Malware Analysis Report

2024-11-30 06:36

Sample ID 240612-w25fdsvekh
Target 2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch
SHA256 3118301d1e8a265d92c26a56630a30575847534f2b3ecc3f4de5bc0627b6b4a2
Tags
spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3118301d1e8a265d92c26a56630a30575847534f2b3ecc3f4de5bc0627b6b4a2

Threat Level: Known bad

The file 2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch was found to be: Known bad.

Malicious Activity Summary

spyware stealer

Detects Windows executables referencing non-Windows User-Agents

Detects Windows executables referencing non-Windows User-Agents

Reads user/profile data of web browsers

Executes dropped EXE

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 18:26

Signatures

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 18:25

Reported

2024-06-12 18:28

Platform

win7-20240221-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe"

Signatures

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe"

Network

N/A

Files

memory/2728-0-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/2728-6-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/2728-9-0x0000000000380000-0x00000000003E0000-memory.dmp

memory/2728-11-0x0000000000400000-0x0000000001D2D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 18:25

Reported

2024-06-12 18:28

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe"

Signatures

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\snmptrap.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\68d9cb2c293b476c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6a0d734f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017e17534f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000022ae134f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068d02434f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba6d2234f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c1d5234f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9697f34f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018df9434f6bcda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 23.53.113.159:80 tcp
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/2840-6-0x0000000001F30000-0x0000000001F90000-memory.dmp

memory/2840-0-0x0000000001F30000-0x0000000001F90000-memory.dmp

memory/2840-12-0x0000000000400000-0x0000000001D2D000-memory.dmp

memory/2840-13-0x0000000001F30000-0x0000000001F90000-memory.dmp

C:\Windows\System32\alg.exe

MD5 2c88963643f127205f1cd65f629418ad
SHA1 0aba37185f4e947121d86392bf45a60027e5747a
SHA256 a61c52ae6f3462bdd60e9dfa9d825975fb32125255cffa3df9790b6d915bbea0
SHA512 2a8fc1708d737a72c13cc549383a9a43e34fcb00382b07a3e8a89abcd71b5d539bca9612beae858f1fba25f237506d9b0e2f487e1f3ddbeb758776d50cda24c1

memory/1572-15-0x00000000006E0000-0x0000000000740000-memory.dmp

memory/1572-25-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/1572-24-0x00000000006E0000-0x0000000000740000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 7ee5bb4237f126f55ea9b3042af7d192
SHA1 429e305bf0f74f81e1745cb7623c64950b3eb048
SHA256 ce16d238d416607654fff67fcd55225b6f3538f14c0ce3b4f9e11dcad9598de6
SHA512 f3091220e66a7d43f3d84939dfd660745ced0a31c9cea0d139b820aca774c3526c221d600d354efcc51e1c141cc7422b326019ecf388ae9220368fdc21dcc838

memory/1624-28-0x0000000000C80000-0x0000000000CE0000-memory.dmp

memory/1624-36-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1624-34-0x0000000000C80000-0x0000000000CE0000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 1f6641b440d141f5b87c92fe39837697
SHA1 9d41806763c4885f6d51ce9c10c6b3832353c983
SHA256 391c094bbaa6cb1a6ab9e191be1b86a2352ebe62a069d091fced80dddc70f5b2
SHA512 d4c7db2e07c8baf73943a9783355e1887ad2be586efeff0bfda7976d45177aa30e855b0d1de42e015b68529fdd4f0648c1bee10191e301879b383146ec3847b4

memory/1372-39-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1372-48-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/1372-47-0x0000000140000000-0x000000014022B000-memory.dmp

memory/1468-51-0x0000000001510000-0x0000000001570000-memory.dmp

memory/1468-57-0x0000000001510000-0x0000000001570000-memory.dmp

memory/1468-69-0x0000000001510000-0x0000000001570000-memory.dmp

memory/2608-72-0x0000000000730000-0x0000000000790000-memory.dmp

memory/2608-71-0x0000000140000000-0x000000014020E000-memory.dmp

memory/2608-63-0x0000000000730000-0x0000000000790000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 80f9b808e1bf9ff00d9803004345d861
SHA1 c78fe01b22347d9d519c3c7dfa7f8bbc60cf25b0
SHA256 7f2c220239cbd2dab32e1b329a479075748301bacf2f77d9bb22d7eadac82d57
SHA512 e5c5159fcb8e5625065c1e54bfe438531c0a30d36147bfb2c461885c31e6069a4b331097906b31a0381f251e205c29bd1242afe3f5a4d99711f0722d44629c31

memory/1468-61-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 22733601ab304f359c11fb456fa1f7a6
SHA1 d4eb9e1693526b731fe15b0f670242d21611ab99
SHA256 ba8336ec993b0e9fc19b2fbcc6a249f09d366cd3042f36ab067a6d146e0854f2
SHA512 5ce9438a771a52f844fa8f100ecb3d2ea3e037b3707a6b194fc4bf328dde7226c9bd85670c9c1d239f6487c64c3dac59e6ede96b1726e9773a1dd25a3ad67172

memory/1468-115-0x0000000140000000-0x000000014020E000-memory.dmp

memory/2840-233-0x0000000000400000-0x0000000001D2D000-memory.dmp

memory/1572-234-0x0000000140000000-0x00000001401E9000-memory.dmp

memory/1624-235-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1372-238-0x0000000140000000-0x000000014022B000-memory.dmp

memory/2608-239-0x0000000140000000-0x000000014020E000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 a1d5e1fb32bcedfbbd430220547bd857
SHA1 5cfe767dfa8e305c65a7f6b7c0cc1f4df3c0e0cb
SHA256 6be72720999cf7dc9c07e8f9392147fd7fa7fac4d26eea934e018921e05f794c
SHA512 dc03f4ffb812dabfcfead78796819d659402e1e518ccd656936427e988b5e2bc6a03c15989fec109556b075cae830f37cba46df9586f6e025bfd379e25168506

memory/632-252-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/632-250-0x00000000006D0000-0x0000000000730000-memory.dmp

memory/632-244-0x00000000006D0000-0x0000000000730000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 df5aafbccbf39d53666c349d8e125c42
SHA1 22bac473a09f7e7e6bed28380d4c81a51cb4e472
SHA256 1ee98aac9f163af25627ee18efd1da75e8aa82ff392d85da9a6054f18ffbb798
SHA512 51e633f1247293e1b01d8f8662b2af5d72f4bc892797d02bbbedef9951a270957fd46fd03856c21ec68c0cd1e03a24611b442153e5120c8549823e80dd35056f

memory/1832-255-0x0000000140000000-0x0000000140135000-memory.dmp

memory/1832-256-0x0000000000DE0000-0x0000000000E40000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 3ba0f122838e2bef1d468b9d8aca88b9
SHA1 83911ebeee296ff5ee1e47ff9dfa85762910c219
SHA256 4bfb839a47375fff367dd6dce9d6413668937078305f091c3fdb3013d94f000c
SHA512 2445ac1461ee378af8b62d2feb0c28f999343f460d6556edab5416ce9be3fc969f5e4c11674b2710d5447fdd786bf5ce1bc317d1965080618a22620edd577729

memory/1904-269-0x0000000140000000-0x00000001401F8000-memory.dmp

memory/1832-270-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 c74706bd5aa6c5aebb98f41d2e11d01d
SHA1 b1cd1d003431f4f149a8ede245e7583e5c0ac77d
SHA256 306d68298327703db1abb3be5d40860ced6cf462bb86d42e4d47c3093398c6a6
SHA512 b882a934eaf61fbb0be26f90b70048ced5f8d783cd701be04a7d5251adc349adfe188c68c84cf85ee0194a92f7af3dc92a3f6e21101b16c8fedb426901120f8f

memory/1180-294-0x0000000140000000-0x00000001401EA000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 7b6c9814b0287a166f6dd4dfc2fd1964
SHA1 311642eb2a5339dda460a37ae6d43ca2e45d1c3d
SHA256 df2d431c97e9fca59ba8392d1bc908546505c007640612db2b787090d527459a
SHA512 512fffc5ceb89385bb2f77680699d1ce7d7936b157b32cb0f7b1562439577bd1a45d70659e4d600650dd142dd8b86e545468b090688a855f63a60ef19a5ef380

memory/4776-296-0x0000000000400000-0x00000000005D6000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 c0b8f7d1dbe186947307e25c7152a119
SHA1 603456a26bcc9a80fb65760cdb55c59e96d2029b
SHA256 abbc02e596c3cd0c64c2ed8225673f4abce1d88b6fd56f118a29504a4333252c
SHA512 9d74b00c7317e5aef70c7fde25ddc02ef4d805f8bdc3f17f0100b2746f1ec2e72b95d210a9a0f7c9629702e006d29a5d7b195b80ce54d4aeddf2c0adbbe83395

memory/4004-299-0x0000000140000000-0x00000001401D4000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 565c58bd7bb220b2ef552b2533cb585e
SHA1 f5fae0eeede71175df18315cd3f7352f05b4fa4f
SHA256 ad059363bf9f2c1be070e03b5cfdce26718e3125607e86c3aac154e3c8c6d73f
SHA512 fe39d4305ed24608cdffe68dc139595440e7af76d4abae3b91ec964c280fd266d95b345a8152d23e67f62fe12bcc18c6059a6c2f3d69e19587e5db020e4191b3

memory/1708-310-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 bddb965fad45ad381c1b8029bf93249c
SHA1 411ecf8c4d71af60d0b0ea2ff4e977d602614461
SHA256 477101d9c1d6089bb9cb90802d04d4a1390d829412af5e9f1fecbc06d7ea9a3c
SHA512 98701fccec615ac88faa20ea8aa18893377adb97dccb30ad494bc6d4b1b27d22f583ed2437b54616710ee75c47c139d572c1c88381243d6a6bf8f2cf6b5d1ff8

memory/3996-330-0x0000000140000000-0x00000001401D5000-memory.dmp

C:\Windows\System32\Spectrum.exe

MD5 7970839ecfb7459d1f85e9e4f6de4923
SHA1 205f268048ffa13d9ce21c0c871b085cf489a3c9
SHA256 1ee23544370c29abb3dadd4781917944b186d917d8e680201259fb0311199848
SHA512 d541641dc41cba59dc0782aa9b1f87a03595fea336a5f40fb3568fb2fb356246db5e6acd78bbab3c0b0131cb65e27d1446aa84ad0e88baf12ed0b5fe7e4537f3

memory/3076-333-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 c3523ca408fb0c00838fe0a369175ad0
SHA1 752e82c49791998aec0fd8c81c616c0cc1758dfa
SHA256 9131f11fb1c9638ae22276fa5f7d5d39d9e5b61f45d0c5505dac38d82beb7eea
SHA512 52cb6f0eee0f7f49dc501dee5e5e1ce64eebb2429ff3a63e052e3e18f2d8c6c508cde7a3adcbbf496e2deaf98e8dc54294d1bd5d3f2f0397567d3224a905e9d4

memory/4860-353-0x0000000140000000-0x0000000140241000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 ff38cbcf027dcaa58e7506b45b1214b5
SHA1 25b737d82c7aa25ec816232dc260f5bae65fa2f2
SHA256 bf35338b1b1d67988bc931d9e42bc5ad15c902f89734efe3ed6df7a30bc98b43
SHA512 9c9ab426762612c6010e402cc2cad31768468c9dce7a77c849a550009e442331ff54b4c5a16d4ed00fd70c847988ebf47e5059b2499d5ff63857f62975fad74c

memory/632-356-0x0000000140000000-0x00000001401E8000-memory.dmp

memory/3440-365-0x0000000140000000-0x0000000140221000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 b2c41fcf4001964668494933d403f685
SHA1 242e12cc666a8ee91deecfc18c1ed668cad4d6e4
SHA256 bc9be5781dee1349e0f05f7ce6a41a2b07a30c52df968191ddeaf61d03dcbc46
SHA512 07a0498b87ff28abe035558c07fa9b8d06a78965368f8944a43ab5e494bc38094d9201014d694148334bfe55b9250f073d2113503e2a5851aad1cdb588189605

memory/2060-368-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2060-379-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 94c0296c01f57a209914dcc249d6ff06
SHA1 dc34bce065d600c8a1c69082c17c6a61786d1410
SHA256 dbedf5e96ecec3619067c53ba4a24472d91943e16b665f9627cb1ad067f5dca2
SHA512 4d93eb4d431038c260a9ed0cabe1245789631a72d69cca2d785fe2af3625fe645a6b6a23a5094ae489a7d591ac99d78527088d54faada3883c12db8b7a397273

memory/5008-383-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1904-382-0x0000000140000000-0x00000001401F8000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 ae70b274e89292ca278268fbf5d3768f
SHA1 46772dbfa4a50a0dbae93d11ca254aaf80ed0709
SHA256 da2dd39bee97fb209139f1005247ce281ae790250520a78c11e5511b7e9b43d0
SHA512 e49a04ee674f12fed4f29b270c12d21165cdd44f3401d652242435a3615174c2aeac2c49e372ca04a1d6191f11fa3dba69efe77e2aca437cb72b9b7240161144

memory/1180-394-0x0000000140000000-0x00000001401EA000-memory.dmp

memory/1960-395-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 7019f938974527ccc5318e3f33a5b96e
SHA1 86c4f682d8b08c0daf37a9e84e06059ba94020d7
SHA256 4def3faa17612c9912ba17019eeba0275f5c21f2cfeb89712e9835272d14e648
SHA512 ad10fc091f71bd6b4ef82cd94e10339d1c52cd2731baba5d7890ad638284f09225230d9550e52709c185a74f91744b3eb984e67c286010cf4ffacf17ed25e9a2

memory/4776-414-0x0000000000400000-0x00000000005D6000-memory.dmp

memory/4012-415-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 50c75373cc19bcc4d50586cbeaa36500
SHA1 f2bfed666810dca70a43403eb90e9a5792fd95bc
SHA256 5587765b02956c139335fe0fc3ad4942f1318d0ec6ded5f9a131a10d9d6895ca
SHA512 72731bf020c86f06e2dc77071471cb3c890b89e5ee9116b0c1415d54da3215e6ef510d115bd1749690229cd984f92912fec81608ebf6ba0b1360985feaf715ef

memory/4004-418-0x0000000140000000-0x00000001401D4000-memory.dmp

memory/1032-427-0x0000000140000000-0x0000000140205000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 934a5ed0442729f46f808640f274c1fe
SHA1 704feb05bb17d1235d67f72b16da0d8c200a0c57
SHA256 47338d203ba25936875f426a32a8b72015359f6f7d8c42886ed3678c0588f4f2
SHA512 bebe897d685efb9a0bf06f70b712d89deb8dfd376a9600cd2ed822e77428ea6f6d49783f8389b252498c0be9adae2a3fe86f8842dfc4231cc1f700e37d7de39d

memory/528-440-0x0000000140000000-0x0000000140179000-memory.dmp

memory/1708-431-0x0000000140000000-0x00000001401D7000-memory.dmp

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 23525052cbbaf28baac12a51329a11c3
SHA1 b7e2f1e65ade2f7d7b4aa2ea4e95ba75484086d3
SHA256 a76ce7a9107afc890c224fa679ed1bc423b617f1f711d70219370784f5b2d243
SHA512 249818035f1aa2b17eb0766d56a2cc4041edd2ec462afa2862ab8b98c252659c49848cb24930a69c8b9c8b4a000a99e87fee9afa3de694300221337623aa38c4

C:\Program Files\Java\jdk-1.8\bin\jjs.exe

MD5 e638af4dcb73cd6e5186ad93951c5242
SHA1 fae6385c90ce43b6b0288d413799e72c896f25d3
SHA256 e5bd516d6ced3e1442f92919f14b0ae745f07b9919335adb6b3254a400883123
SHA512 1290d65567c24bd34d811fa17907097ee435abd188deb60fdd103752be7c4cda3159e6d8a51790158ee2b973a111a94fcf9f0b1576399cccb05cc7d3cf11a99c

C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

MD5 c6ee24522d409748f7e322604e689816
SHA1 b1e0721d78d0bba5922463d558700c1aec0b061a
SHA256 9ce725e8e0d87c8e06494bdd1dbc39655dc7ae593e194b4e56800344c55ec440
SHA512 db8846a9b26b8af66660be217b104d7b1d3285e1993ccd706d7bbd9cb9886a21be0ca16cbba0f7fb2c97d37b368aeb2cf298da5136b717a29fc7fa1de4035532

C:\Program Files\Java\jdk-1.8\bin\jhat.exe

MD5 4b69bac80eaafabaa6b123cdd6828b62
SHA1 bf7fb85e45f3efb9b0b7e9a8d88aa54fa64d98cf
SHA256 9c64abb3927099f86de62f48408a4d0e7bd7bf0dba8334fe384de02e15079896
SHA512 b55e441e06d2fec1399469df0a9b6fd294d40cc87cc7d33422553b4d0526dd3940bf010ca63c270d24519e09d57798a15113721c92f850feee5a0cb80ae2c8a3

C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

MD5 39ac3c4164df8b96bf404d2381a9adb1
SHA1 84404582fbc9aed9fa8b159bdefc21a7bfe32033
SHA256 3ddff2d3a25b66b8cf18e62ddc98f0026e692fa8f75c60897e11cdc2b34a9151
SHA512 f0b916e25472494815a179a0145be6d2a2159674776dfba780d9cee87e481042448142d9e8d29ccdc79c9b47d6f30d33e759ba21e69b866c4e0d0c632ff3458e

C:\Program Files\Java\jdk-1.8\bin\jdb.exe

MD5 c72d9c49e5fa9a400aad12356d8e81fd
SHA1 d5297c95422e3ddc215eff96a7976ef293714ff3
SHA256 b7577a99f2229b46f199e25d0df375144d2d9b44797928a4202c06b4a107051f
SHA512 ae2bae40e74a5d528e7ab8857e5828a20764eda09c5a28e0d276bc43b0217d5b1693ab17e84ac1396a851063a4de5ac535ccd612b0cbe9a209e9540b22eb3952

C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

MD5 ec49b447aa750795929014c036770c8c
SHA1 2be328630c722b32fc3989f24bf11a813c78a205
SHA256 7b9affcbfbfadd599f67d2e75d8da901338a24d295678697cb7633fa4148a288
SHA512 f733ce45ccd3c674132facd9d7cc3281300db2205b22935c38544c0b9dfd1f61e2bf7dfc28a8a55ab399efbe457c7e4eb6a2a7dbdecc47c0a82f9a78cbd402f6

C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

MD5 f105ac06edca92ceff999e157eaca469
SHA1 a585a78d4e5e42a43811b49ac3abc9ac2b6437cd
SHA256 2dbfeb96bf04fc940b28ef2716cb290e027f2f918e3fbcf4d0fdd1ae21950b9a
SHA512 9245e0d261472758b30b9cc591ab923214b8e357ca8eefd505bcb428806a72b02fd9c23560863580ed52c162407453cfd001d9409215856b79cf4922916ec8df

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 ea9072021056e6b3ac61b1f9b3a07993
SHA1 ee93cc93b65304e041cec1d73f8ac6735c7e190e
SHA256 57f6ff74a2a2c18d5de05084486855df8ccab7a81d7ce936567ff588c0d330f8
SHA512 95fdcabe7b414698572bdf3588c5959985afb54379030721695a45851afb8a467b38fbd47eb284e468fb9c0eff1633dd89ef3ff0b777cbd9e8c950997a10822d

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 609654476e024e253191591d3e948dfe
SHA1 198893f67ae579667916c046f0e5fd16db79c98a
SHA256 3b4f63edc25296cc060283095fc47f6d2652264dbd94086d8d3bc9d1e50097d0
SHA512 1490a247f9e6e29bed8a017effd62660a36188b6bf896e7ff13620bb5dce13f2cc2bbde760de2a5387a3783e1efb18fdde43ed447b63321cc3bb28926807416e

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 7d56a594b50e56009da83d8214ef8b3f
SHA1 88cde64bbcbbd99a90eb85cd3684acf27e50d417
SHA256 c50b221b05a464bd05b6dd4723e1ffd2f838a16e296b25d4a6c1bfd2b03f3174
SHA512 edf585a4d2f34fb4ad5435489bc5fd6569d5508222e4e01c0dbf791e8b274b3f28659108f60da7866267a6ad4f1ec88491a54da3d2c3bc255b40a76ab42c6fa0

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 ac67ea79fc00744042bfdd72f14c4fa1
SHA1 587b7fb622e18e8057ce729f38cda94966a6afe9
SHA256 e5adc6a27cfd4139694a39c3c812ee2a38aab4174288618394a7ef46bc742ec6
SHA512 e9425c26a34337be032a4485577a612f50422cc59b31e95d4600c8d38210e7d95c6c6db5d9220d781b4babb222910012ee85c296c8e471f2d973d84bf968cd34

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 df07ee8ff0079064c8f185dda5157a4d
SHA1 a25457da48213a34a1d6bc35bfd52f1917be75e6
SHA256 a420799c43b7dc24843b38ff9271ed358f2ca42f4ae405090935852b8b2eb85a
SHA512 1e2acbbcc9932b417af8b44d3c39797ee1c44cc2ee68fc851a87b1e16d9e011758f698ea4add779a62c5121a885ad5cca0882d8629c8654c403f8965826a46da

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 cf02237e598fa428e5aa22a7b8f660fe
SHA1 96b4e57615dcad3d1a4518d19b4a1f1d811e2688
SHA256 4d74239ed720472983a387d8e062e6c9315154c8c17a4d5d6d179d231697f006
SHA512 07052eb192e4aeeb991f99f6cbb1a547bef2a2203afc691f411f1a799d2e5d5ff64b5ad095b044d10028eb7edfa8f31e970c3f0c05b0d5ad1259d26e2c0ab6aa

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 2f913e1d9d5870e6f610a40865025e50
SHA1 a66a0f54c5637901b8ea7cf3c4ce0b34e7c966d8
SHA256 da2c0bb1af155530d33fc72c2db7d5c2677ecf516d10a737e49b9780d39dd29d
SHA512 9e4974e6a5d6127b2d5bdd4d40000c77590064e81b2f672305f4ea84f8ca5c16808672a2b78634bfaf7514825a283180be12eab80a2e62724c61a3cc4a297527

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 249196ab6f63522d021ddf87b8206867
SHA1 7111ee7d86eb55d26ebf089095554b68ee1d51fe
SHA256 a32794f8c02d20093d643f1eca3839dee89f3cbd5b41de283ad522d27a61b780
SHA512 c4c50e3022d9b86a8b7929dee1877adf601a6826f105904ab47d8260a83c79c73bd53d0523daff61446fa6e4d9d8876d22c1ac908c53342d2ed75af923454459

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 23b4aea3acbefb3375b411db7f48417f
SHA1 55e1604cbc551ec1e29817233b01b72e696d07c5
SHA256 1e97c669ee126655b64845a0d17a3788b114f48e51176ce08dc7b669e4ad9db4
SHA512 175c8f7472c0621a9d0fe7bdcd8ab07111d2444a056ae0c65a23d46c17214780eed2efb9a5fc2a3d6ef60af82f782f04b520ad767df6fe9517a4899ba7cd086e

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 f9da357e93922c5b6006dd46750722f9
SHA1 7f5942a9ef4690175a485dbd7d4ed6020aef1c65
SHA256 ca70c73c68948f4b4f8284f5b55e8dded2056e20429983575704214812adb058
SHA512 bd320ba51bc77b87f0e7809ca07d14791a227f96a00072e2e66102d72c427c40a2d4eb0c05ac1d488484b57f25927596123ea4e229b930a9860e4b21a968e6a1

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 5bf2d2d16e9137f10a667edf5a9a889a
SHA1 8e8562d800c222531d80f33249d33ab200375f20
SHA256 ecc48bc2e71e8294422cdbba118eb6ded29286d6459de4cc308b792b015c7d30
SHA512 2f690434cf8655ff69601146e54e6041a1ad3dbb38f230a8cbf85422a2015ace4a8bd6099a67bdbbeede721dfcf5ba9931f1ec6ba60b7d2b6cce00a5d3497ec1

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 2e836adedf67893acfd82488431d6faf
SHA1 9d53cd38102fde9449647fdf97d42a70f7825242
SHA256 c5abe478cc488f5785401ddee202aeda0625c466c37815d6c3e963cfd7d3e8fc
SHA512 aad8fec5d6487a0b3ff4267d737c54eed2c9bbd52dc5bf57cb74dc3ab11dbf6bba5fa7f4041307c1972bc7476be42dd9717c97bbf1883908fab8d599df7d25dd

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 02b157a6f769b0c97c8163b836f79205
SHA1 97903d82c1923e0321d9da92f2699f1beb6b697b
SHA256 ce20b6901ea7bfbe676a0866df0ea980ce6159bb19015dec4d680c126492b812
SHA512 741cd143f3de02d54c96703f0ab52b0cbf7130a823474291b30fe89893266967abe493b1443a04861b2d9f62e0e3aaa525322b4a1559025c64a5e630e842878f

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 e707b0e09832202e918b8a83386d7529
SHA1 f2a1bba28bd56368d4626e95ade15166eed546e9
SHA256 44d983ea318acaf9eadfba9261ceb17710ec9da9dc5e72de4894a9b0ba593ee2
SHA512 d96793416696264343bbe658474d999e983a90a1b0a80d7da54707fbb5226fd5128291e367db7812ba4bc979d9d9f9f56d1ec0303e0dfc03b8e145a3c72e8d26

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 83d4b06186c7219153699b04a67bdffe
SHA1 6298717daf5517832d9dd06db05dc78892e35a5c
SHA256 66401edd181a6d68e49d777f415b485638ba11576d045578768c678679b2b761
SHA512 edb25b3eb3819c4308a80ed4789e28d37506f001faac658951a3ef267db226b587988a838ba658a0560e4536a4e092c0b2a8dbca7af6fd445549d3f32386e88c

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 1d0d59e6e74bfab99cfdc54cef8be542
SHA1 7ec5562acb7832d4639f3390678e7e2a3e184da3
SHA256 d1b0bc4bf8244024377dc6d98ad082903b9ec599c72410a9cc01ec37cb305d21
SHA512 832fcf6900469ad71f64147fa3a46103a71093a5c6f3ef1ab07a520c95db50e2c0193f85ded82031f51941d1872c184e7272c79ae74897d12f02ab00b141bb5a

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 de4681e7e63ad210c5f501bfa0494bd0
SHA1 e7ef82467f91a3452c99ad4e81dd401d6d030873
SHA256 5e65f1f69600937929c8aba8c55eefb1d2d57e1a2aa50c1544b96e05f3e6a642
SHA512 0015c93032cb7519236b676eb0f9e26d257f8cd9005b0a377ea37db9be8c7ef067b95cc967b8d2460cf251f9939a682b4e44a8e9e34043a77a2d343a766fe9bb

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 55dbca8c30b3272b433e686a016766bd
SHA1 708a1bae79dd481c20f832966b2ad9685b22588d
SHA256 846add3285b0f413ea89dd325c2a4214192cc5cf6df0d498c377b7ed2dbb13cf
SHA512 764a866545f4b1918324a0e8448f5d795cce6b18c57100513a067ec46863925a037323010fc562ad97b083cc8dcf492b9cda704a084147110b4700c8b5eb77ef

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 b9172f65c605caabea11d12673f3859e
SHA1 1154598ddbfd49364c7fd77965291b0a466f0191
SHA256 0f0f71b74fca6dee9b45ac6082ae8dbad01bc92ee701c7d2cf84cc984863b143
SHA512 cd3709576e243b1e783780632cc1689a5c9ba9c2d9ab6582df1ac049c634516cc0e1c76e0124a5349fc49f1a1454f5fd555d467fda8f5144512cbee42c23757f

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 546654643419e22b2fff7fbf10bf47c4
SHA1 25881494bf0181abe76b856a234fa2daae38596b
SHA256 53dbb52712d86077c21c437be62c66b2f262325018657756ea382f65c3f18612
SHA512 9740b8228e0d5563668c3784b507f203b0bb59644bb947fb032d5ee15896bfde3a692e91994753cff746d03d12adfd140cf4faa285329e7f3ca57a988c5bdb08

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 4c464d72a2e48291b21c64ad0465d637
SHA1 42097ddb6215ed01eb1abda9d42d4d9037bc57b6
SHA256 dd220b00483fcf3a17999b5c2cf3eb24e9fd3eb5653837aa9f9b79cdc1019185
SHA512 5e32a3e2db3ce0e92b8b97d0486c547f8e3df618bbf222cde7f33be893f61304ec2d0fc3512f87d64a7a33335ce7f7edc450672f19b8054904e38027091df55a

C:\Program Files\dotnet\dotnet.exe

MD5 c6a3d3b1e675af99bfad650619436a56
SHA1 2821b02fd9178ca95715fb7777532131c5f6763a
SHA256 8768dd73adcbb24b82fce7e2406519bd1ba8fef38eb5ed40a9ae78f0a194dc0c
SHA512 abdea87ece28b5ac21b8cd7456a551c91c367a42d74d114bfb2023e6d66cfc9ce5c2043a9868be2b80d5b163de08d071211b3238ae6c1e3bbee06540e253c7d8

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 d87f654a4ca460e83b6ee08f14244757
SHA1 1bcea50705ced75bdc3489518ebf0619ef63d003
SHA256 2dbac5e4e11ad468ea880f2953e2522d2f323ae031e8a6721491eaf43f961a62
SHA512 0b61bbbf22bbe74fafa86a711682b1a59c9b8ab00e96bde84bbde176732caa2c257344447d4a98f38338b3eaec8830fb6e935467beb9d561d56d300cd80c6ac0

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 9db97d9569a08fd7b6760b8359e78d37
SHA1 81dd77a6e7485782e842653d14e283142bbfce40
SHA256 ffcaa2072258f8f792c72b9c9d6e81ce5552e3c5352c479ee295329391bfef27
SHA512 9551028feb734f8ec7ee789bf753e8fb7932ad2cb76bdd021d4290d0fb24338c9580f26f55d30abe87d745b2fe3aa526c6b0527eefaeeb97b969e4e1042b242d

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 5dd5b41a258eff38041d73e9d5578ce2
SHA1 8695a69a52d0eea731d95a19d0ccb64e35c6e687
SHA256 15c19f31194a048d2f793a69396bfbb1cccb679b8b73910e575f82c083c2016b
SHA512 e952b57ebaaa393e82f83f748faffcefb3f81cbc7f2cbabe34ebc9e409c508b6bedaad7ce5d20151de626d2edcb7ccda8cc346ead27f2613c35b1ed1fe15e1e3

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 91d210b23d5b7cdcc60a456b3614f15c
SHA1 61f43d2a7e9d9bfe2b3ee992ddd925b67ef00c9c
SHA256 0c8e8742354448090d5e15ca28ffcfd48795ac15d7aef58666e43c09c76d4cc7
SHA512 d1a507e54fbfc65f81747cafdf8afee2291901166fd9d6b6386c33bec83a472cafd024bde49aee0177080fa66702af439417a0019dda325e266d424fa3750175

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 e375b12b40b89d667966749044e754a2
SHA1 ad4f159318da47870cd8d76678f378e499918bef
SHA256 a71079a64110b1147df61ab403778575281893298f8540c599796289a67453d4
SHA512 3193b89dff3f7c092c667352e699f0987f0ffaf4796569e4791cdcf54c20ea62bad11365ac5de3cb2eb7a60ac77633398aaeb99032d90d13d234695d3fcf32ee

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 dc1348fa71051f1cd939b6a5e0188186
SHA1 2bc11966fff28bcf0590fe5ff4007715f0450e38
SHA256 cb76429b5061bc535318c627e211b3dfa5f1d07587365cffe5568a030398a18a
SHA512 1414316b8a3a9eb7b5f65730f9738938c0e9aed0aca82939b8552e22ba80d90c7f338998978711a7a25e50712bf3e71e1a3eac3ebd4f199f978436cd788152f6

C:\Program Files\7-Zip\Uninstall.exe

MD5 89a4755f12641c9332e658f36fc07be5
SHA1 b70576e13430cc7179f007a2464b0455cfa5c8e4
SHA256 eaac3e1d7fa64b51d0ffba2ccba0f314e008594dd587c3490f08a42eb00eb938
SHA512 18d71ff0a9a543367c00d9992158da11b9317d324976507dbad631b742010ab89e0507f19b3c1c3b57d27acc43d46557d179f05606790d75681fd08161db6996

C:\Program Files\7-Zip\7zG.exe

MD5 641269f6e2b75f213187fa1a64b38d13
SHA1 7e1409fa4a2c2b82bf51fe8ca32a8b8eac6480fc
SHA256 5d90c2e4858cd6647aba2450d13571f40643bddd7bc3a43dfb5c7284c8abba0a
SHA512 6095593834e9be670b86e79066e12983783a88ab484ee2af1207c2addbead2f55d5392aa6524c18c278b8f27fcd2cf51232fc6a057bd58aeae4fcb67bcbd031c

C:\Program Files\7-Zip\7zFM.exe

MD5 ea09239b6a32023dac1c72f4e299a275
SHA1 613817e06a95092d8de007f86bf8d1fea8260729
SHA256 fbbb51f187670402ddbffbfbe2e7b4d9cf96da01186eae896ebf2d2575cf3be0
SHA512 f927826cef2098dfdc326daba46cd383f9423c2b9ac2072203eff37efd7796165ff9397325bd972c612670a19645c5094e4efa3d85b34000fb54a8f853d24fc8

C:\Program Files\7-Zip\7z.exe

MD5 5a7cd7f8b8f5a4fe2ecc546a026fa466
SHA1 37d1f58fc09a49a520c2186a6ac1f899466d8f80
SHA256 5f5a3e71d95e1e63660c36e59c15ef50b0c791e5ddefab329a89dc274d66f62e
SHA512 f99f8109826521a4813014cb7a098f6febffe50a06dbdf04fdb511fed262324e30c33f8230e6e6c9d2dd4301d4859e8f5143cd80c59c4462822eeef354a97e59

memory/3996-565-0x0000000140000000-0x00000001401D5000-memory.dmp

memory/1708-600-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/3076-601-0x0000000140000000-0x0000000140169000-memory.dmp

memory/4860-602-0x0000000140000000-0x0000000140241000-memory.dmp

memory/3440-603-0x0000000140000000-0x0000000140221000-memory.dmp

memory/5008-606-0x0000000140000000-0x0000000140147000-memory.dmp

memory/1960-607-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/4012-608-0x0000000140000000-0x0000000140216000-memory.dmp

memory/1032-609-0x0000000140000000-0x0000000140205000-memory.dmp

memory/528-611-0x0000000140000000-0x0000000140179000-memory.dmp