Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 16:39

General

  • Target

    2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe

  • Size

    5.5MB

  • MD5

    b08e0f568dff4a4c4429e9a023486520

  • SHA1

    2c36d669df459d80b5baa54ea721266a9357a7da

  • SHA256

    0f43ea770c1f04c5b14224d53b65a1ceedf2ef53a65b88acc3466d767bac015f

  • SHA512

    447cd50b928eb23d5d0a6356b442c461cc6d871bb5c82eb9fa3df7ef14d98b0f5bfe94a8556be170713a8d5e467298e2bc8f10e47f8791a4311f4909f6364a3c

  • SSDEEP

    49152:OEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1bn9tJEUxDG0BYYrLA50IHLGf/:UAI5pAdV9n9tbnR1VgBVmGB2Yyjl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-04-07_b08e0f568dff4a4c4429e9a023486520_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d0,0x2d4,0x2e0,0x2dc,0x2e4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      PID:408
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdf329758,0x7ffcdf329768,0x7ffcdf329778
        3⤵
          PID:1376
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:2
          3⤵
            PID:3468
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
            3⤵
              PID:3716
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
              3⤵
                PID:5080
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2856 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:1
                3⤵
                  PID:888
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2864 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:1
                  3⤵
                    PID:3480
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4520 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:1
                    3⤵
                      PID:1000
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3744 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
                      3⤵
                        PID:1884
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
                        3⤵
                          PID:4020
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
                          3⤵
                            PID:1116
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
                            3⤵
                              PID:664
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                                PID:5264
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6d8377688,0x7ff6d8377698,0x7ff6d83776a8
                                  4⤵
                                    PID:5324
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                    4⤵
                                      PID:5392
                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6d8377688,0x7ff6d8377698,0x7ff6d83776a8
                                        5⤵
                                          PID:5424
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:8
                                      3⤵
                                        PID:5672
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1892,i,4196166854989429620,764818935068350845,131072 /prefetch:2
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6048
                                  • C:\Windows\System32\alg.exe
                                    C:\Windows\System32\alg.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    PID:4640
                                  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:3552
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                    1⤵
                                      PID:4080
                                    • C:\Windows\system32\fxssvc.exe
                                      C:\Windows\system32\fxssvc.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Modifies data under HKEY_USERS
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4240
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:4212
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:3736
                                    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:2760
                                    • C:\Windows\System32\msdtc.exe
                                      C:\Windows\System32\msdtc.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      PID:3148
                                    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:3392
                                    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:2412
                                    • C:\Windows\SysWow64\perfhost.exe
                                      C:\Windows\SysWow64\perfhost.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1280
                                    • C:\Windows\system32\locator.exe
                                      C:\Windows\system32\locator.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:3936
                                    • C:\Windows\System32\SensorDataService.exe
                                      C:\Windows\System32\SensorDataService.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Checks SCSI registry key(s)
                                      PID:8
                                    • C:\Windows\System32\snmptrap.exe
                                      C:\Windows\System32\snmptrap.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:4984
                                    • C:\Windows\system32\spectrum.exe
                                      C:\Windows\system32\spectrum.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Checks SCSI registry key(s)
                                      PID:1800
                                    • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                      C:\Windows\System32\OpenSSH\ssh-agent.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1080
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                      1⤵
                                        PID:2296
                                      • C:\Windows\system32\TieringEngineService.exe
                                        C:\Windows\system32\TieringEngineService.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Checks processor information in registry
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5172
                                      • C:\Windows\system32\AgentService.exe
                                        C:\Windows\system32\AgentService.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5412
                                      • C:\Windows\System32\vds.exe
                                        C:\Windows\System32\vds.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5588
                                      • C:\Windows\system32\vssvc.exe
                                        C:\Windows\system32\vssvc.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5852
                                      • C:\Windows\system32\wbengine.exe
                                        "C:\Windows\system32\wbengine.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5976
                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:6116
                                      • C:\Windows\system32\SearchIndexer.exe
                                        C:\Windows\system32\SearchIndexer.exe /Embedding
                                        1⤵
                                        • Executes dropped EXE
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3560
                                        • C:\Windows\system32\SearchProtocolHost.exe
                                          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                          2⤵
                                          • Modifies data under HKEY_USERS
                                          PID:5212
                                        • C:\Windows\system32\SearchFilterHost.exe
                                          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                          2⤵
                                          • Modifies data under HKEY_USERS
                                          PID:5912

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                                        Filesize

                                        2.1MB

                                        MD5

                                        60831d13733a8df4976ed2bbc2cc1426

                                        SHA1

                                        15070c0ffd44939112ca25c405cdeac63220305f

                                        SHA256

                                        946fb8465e863f9b94e495a4e20e113aec9a7c2e318c028f1894dd1c22b7b1d7

                                        SHA512

                                        1e2102d9491894601b107f745076175e5edf719658b4d215adabb797601ede9d8887ea4b370136ef5d385b8483ed0956ec56e7e7533149199b87596a2a426d81

                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                        Filesize

                                        1.7MB

                                        MD5

                                        9eeeb03b787bb83dfa3c6a3f26433397

                                        SHA1

                                        71ee01e3d8d4993536c0f226faf98507410422e2

                                        SHA256

                                        319a327f941585512a072d10844e2556a9ad24d7cd161425007e873d5854931d

                                        SHA512

                                        6e43b147d822bd7e197af4192db90738e1cbda5376c08d614ae305f00fc8bba72bff1aadc763098c30777cfa3d34a2c28579800c74d8caea2075fbed4c330323

                                      • C:\Program Files\7-Zip\7z.exe

                                        Filesize

                                        2.0MB

                                        MD5

                                        5f0f4d4eb4a4eafa027760df4512b02d

                                        SHA1

                                        3a96ae2c3b0d6998d3b9e962b367cea122dd45cd

                                        SHA256

                                        0f456752645378ddc029de608409e9f055f8c130c27ef392dd63944bceeaa49d

                                        SHA512

                                        4a4b83d27cd3debe790d13cc3f3b019b112991fba9c4dc08d876eaa42d5cccb701c6440c2941d3594b74b55481e7876203ad0f1e767c74d3ee1f84634cbc9574

                                      • C:\Program Files\7-Zip\7zFM.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        af4bdf9fd0a4bcd0f72dcb8de4753927

                                        SHA1

                                        3c2d6975a51647e7359920de55984a52e15ca5f9

                                        SHA256

                                        66298beacd1c4c13ed109338b1da18df978c7d7149074ccd369a31f96a08074e

                                        SHA512

                                        d589db0894de6b431837f4e52f408799760dac0a60e99dd408874d449eec6826174d28c60b9778c37a5ba01dfde3f62deb9bec8dba77dbd54a333b40287ecaf4

                                      • C:\Program Files\7-Zip\7zG.exe

                                        Filesize

                                        1.2MB

                                        MD5

                                        5e8467f8300a12727fd2814b04938ef8

                                        SHA1

                                        b15d39df33e6b1b1b1cb32660cec2c5d743f4de6

                                        SHA256

                                        b883087182e285bb0ce26011980dfa043700501eb2548ab5567567ca2736d7ed

                                        SHA512

                                        fd8250207200cecc6a83f72087c591841d8668fe88378f9a099674b59e9bbc1064fe118ec9ab605e296e962ebbee9237987cebef59e8e573a7c67b2afc692fd9

                                      • C:\Program Files\7-Zip\Uninstall.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        7d32cbf653c7385c6cd35c40062de537

                                        SHA1

                                        9cd5408261111dae32adb026d8cd6e681d403c23

                                        SHA256

                                        c3dc8ea3a4b715269f14b409e73f0f8793dede4c487980c6e577928ad959e88e

                                        SHA512

                                        81c663c45b4b9d10878dce1c9cece4e193f6ba60fb24d74fc2131f224c9606b523411d542689f577efcf7351ef21870c0792614a1ac47bf350c9b835de153404

                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

                                        Filesize

                                        1.7MB

                                        MD5

                                        f42fcd4d52b0025633e3b6d1bb682d68

                                        SHA1

                                        8dac7b716b9830e06cd38cba3a8e50cfbc879d11

                                        SHA256

                                        2f367187d7d6de6dac313b9f464bab58af2530c3cf2806eb96bd9ba4b8234df8

                                        SHA512

                                        2c5e612ff8ac12e9882e3c29cd4c9029e0f453fc482b55f1002983f1ae18aaf22c01e87e79efbb62ee3a8651716d52578fe428c3a6b49038230a5ddfa9ede468

                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

                                        Filesize

                                        4.6MB

                                        MD5

                                        555d75045ac160b6011d9a77355e2027

                                        SHA1

                                        71aafb9277fac50c4520178fac0cd54188a5fbdc

                                        SHA256

                                        7c1dae18f1df626d329834776f9cb871628346ef36b31e0d7834ffedfceec9e5

                                        SHA512

                                        39e168f96a736ac635e571709073fceb659889c9bdbb8b2f5bc00c1bc076e7801dbd0395715e5aa9a25af8b2a96aceb48c8000b442e3769e3fe219ab3ca16c50

                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        d32ba7950c29ca6b99bf1c9587e62628

                                        SHA1

                                        36f50d04a21966c9dbc2c0146cb17102b4a0a8df

                                        SHA256

                                        43710fec0f5c88a9c750639810b23bf6e7e6e69c1bdba810c97a7a2d4d73090e

                                        SHA512

                                        7d1a6240ddab626fdd6ab4d62ca6cf02f24e6e89138f978086a88d44b59c7a21a9062e3f0c50cce10982f57eaa813feb906754d701685c72be042fdaead11464

                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

                                        Filesize

                                        24.0MB

                                        MD5

                                        70375f6111b57611fb30fd24d24b8754

                                        SHA1

                                        d7560e77e71a30daa105f518a9e9a22737f1fc2c

                                        SHA256

                                        3f340bb53913ca9181f7d7b933237731c9b1f5acdb73d1c5501e57d05a0ac501

                                        SHA512

                                        403e774242b78361f91df5cc7f3b34cab4f13c848cc471ea1ba89e7ea610d0f555c16e5a09e4b14f5f6406382e2c3998f6fab6033f8bd8c9923ab6e0e35fd6f3

                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

                                        Filesize

                                        2.7MB

                                        MD5

                                        b0ad481d66645ed136cac4487e0970e0

                                        SHA1

                                        5f0bbfedcc5f7d05e6c038f09728a172b3902971

                                        SHA256

                                        84316c5f07d1340d7af0b6f862d1ecdc1e917e56edf5deba600a8db6437178d8

                                        SHA512

                                        f4652580d5d2096aa634cb159100edc11c51a5059ed49fc0a6e0eac476d361a3aa60c2f1ae909255b5db7cb64fa9573cf52d1c0aa811b846fe1538ccf9008739

                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

                                        Filesize

                                        1.1MB

                                        MD5

                                        39390f98c74cb458fb0a8df74427fbf1

                                        SHA1

                                        fb59970dc9b3eaecb38330f7e4335e46eb96b713

                                        SHA256

                                        544d28edc8e111bedd6913ce8de6b40b78cbd3403f83b80857f22b1504905af7

                                        SHA512

                                        a9f2839f85d256a59dc70176be9db2fb56851669e170c0e47bd75f9a217294386484511fc1695200227ba07eb28754811f118a9d1d9276e84b1a89e6ef50df16

                                      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                                        Filesize

                                        1.7MB

                                        MD5

                                        bdfc2b859403181d74fc7824df2eb8d0

                                        SHA1

                                        5d242d8799ae7740f821b37e678d2bc8d88d6970

                                        SHA256

                                        1b66989b9702e618fedabda07e9f51b0f806c0a106e2619d1ba9aad484d59f4f

                                        SHA512

                                        1beaf763b0fa2b97f2381e566784c6ed3e663831dfd3ab989e36bfc97fd600a48abcc1af02c34d66f126c3fa8982c695748d77cc7a2739ebc6c8a1c60388bd83

                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        b12af62874497c4b7684248ee1a592cf

                                        SHA1

                                        5b2570936f9ddef8ae678b49220cc77eea0e694c

                                        SHA256

                                        a28237afe5095818f345b37ebce8f6a271f9ca34aad1d5412ba91b4f0641f42e

                                        SHA512

                                        c5d89d3bbecd8ac16f33331094cf97c2f020beadf6a42bcdeef52ab5dbd40f4fb398897578698d4cae5abffc3137d0482e9e4c170f356e69983f7f1816965cac

                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

                                        Filesize

                                        2.2MB

                                        MD5

                                        8ad184e8e13da54d76de47093bb7c4a1

                                        SHA1

                                        1653dd61074ab765c2ee73c80f9164ec8f1f394d

                                        SHA256

                                        50508117f7b1c0a22391d4f9e67673136222fb5316480e3255fb34e1094d0e23

                                        SHA512

                                        97bca752cfc0283bca9391853af663d08a8ad3ecb444365f1935c086ce25825a6feb867a6489b55690616f1f9ff470b7aaeb1453083f007f493b70fcf61f0860

                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                        Filesize

                                        2.1MB

                                        MD5

                                        636e36130476965b5eb4398eb60f0097

                                        SHA1

                                        48a7f51b046bdb8d38df129488ef74f86ec4ffa2

                                        SHA256

                                        6095b64f38812307f6adae7872b16157f4451f6c0c7fde0f05708b7b85507321

                                        SHA512

                                        5495986707dd4dd50492b6487597bf3a1b429bbe5e54ad3948621eb4bd1a7b870fe1486f903f91677f6dad614e3730dec8e72a55e2571d499748004843bff1bf

                                      • C:\Program Files\Google\Chrome\Application\SetupMetrics\0fba51f1-4085-4ef0-a08f-5248c9985e43.tmp

                                        Filesize

                                        488B

                                        MD5

                                        6d971ce11af4a6a93a4311841da1a178

                                        SHA1

                                        cbfdbc9b184f340cbad764abc4d8a31b9c250176

                                        SHA256

                                        338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

                                        SHA512

                                        c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

                                      • C:\Program Files\Windows Media Player\wmpnetwk.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        35a964f4cb19f836c06505957f822dbb

                                        SHA1

                                        7dd8a0e09559a58809980c04e0f6cc21ec29b0e9

                                        SHA256

                                        6069535ed2f557fcd9549dd0e61156c0424c4b23f549997ffb77a966e6774b23

                                        SHA512

                                        cc0679979b98d61d9a8aa7b82a8acfc3fbc199475e6ff472d972eecb280681161704f79eb9ebbc9b9878f7aefa4b1e864092744a56cd68e2092cf8cc79f4201a

                                      • C:\Program Files\dotnet\dotnet.exe

                                        Filesize

                                        1.6MB

                                        MD5

                                        f0f1f2eefdc371b4de129f1bb924b795

                                        SHA1

                                        82b3b534dbc1dd19455289e4c4211f98a903d67e

                                        SHA256

                                        01ea75f58e84f682a97a37b627d2ebbdd81aff0115bfc5e1b206a91306f0d83f

                                        SHA512

                                        f3dbb7cd238a21055c0008319ef24f433596aa77c15e45edc5a3a5382bc225aa13eca4080f1fd9e91d9577a18a372950dcdf0dcf89123e5fd1fd4b7fd3abb3d7

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                        Filesize

                                        40B

                                        MD5

                                        d98a862745da89fffa1a305d578048b9

                                        SHA1

                                        59c750081af110ad27f4a360bef4ef689b0fa519

                                        SHA256

                                        2d1a2162f435610d5e0dd4650a8e71211f1a25d879a94d11fc06c111c69a23ef

                                        SHA512

                                        d7885a29a75646721b631f736bab26191a0c79f7b32b1e2c7d1cc79507ba80a598d9bb9e967a10cb522d6f8c65c1a8eddfd96d75ccb0914947c09566c7642dec

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

                                        Filesize

                                        193KB

                                        MD5

                                        ef36a84ad2bc23f79d171c604b56de29

                                        SHA1

                                        38d6569cd30d096140e752db5d98d53cf304a8fc

                                        SHA256

                                        e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831

                                        SHA512

                                        dbb28281f8fa86d9084a0c3b3cdb6007c68aa038d8c28fe9b69ac0c1be6dc2141ca1b2d6a444821e25ace8e92fb35c37c89f8bce5fee33d6937e48b2759fa8be

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        371B

                                        MD5

                                        1b0bf27fbdcb3f920bb84cb6fe3ae4ef

                                        SHA1

                                        40853ae7129d59e964344799a995e4dd6e2783ed

                                        SHA256

                                        bf9905bb8175ea374cbbfd9399f48ba5b651a8dc15afda51c14327a7550a2e19

                                        SHA512

                                        e6566fe1a7ced0dc50f8bcef82fccdb9fdc679badb2890d8dfceaaa58e094aee0c00bdb24eb1230c4bc1cb282cdb79a746067cf265b1de0809989bb1bab13239

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ac575053-e5b7-4a05-b3b0-631b76490879.tmp

                                        Filesize

                                        1KB

                                        MD5

                                        a6140abe0e32372b2cfd34b4fd42de76

                                        SHA1

                                        5d397a41dacbadbb4df7f64e4d3ccec9f308e24b

                                        SHA256

                                        e6fc03fd2a0cfbfe1e13b7d288cdb99177ce643028eedb2c483d6fe7968a5257

                                        SHA512

                                        7d2b9b13756536b16743a75d8320daa84d8d1f68402f918ae5738f370f4dfba0fe48d63d4563ae79569bec0d09c5a0ea015c73ac9a369dded8945835ee008cfc

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        274d36d238a3bcb404cb4e81c8e16f87

                                        SHA1

                                        9791999e279cba61ca24ef3932035f91a7b5b638

                                        SHA256

                                        376421208b607de6806b6dde09124333a3fca5325aa84e8356e9777a46577899

                                        SHA512

                                        24bf04224cc94cb49004c47ab5ceeb8cf96b4bbc701d802864e8c02894556cdf1a3e6574a230b8bb302f3d027cffa42cebea6cc0c989f054b010513b02b28590

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        4KB

                                        MD5

                                        d7502dc78aad35f62c3fdc24adcbfacf

                                        SHA1

                                        6bb1addb0983402e6fd8d406fea635221803c967

                                        SHA256

                                        b515224fd4ff3bb867d617c908ba59d9e163a3ccc32eb35afccf3a8cbbaa5f4c

                                        SHA512

                                        f5bdba8938b29082be70fcca6a42b08e8228cdf6e25fa22001c8b5ee34081f357efebaf9e4e824f55b1d596056757da4683c80f19f73aa5bc0d8da7c18ac40a7

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        4KB

                                        MD5

                                        08a4232d0b8761306a8b93d2dc1c8824

                                        SHA1

                                        9219ea1eac0e13f0c6ce4b9b7d60d8359f9cbb81

                                        SHA256

                                        6d65d141d4bea28c7199aef64673f2c2cae9c89fbeae6c79911bafe0c4fc7055

                                        SHA512

                                        b120d642c7342d9ff94d853ce0b52018d7041adb1c9075f6cc6fb566e18db97e834c3595e3b907e77c658ad727eb1df1a83065eb58e3021d4a6223fc8bc7a043

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe576254.TMP

                                        Filesize

                                        2KB

                                        MD5

                                        29e97ab941f5c82421dd16c25e9a6087

                                        SHA1

                                        c2e54372210cd01a8aac728f18e01cad1877e6df

                                        SHA256

                                        434f74e38c83f9ef23934cbf9477d3bb9e8f40cf5adaca89b96fe15a283793a4

                                        SHA512

                                        de4ebcb46a9bed711439e693231b38961e7958069986bb0f485781dd8ce4ab410612d5d5d9df8c89b534b7b0c5231b3e29aede00dff940e12c76ab2fa78909bd

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                        Filesize

                                        15KB

                                        MD5

                                        d572808d3f78c411c734efa03fdaa0f5

                                        SHA1

                                        14bb5f7975af83fb67dd24e2fda30464f4f5c1f0

                                        SHA256

                                        c566950899664e21f11059d8ef3521f6b687a2185fe8cb49c26b7894b598b5d9

                                        SHA512

                                        a130c1f33988f40347eca2bb28335af20d4f46a49b8ff4558999dfc95a918a09f8374cee24e6fdef43d8bdd2c2980babffb789530172b511b1953003d595ad10

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        260KB

                                        MD5

                                        dd7f50a3ad435ed34ff31c5190bbf8ea

                                        SHA1

                                        97831ce71e11b4bdc0fc68a6270618d8d0fb42e2

                                        SHA256

                                        59e3dce8984a217789c58f2e6861828c561556b5fb093715728c76eb11a0539c

                                        SHA512

                                        085a943a578f023085764b156f34a179dd57fba4cc48aa713175e61d824a65dba109b944308f66ae04f01108902e591217541da526ec8a46f029a62f4d8b6efc

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                      • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                        Filesize

                                        7KB

                                        MD5

                                        b141b968c66d16955f3f307583275f30

                                        SHA1

                                        9e9a24db3bd4c911977f8229c71c196f5cb471d1

                                        SHA256

                                        0a5b8829118e2c9efe7fb5e3b9214b9f3494a2ba8e6776e32bfadd3c89bd9c98

                                        SHA512

                                        168a74b6a1ffed13d031a90b70ae36a20c8632789dd421613584c9ab9d4a26fe2af82b4e6c0afbc35aeddeb25ba893dc2e532ce550bf4fb97d7122df37fbcb53

                                      • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                        Filesize

                                        8KB

                                        MD5

                                        8223b9663543291df728bb785a0b1f67

                                        SHA1

                                        fa73a74ee10769b2cddad3eb5e13c7a314bd0ce1

                                        SHA256

                                        766e9046b831327596cf7d46a428ed142d8ff5b3906704d8bd72ca768968ca3a

                                        SHA512

                                        3c0bd45e65ec2fc0ab55b13792a546696b370afe4c21f54b8cd2074219c3fdd1389e673526fd799961edfe57811a77b11620d6a8af28515bf01ec1efaafe824c

                                      • C:\Users\Admin\AppData\Roaming\58421d9b205991d4.bin

                                        Filesize

                                        12KB

                                        MD5

                                        d56994eac6cfaefe6a040bf63de8e54b

                                        SHA1

                                        65c65a8d66ab0889cd1f2f4857ea9e646de708a1

                                        SHA256

                                        a08986a9115947ec5c02a04c85b3166717518ed3df4aa8dc7739990198052a04

                                        SHA512

                                        1ea1fd611086f98f3a39c3c280f7cd7276d06944e8f6e52f454ee9c606947ede1bb54bddf7e7c61019666e30a87a818d1443407488e25287ff572a9ee655e87a

                                      • C:\Windows\SysWOW64\perfhost.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        149be38f867a8c11288633a2618e6be7

                                        SHA1

                                        58f38e1cbbcbf10fae625f97ec865a1828a65a33

                                        SHA256

                                        86c6ebab5bd5aa802fe651a2edb790604abc3cdc03ab561bdf9238f2b8f5ec91

                                        SHA512

                                        1689360eebc16373d486e610ee81d065b04a841bd47fae397f6fdb83d1a83ec4593e45dbac4fd00ab12526c4886f86fc439154f09ba5400324ede4f14584c119

                                      • C:\Windows\System32\AgentService.exe

                                        Filesize

                                        1.7MB

                                        MD5

                                        8e2682a027080bec38e81550ba21e56e

                                        SHA1

                                        3dc79eb4e2bd79bca189f79df838a8c8fae3b091

                                        SHA256

                                        bc106b5fd03545b5b544d881c39e42ae9e1818b2188690dd87f04e2fb34a4a2b

                                        SHA512

                                        abaeadd73e8ddc2de1dcda68b6b6ae60a39f38a743abc7d1c24323866d992a7937c3c0ddeed21133a387cc0634326732b8e577d2dbd9511c511dffeabd250c02

                                      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        932d4b693757f9f71d1e0f1cc14ebabe

                                        SHA1

                                        653e044600e4b96d754b2116f4823f6a277ccb76

                                        SHA256

                                        a2da85493ad32ec684fcfc1936e3c5f159b78a9f7c385331560d705dda2017f8

                                        SHA512

                                        d4ff51c81883799078b240480923a3a0be3824786fbf2a688e2ba52200f401416a19bfe0889bb699cfb454bf2ecfc7003a9bd88a8ef75039575f989aee6d8383

                                      • C:\Windows\System32\FXSSVC.exe

                                        Filesize

                                        1.2MB

                                        MD5

                                        ce431ebd7bd4baf918a04b136276b581

                                        SHA1

                                        3bfa5ff5d63b7cfd2cfa346db76ef0129e7fe4b2

                                        SHA256

                                        5bf90aa258cd806456239ea878a12d70afaab9250530075abff7f7d1dbe84436

                                        SHA512

                                        0e09d60d29dd554b6f52b279863b81d5597c80b0e4006b16d7cfb0103404feecb1437ee5920876cc42fe261731b753b7e1b9de64cf9b432e1bc30548f6d30725

                                      • C:\Windows\System32\Locator.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        75d8d50bf5252ecd53192c2e419a5420

                                        SHA1

                                        a6be45e0e9f3f49af5692d62abc7803149b318b7

                                        SHA256

                                        1d2e7d240c0722a447cac150b4f200484979a4e489f2752cffc08b44392f8552

                                        SHA512

                                        519a90488d00158a905b8a2fafb27436c218aae57b7732c0aeb02219dea932b62ad39ae0da67955ba90ec4b649d791134709e721fec2558b20bec55202c0d793

                                      • C:\Windows\System32\OpenSSH\ssh-agent.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        e02391510892a7dbaca87c82eb241876

                                        SHA1

                                        39b089e91b6b390509d3a9e1d082bf9d34a0095a

                                        SHA256

                                        27c6f220ba7f539742b579a712b325be3427853e0ce3446424b9532cac36b9e3

                                        SHA512

                                        0913c52b614482e84e2ea551df28b5260270c5806da5bd1b100bcc73e87bc55b0bace18141e37da0a820af4d9312c64a3a7958dbceb79cf3fa983410ee8fe80f

                                      • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                                        Filesize

                                        1.6MB

                                        MD5

                                        ed5ee6daa0ca12d21a5470df9d4b737d

                                        SHA1

                                        b348cb4ab422fd4daa66f1e6ccd6851130454b07

                                        SHA256

                                        4feb7443de41ce6ed30a6221f5c4653ce93d834233bb13cb911e3dfed0257645

                                        SHA512

                                        6f79ea04c7c7fe24a5e94a1a8f463889a0fc15702068de12e87e31793a4351dc2b2a894c2d288926d45a803a809fc0fce80b4a331f2333604746e99c66656ad1

                                      • C:\Windows\System32\SearchIndexer.exe

                                        Filesize

                                        1.4MB

                                        MD5

                                        23604ff244e97d7ab7ef0063e7b36907

                                        SHA1

                                        da8eafc53128fd683835dea27464714bcf8ae4c1

                                        SHA256

                                        e125aea996a333811187d7cd7a45039fbde5d76b2eef5980a1b9757fae7881be

                                        SHA512

                                        35d87d388651bd6437e35483f54774412f2a56bc451605abd2a228fc528efaad2af06b8dab686dab2d17a55e747089b1ccfdf118873e1ba082d18825d4da502a

                                      • C:\Windows\System32\SensorDataService.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        5852220f485bc1ea34511840072be800

                                        SHA1

                                        9e340e64e6e041629950b62ea67655113941a5b0

                                        SHA256

                                        53ffeb90c0048cc0b3202ddf3bc7ce5d834d4e7099f0ef8a0ef947e6ad3c1e26

                                        SHA512

                                        d3eb68e8c1729eca355015a0add6df199b27e95dd0b9d76531e20512d921107226c0566041d5118e14c5fa20ddc73b302ed6c5a300baf24269119a95f1bcf656

                                      • C:\Windows\System32\Spectrum.exe

                                        Filesize

                                        1.4MB

                                        MD5

                                        6fc0a79669887a5dbcc4874808809866

                                        SHA1

                                        b08dbd727759d45c4f418f1597503dce41c431d0

                                        SHA256

                                        7cd482cbe48929352e1b967262f1b55c9a798883ce7353a9c673acf3bda7fc5b

                                        SHA512

                                        ef79854962c7c86ea1d16f5b0ec1665df6e3790e32f22f5b586894e26aea90fd05038a8eea272ad20502ccd05ff1c35c7016198a5d45abb33989cd20286318cd

                                      • C:\Windows\System32\TieringEngineService.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        053a8f8dd182e7c31d39d5497080ced4

                                        SHA1

                                        c60b92e6bcc99d1062396beccd2af218a705b337

                                        SHA256

                                        8e579eb066ce046f1c499e4f29603d4a27ac8ded80993eed52526531e5e2c94a

                                        SHA512

                                        2ae03802e6dc0f7736494a82231275130488a105e79ac8470808b08daff82853e36b0b6f436acc96a7dc8f3b5df7c77dbe57e1bf02904b8170ee1184fae85767

                                      • C:\Windows\System32\VSSVC.exe

                                        Filesize

                                        2.0MB

                                        MD5

                                        2ec9e5edca26c558869d2e3ac8fcc889

                                        SHA1

                                        98abbdeb9ca237a6aea7914e584f0a8361bc9728

                                        SHA256

                                        c8f60dd3f0a10124425a9d94cec00212a7b5dd3a3e19a4a48a621cbc82fb52a9

                                        SHA512

                                        53ad6ae89e09f4d9c7678b0d9f5b5328cfff0604578c6182ac2984866dbed773492661f8dabc1cdbf40d8a87c526a8476b43bd74955f1ca36fe0b08b1f424a39

                                      • C:\Windows\System32\alg.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        f6c5661662f61d84a5acdacc56cbcc54

                                        SHA1

                                        878eba212e155baeb7d50264f9efbcf56418ab45

                                        SHA256

                                        c9b09a2a491b8ce96dc427755c25dfcfd9188a2deb0d9e5ee42a94bd5fd5c9e8

                                        SHA512

                                        2dbb7f9e931ee3db933960aa36553aa8d8607556311d3a00fcfa2f1a6626e6f4cc0245042172b56ab83ccb99b34a0493a3368edbfeda374331055c0b5cc31b28

                                      • C:\Windows\System32\msdtc.exe

                                        Filesize

                                        1.6MB

                                        MD5

                                        fcd82f93a74b45bf11e8773cf1526365

                                        SHA1

                                        31b3d6999fba74702e273d105a043ea7e35bf51e

                                        SHA256

                                        527470671ec89e4db85110e117bb255e0fdf69311e9a7a9c7cdcaee0458a47bd

                                        SHA512

                                        1609d675416809f20cb84e209d82a11f7cfa9519b847c68180c12811f4b13877c7ea62573d4b3f9ec3280118efdf270aa4594a1bea124f6e90853f4ae7bcd27f

                                      • C:\Windows\System32\snmptrap.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        8645197a4d9c2bbbeb58812ae79cbe3f

                                        SHA1

                                        10a06c9378efa1e42f44201b54512a193ef0d696

                                        SHA256

                                        fe9d0dc21eecab76ffbbe465cff2d37a76d7b9f0bcdfe8a8fe9242e5b56b6b1c

                                        SHA512

                                        ff43b8c5b25d0629da309119195457b4c5c3efd5e3d2979c22e3af38c51f73ac1fe6dad9e79199ad55c2b3d4d4351f85b429a1c562f1bc2102f8eccece769239

                                      • C:\Windows\System32\vds.exe

                                        Filesize

                                        1.3MB

                                        MD5

                                        f9e86ff597ce60883386ceedc2c7f4cf

                                        SHA1

                                        b63218ead7b51804153a7c68ff52e9a645374e9e

                                        SHA256

                                        4e42abcf43fa9a0313310a04dfa88e7e4bd85623aa0be90f7bad8e33d18372a6

                                        SHA512

                                        b55343230ee93100206fbe947b7c1461183525aed61fb82a085bae3b7c4334795b2d13830acd3173504bc414b38e240db93be59750009d1c4c844277dfc02818

                                      • C:\Windows\System32\wbem\WmiApSrv.exe

                                        Filesize

                                        1.7MB

                                        MD5

                                        3e53acee892d734dfa270127743b0ba6

                                        SHA1

                                        99ddffcba167b3b9b2d8330e9fbac89d4baf4ccc

                                        SHA256

                                        92aae7d30a12522d65e4b90c7e42a3e2054ad4a44f67141f2fd0a4c8607f2ee7

                                        SHA512

                                        3cb82f75adfe788c0dcebefea2fdc7ff4e5abfb6e26b43f30b2c96cdba98fb79f57a51723b237d180abaf41c19d53fb836c24b933613b0822870993f7c30f041

                                      • C:\Windows\System32\wbengine.exe

                                        Filesize

                                        2.1MB

                                        MD5

                                        39757697d47673c564a842094ac8fcfe

                                        SHA1

                                        35d94424554d2cbd7a96ef1eedcc50dfa2e3311d

                                        SHA256

                                        1d5353fc299b33434fc80c0a4454af3cf033d4f355ba653a50f60e8c3fbb3314

                                        SHA512

                                        7ae8c895cca12b299fef751563fda8d5ea6c7fbcc448e2a32b805475127dc3f64371c7a3aa5a1aefb3eabe0bd28e2788c0c57a48e277ae69432d725a28a1eb8f

                                      • C:\Windows\TEMP\Crashpad\settings.dat

                                        Filesize

                                        40B

                                        MD5

                                        2f356fd7d6ab9640c82881fd6ca23617

                                        SHA1

                                        2850cee0903aea112835caa614e340663d5e004d

                                        SHA256

                                        cab65df1c84361a06e3db00485b191bfb5231b9ae9203a34aa713dca7180eefd

                                        SHA512

                                        a84c1335dc783b68295ff907fa2ce5b55c13b54645e0266109fc2612d6287b7445b555638cc8bf5282d4037dd9fca9891f685410e7c477a2b39ff29e6d31541d

                                      • C:\Windows\system32\AppVClient.exe

                                        Filesize

                                        1.3MB

                                        MD5

                                        5fcf7c1b36ca56608ecc69530670d607

                                        SHA1

                                        3543954ee580a6f3066f8b51ac78e2c56a50f1ba

                                        SHA256

                                        d4ad7341f98d6ee7847fd61fd43dc43287ea00d9ecaf6827b6d95c80a2bc671d

                                        SHA512

                                        e63591540764f76f03f54a28085695a58e0bccdde20f117b4c8d4cdfc414388a37ea13f44a773fcf1a858a6f6c507e9bd2ffeb39ba80d133964d26eddf144ae7

                                      • C:\Windows\system32\SgrmBroker.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        579dbf39c16b69a22fe812db7d4efe84

                                        SHA1

                                        0eb64ec5999312fa6ea343a93b236a01749eecbf

                                        SHA256

                                        9cee4edcf81d996b35a4e0aaea49dbdced24ddf530374f83bb132bd4b311959f

                                        SHA512

                                        3871deea340a12896b7d9ce2b8ba45d7f94bd0e14fbae713a17226e801f746a75770a95256ac33c0a904788c5d326124e510dab7a418cb5dfcd227fc5965e1a5

                                      • C:\Windows\system32\msiexec.exe

                                        Filesize

                                        1.5MB

                                        MD5

                                        f56b7624bf5e97078bbd87d62e001b3c

                                        SHA1

                                        6c5bba6265a984465765e3b2327dc1f32d9123a3

                                        SHA256

                                        bcebe2bf589fa981d599dc6c1c2a2a35e9a5baf142fb0a4a944d6b8672f121de

                                        SHA512

                                        ecc1eb1fcc612d3b921d9ac977ebb7901aca9736d07ed237324c91bf42bcb540e7712ce4e35fa46839b1bd813b12b08eb4a30414abf1fc6513b450a5e7b59b97

                                      • C:\odt\office2016setup.exe

                                        Filesize

                                        5.6MB

                                        MD5

                                        1563e2e09eab9bad0e315c54e485c3e3

                                        SHA1

                                        6187f80b8a14b4b849b0411b8f718fb08eb78341

                                        SHA256

                                        58ec4e22733fe8d771d8cf7971c8c1a260cd14b31c9ba3f36566fd2bb2721ac1

                                        SHA512

                                        423931876ea4937757b06bfb3f5c2c963a1950d7f0fa05698fae5fc91cd4d97fc8b62b46ae96b78c1fd0c82fce00dd167e56ade80c59c9a364158634a5683856

                                      • \??\pipe\crashpad_3828_AJKANOFJTBYKFORJ

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                      • memory/8-199-0x0000000140000000-0x00000001401D7000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/8-208-0x0000000000740000-0x00000000007A0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/8-277-0x0000000140000000-0x00000001401D7000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/408-20-0x0000000000800000-0x0000000000860000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/408-110-0x0000000140000000-0x0000000140592000-memory.dmp

                                        Filesize

                                        5.6MB

                                      • memory/408-14-0x0000000140000000-0x0000000140592000-memory.dmp

                                        Filesize

                                        5.6MB

                                      • memory/408-12-0x0000000000800000-0x0000000000860000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/1080-242-0x0000000140000000-0x00000001401E9000-memory.dmp

                                        Filesize

                                        1.9MB

                                      • memory/1080-252-0x00000000008F0000-0x0000000000950000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/1080-335-0x0000000140000000-0x00000001401E9000-memory.dmp

                                        Filesize

                                        1.9MB

                                      • memory/1280-183-0x0000000000400000-0x000000000057E000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/1280-251-0x0000000000400000-0x000000000057E000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/1800-225-0x0000000140000000-0x0000000140169000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1800-236-0x00000000004E0000-0x0000000000540000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/1800-321-0x0000000140000000-0x0000000140169000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/2412-170-0x0000000140000000-0x0000000140192000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2412-235-0x0000000140000000-0x0000000140192000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/2412-179-0x0000000000BB0000-0x0000000000C10000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/2760-125-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/2760-134-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/2760-117-0x0000000140000000-0x00000001401B1000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/2760-116-0x0000000000CD0000-0x0000000000D30000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/2760-132-0x0000000140000000-0x00000001401B1000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3148-145-0x0000000000770000-0x00000000007D0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3148-136-0x0000000140000000-0x00000001401A0000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/3148-207-0x0000000140000000-0x00000001401A0000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/3392-167-0x00000000004F0000-0x0000000000550000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3392-159-0x0000000140000000-0x00000001401B6000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3392-220-0x0000000140000000-0x00000001401B6000-memory.dmp

                                        Filesize

                                        1.7MB

                                      • memory/3552-135-0x0000000140000000-0x0000000140190000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/3552-53-0x0000000000690000-0x00000000006F0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3552-45-0x0000000140000000-0x0000000140190000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/3552-44-0x0000000000690000-0x00000000006F0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3560-364-0x0000000140000000-0x0000000140179000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/3560-372-0x0000000000870000-0x00000000008D0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3736-98-0x00000000001A0000-0x0000000000200000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3736-101-0x0000000140000000-0x000000014022B000-memory.dmp

                                        Filesize

                                        2.2MB

                                      • memory/3736-108-0x00000000001A0000-0x0000000000200000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/3736-182-0x0000000140000000-0x000000014022B000-memory.dmp

                                        Filesize

                                        2.2MB

                                      • memory/3936-255-0x0000000140000000-0x000000014017C000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/3936-187-0x0000000140000000-0x000000014017C000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/3936-194-0x00000000007C0000-0x0000000000820000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4212-69-0x0000000140000000-0x0000000140237000-memory.dmp

                                        Filesize

                                        2.2MB

                                      • memory/4212-70-0x0000000000440000-0x00000000004A0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4212-103-0x0000000140000000-0x0000000140237000-memory.dmp

                                        Filesize

                                        2.2MB

                                      • memory/4212-100-0x0000000000440000-0x00000000004A0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4212-79-0x0000000000440000-0x00000000004A0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4240-77-0x0000000140000000-0x0000000140135000-memory.dmp

                                        Filesize

                                        1.2MB

                                      • memory/4240-58-0x0000000140000000-0x0000000140135000-memory.dmp

                                        Filesize

                                        1.2MB

                                      • memory/4240-65-0x0000000000730000-0x0000000000790000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4240-59-0x0000000000730000-0x0000000000790000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4240-72-0x0000000000730000-0x0000000000790000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4640-115-0x0000000140000000-0x0000000140191000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/4640-36-0x0000000000720000-0x0000000000780000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4640-22-0x0000000000720000-0x0000000000780000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4640-23-0x0000000140000000-0x0000000140191000-memory.dmp

                                        Filesize

                                        1.6MB

                                      • memory/4792-0-0x0000000002090000-0x00000000020F0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4792-6-0x0000000140000000-0x0000000140592000-memory.dmp

                                        Filesize

                                        5.6MB

                                      • memory/4792-8-0x0000000002090000-0x00000000020F0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4792-28-0x0000000002090000-0x00000000020F0000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/4792-34-0x0000000140000000-0x0000000140592000-memory.dmp

                                        Filesize

                                        5.6MB

                                      • memory/4984-307-0x0000000140000000-0x000000014017D000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/4984-213-0x0000000140000000-0x000000014017D000-memory.dmp

                                        Filesize

                                        1.5MB

                                      • memory/4984-222-0x00000000006B0000-0x0000000000710000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5172-258-0x0000000140000000-0x00000001401C9000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5172-349-0x0000000140000000-0x00000001401C9000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5172-269-0x00000000007A0000-0x0000000000800000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5412-280-0x0000000140000000-0x00000001401C0000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5412-295-0x0000000140000000-0x00000001401C0000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5412-291-0x0000000000B30000-0x0000000000B90000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5412-298-0x0000000000B30000-0x0000000000B90000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5588-309-0x0000000140000000-0x0000000140147000-memory.dmp

                                        Filesize

                                        1.3MB

                                      • memory/5588-568-0x0000000140000000-0x0000000140147000-memory.dmp

                                        Filesize

                                        1.3MB

                                      • memory/5588-318-0x0000000000B00000-0x0000000000B60000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5852-322-0x0000000140000000-0x00000001401FC000-memory.dmp

                                        Filesize

                                        2.0MB

                                      • memory/5852-331-0x00000000006C0000-0x0000000000720000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5976-344-0x0000000000AE0000-0x0000000000B40000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/5976-337-0x0000000140000000-0x0000000140216000-memory.dmp

                                        Filesize

                                        2.1MB

                                      • memory/6116-359-0x00000000006C0000-0x0000000000720000-memory.dmp

                                        Filesize

                                        384KB

                                      • memory/6116-350-0x0000000140000000-0x00000001401AD000-memory.dmp

                                        Filesize

                                        1.7MB