ca47e2d960b10f9b5b7ca54e6630120257c5e51ca
SHA512 1db230b0af69f7d9e114e064ee763f30c2d04c12e60d23e94e6a04ffe65cbd0d74c4a63c2f6c5c1fdb7b4012dcfa152a9226b51d1c4f7f8f22716dcaeacc5b69

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 c500f6d1c4df2f7d5741e3aa1b394206
SHA1 b09f2969f7aff50c79660a15f66f4af358cebeaa
SHA256 bbc0b071c46d99db8ef4b2b78f161f9a3e53de8a212c768a6dd916f752cb90fc
SHA512 e3d8603f693e36295daf731d36d9a18b94f7f7338780d1b7d108ea235f3ccb094c83ce23a7bc46f5e3589d470e6ea1012d9c94633a42fc540aaea2b3b9b17861

C:\Program Files\7-Zip\Uninstall.exe

MD5 594b68208e355dc0d9896eff9ba92844
SHA1 520c8da962ad54d031851a95a59b7b6e795e72f0
SHA256 d9eb3157f476072f548f35dd0426ff4cac4926aafcbd9fc70dfbf7b85463a99e
SHA512 e77436b02f1751adda052581f9314f8453c62fa66f44ee62c2a8a3c497f8feed681ea171a0bdf9f3ceb9511dbea12e1dd78fb1413634b7d1bb6e3f1154a1ebee

C:\Program Files\7-Zip\7zG.exe

MD5 772c8a58a1abe5772488f369b95e4f9e
SHA1 22f5e043a09aa1574d63698ae69aa39eeeb62766
SHA256 d9515cf8b86ce402ea28e00663e0fa205440ff44e0eab181f52e2ae66df81fcb
SHA512 da8bc1dd7a080299356365a16b2543b00092b3ba1cc400e57f4116e8530f640549976f91ec68cba29caec990d06e92a468b09c2a47448c56a3888e49cceaedb1

C:\Program Files\7-Zip\7zFM.exe

MD5 b035424821f9078f68c82a94a049ddb0
SHA1 9c2c197a290d412bbb017d8314b201e5be41968b
SHA256 60454b30306308edab979cff320b32776e68730a91c8933c63348ea001bf3456
SHA512 0923e5f4b155e3a0f10e0d08587deea063595d81b97f14d6b5bde88fe808596118bee3da7a8f598528b507161cbe4f476d7782acfd0d4c7e00c3a375ae325f19

C:\Program Files\7-Zip\7z.exe

MD5 e5b8b6ba83a60c3e96e1be3a1a156b63
SHA1 7de4993db4697db46ca065b598a28960873bbd49
SHA256 a2b170480194ee73566311510abc0cef60b63ef8ff30e08941ce120fd17995c5
SHA512 23d7d47211bc65c5abeb1e1c69b29382b324e2534043ceb31e3f32874d7d06fc1837a0c6cc775b0ae5d104b931e6780ccc3fe65c201874e2f4cf66366ad8832b

memory/436-428-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1492-421-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2308-516-0x0000000140000000-0x0000000140096000-memory.dmp

memory/1028-610-0x0000000140000000-0x0000000140169000-memory.dmp

memory/1492-613-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/4084-617-0x0000000140000000-0x0000000140102000-memory.dmp

memory/1112-620-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/1000-622-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1368-623-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4648-624-0x0000000140000000-0x0000000140216000-memory.dmp

memory/2304-625-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/436-628-0x0000000140000000-0x0000000140179000-memory.dmp