Analysis

  • max time kernel
    138s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2024, 08:25

General

  • Target

    2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe

  • Size

    3.2MB

  • MD5

    9fecfd4c3d7862921a2e06b026a3d5d3

  • SHA1

    04c5e957c96c7a8c61ecf850ec7830ab9baf68d3

  • SHA256

    4eca1b53f9a34ff31976a838231c91360bfb48175d60cc168c341017d955903f

  • SHA512

    91e7cb9af7e52c928b03db69a92d216531809458fc2eac12e5a760f1336182ea2202d5f54e803e481b56de8711e1f1ae1f7010072f116a0b16cf9619ceabcf1d

  • SSDEEP

    49152:D5k1YCdptya507NUUWn043oHS3fTGYwVq1/xT3DDbwwTU+ete30jaNf1TWbdz:XNhSqYw8OlU023W

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-10-21_9fecfd4c3d7862921a2e06b026a3d5d3_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=92.0.4515.159 --initial-client-data=0x2b8,0x2bc,0x2c0,0x28c,0x2c4,0x140221ee0,0x140221ef0,0x140221f00
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4916
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0c2ccc40,0x7ffc0c2ccc4c,0x7ffc0c2ccc58
        3⤵
          PID:1488
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:2
          3⤵
            PID:1924
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2504 /prefetch:3
            3⤵
              PID:872
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2124,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2596 /prefetch:8
              3⤵
                PID:2656
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3124 /prefetch:1
                3⤵
                  PID:636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3068,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
                  3⤵
                    PID:2220
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3636,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4480 /prefetch:1
                    3⤵
                      PID:1480
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4660,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4328 /prefetch:8
                      3⤵
                        PID:2668
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4448,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4800 /prefetch:8
                        3⤵
                          PID:1880
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                          3⤵
                            PID:5688
                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6b8594698,0x7ff6b85946a4,0x7ff6b85946b0
                              4⤵
                                PID:5768
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5852
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6b8594698,0x7ff6b85946a4,0x7ff6b85946b0
                                  5⤵
                                    PID:5884
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4436,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4332 /prefetch:8
                                3⤵
                                  PID:5872
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4900,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5116 /prefetch:8
                                  3⤵
                                    PID:5232
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4720,i,7501576214604955545,16031000360661419839,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3076
                              • C:\Windows\System32\alg.exe
                                C:\Windows\System32\alg.exe
                                1⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Drops file in Windows directory
                                PID:3764
                              • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3428
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                1⤵
                                  PID:5112
                                • C:\Windows\system32\fxssvc.exe
                                  C:\Windows\system32\fxssvc.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4364
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:5024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:992
                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4228
                                • C:\Windows\System32\msdtc.exe
                                  C:\Windows\System32\msdtc.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Windows directory
                                  PID:1192
                                • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                  "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:3960
                                • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                  C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2708
                                • C:\Windows\SysWow64\perfhost.exe
                                  C:\Windows\SysWow64\perfhost.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:2424
                                • C:\Windows\system32\locator.exe
                                  C:\Windows\system32\locator.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1056
                                • C:\Windows\System32\SensorDataService.exe
                                  C:\Windows\System32\SensorDataService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:1652
                                • C:\Windows\System32\snmptrap.exe
                                  C:\Windows\System32\snmptrap.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:3460
                                • C:\Windows\system32\spectrum.exe
                                  C:\Windows\system32\spectrum.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:3940
                                • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1952
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                  1⤵
                                    PID:4560
                                  • C:\Windows\system32\TieringEngineService.exe
                                    C:\Windows\system32\TieringEngineService.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Checks processor information in registry
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2392
                                  • C:\Windows\system32\AgentService.exe
                                    C:\Windows\system32\AgentService.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3924
                                  • C:\Windows\System32\vds.exe
                                    C:\Windows\System32\vds.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:5176
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5280
                                  • C:\Windows\system32\wbengine.exe
                                    "C:\Windows\system32\wbengine.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5480
                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:5604
                                  • C:\Windows\system32\SearchIndexer.exe
                                    C:\Windows\system32\SearchIndexer.exe /Embedding
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5824
                                    • C:\Windows\system32\SearchProtocolHost.exe
                                      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5368
                                    • C:\Windows\system32\SearchFilterHost.exe
                                      "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5952
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:5240

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                                            Filesize

                                            2.1MB

                                            MD5

                                            ffdde2ff6d910d155169b83683a37ee2

                                            SHA1

                                            c11e9a9d1be87be23556a3708cb45f11fafbeaed

                                            SHA256

                                            beebf528754b36f84ed3ec657d5891e3307f625d56ca36e5b0c7af98766b5955

                                            SHA512

                                            5bd861c2d8242f566649451c4e1dad483fc22678d6781c2f19fa1d375cdcbcc2e1bf0faef722ae798c1337270fed582e90549ba745660eae8f671f7c69df560d

                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                            Filesize

                                            789KB

                                            MD5

                                            f908e3c4fc69b6a5a19fc77834cf7f4e

                                            SHA1

                                            6e5815dc606a3b272a39d23af775755360d7f453

                                            SHA256

                                            96165baafa19b8e1a41db36e5fb0ca8eb8fd2a4a95542a818264d9cfbc1d57e1

                                            SHA512

                                            00d334ff05be62bb3042408bcd136ae450a79086abc6a9df90e1371401f8024a99202d53a2cebea8062cdb21363c5f39f24eb60e736a48fe619767ee913bbe7f

                                          • C:\Program Files\7-Zip\7z.exe

                                            Filesize

                                            1.1MB

                                            MD5

                                            646e30f7e0ec0f2b9ad6d95c1af77e88

                                            SHA1

                                            e34a729a52debffff8abd93795ac68fd691a6a2c

                                            SHA256

                                            b59210a31f51b8f7fe07549b945282eadf32711ca7b8906409a529b14ac7ed16

                                            SHA512

                                            a1796ac483eca929916160d803752b7884971ee74d518e9412e0a84bdb3fd8fadbd7145f75ba10a72faaa2176d9b503c5d9bd9000ece7c676296a107c6175c10

                                          • C:\Program Files\7-Zip\7zFM.exe

                                            Filesize

                                            1.5MB

                                            MD5

                                            de541ab7d700ad9d8e6c9d53ca03e456

                                            SHA1

                                            15c005fcf2d4fed35593c0b7c90aab24d95c91f4

                                            SHA256

                                            6c71cf0627ee4dd77875d0041c36f85856c9ebac401d3b46e61d3451e8d31d2d

                                            SHA512

                                            9b593f2f463ee49778f0546461c0b4df7a5ffe87716965f822d9bc7949c580855031d7a1a6be9025c291ccdf7f53e3bf00040fd09c33c88ba714f36afead8bf5

                                          • C:\Program Files\7-Zip\7zG.exe

                                            Filesize

                                            1.2MB

                                            MD5

                                            b126aa7c67bc94ca22ef9d09acd8cb89

                                            SHA1

                                            cd5f262c23942a8d38255ac5dc40ea20c8a11b51

                                            SHA256

                                            e8771fb9a1fedb52b3f5d783848b8f07cb9952dd2c0991c1d8cbdae24ec1425d

                                            SHA512

                                            f509d5a060bfe67f401ad53c7830a67170c4c490cf4c59c2e2efc5beb1ff5ecc0109c9c9cb25fd84a310a869ff1a959c79569648485829eaf53d68a598c2dd76

                                          • C:\Program Files\7-Zip\Uninstall.exe

                                            Filesize

                                            582KB

                                            MD5

                                            7d497feccb62be3deca753beefc94108

                                            SHA1

                                            744fbb24b70ccaa44cd65447be219c4459cbf487

                                            SHA256

                                            6d1ea6d1259936005bea1140ab5efe6f5a8892530a54ba46b5f53ed2d6896a6e

                                            SHA512

                                            f01ce815a0a261cea191163fb1b07a38daca279a3ae7e7f2ff0604afcde4a0bb0f18df7fd06caac9b8b56810c8909ad509c1c4b17231ab7e27cad365a55f6a40

                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

                                            Filesize

                                            840KB

                                            MD5

                                            e87c1374f8788420d5a48a453754aa1e

                                            SHA1

                                            615a00c0f6b718760fecd965a0887b4e428c534c

                                            SHA256

                                            86a2d098b2812a5da18707e7cda71950b7fb88ea97df91c3e49b40a2d84c546d

                                            SHA512

                                            1a99943bf88b8aa4323318d4c128f8e61eafd320434b09aada937802b32791ef534ba4bbce494b9ddbea651efe29289f49855eb1d955eb9511e5d19699960167

                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

                                            Filesize

                                            4.6MB

                                            MD5

                                            b43214f61e11b36337cad833a221c6c9

                                            SHA1

                                            31ba486125b8776c20d6204473468da8674657b8

                                            SHA256

                                            62eb400f1a6f34b0926a543bb8ccb9ee30d5978483720d432da6f65c3b3a55d7

                                            SHA512

                                            9f41a888fb2eeccbc41271b6e166b6b79de3e69eb4c441593bf8b2ab1ee83e30b18ac1b4a122fe3f5a22217fa880a473dd44321bd956b4e5a0af8a5d933efd11

                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

                                            Filesize

                                            910KB

                                            MD5

                                            5251694f3c77c6f61c8c90ebb7a7f0ff

                                            SHA1

                                            2cc0d293d2a3e57981d29a07caf37df1835ba2af

                                            SHA256

                                            3e0284768375899018e476cc3cdf600040a1f6539903ef27bf4fe4cdd13433b2

                                            SHA512

                                            e1399eafd753e13c87779eb32b788e37f1254fa8a5b42c15f0995927a71b5b47f040a08080ed663784dd39d448edc2b9f8c112643457c2cb44aac5ff613509b3

                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

                                            Filesize

                                            24.0MB

                                            MD5

                                            1807193ade8c2779b523a23229b344f5

                                            SHA1

                                            6af7b31a83a442bcc7d95fe1a6e924f3566bae3d

                                            SHA256

                                            27f3b99e8ed18081cc28b9d3c14494add23b42acd13293ef0d0be09dfbe5fd4b

                                            SHA512

                                            4a5c86201b3f279e34ab73668d3bdbf7e39d9aaa7a41078decea0018a52a5b144ee9a53d365551853b6574e72f99addf0a9c333c81eac0501499562c5a4ef536

                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

                                            Filesize

                                            2.7MB

                                            MD5

                                            011a6590d6f39b84fc934d3bf626ffbc

                                            SHA1

                                            498a8af11d428cbf1726bd8ecf7bdf6166748baa

                                            SHA256

                                            b73e08e1fd624431d04afa54a11ae9d7b8785e6a9ea52cbaa49bdd35c874aaa5

                                            SHA512

                                            96fbc5d9a389dc6fe9d6a86484112f7059624cab91ba1ab21b27a75c54336d75caa737c2068427fda21607d2544d7ca2a4c4fed2e14a2e973d5995b0773c8792

                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

                                            Filesize

                                            1.1MB

                                            MD5

                                            aaacac733152ea1d38f74384537793ec

                                            SHA1

                                            a3ab235ed999075d42eb155194ffc43071111192

                                            SHA256

                                            f1e23c1e98f64fb7ca759473fa77bb868bfe30d81b50d56f9af2235140c2aa54

                                            SHA512

                                            100b40af639c484b0e66d47f60173256a281d6cdf007b6042784320c6e1f78d963e8932a98ce490cc28f610d797f08d575504ad2f8002d46baef8fd030a2b00d

                                          • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                                            Filesize

                                            805KB

                                            MD5

                                            4158ecbe1becfe8e307e72d6cd09a1fc

                                            SHA1

                                            a0f23e4ccf4c928b79e09655364c8b58135bca80

                                            SHA256

                                            4786d47e216ba1fe8c00397bc6e3d417a64d5604058419cb561feb6a2f6c9e7e

                                            SHA512

                                            fec43dda9007ccaef1e3cfa0c73ffd0929c59be36e0ad39bc973bf19e1ae1a244efb43cf89c4fdee96f93abe8f3a8c6ff05b6d8ff6209b39613e7815d0b9482e

                                          • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

                                            Filesize

                                            656KB

                                            MD5

                                            c8d2fbb244ee34d35e36db9b867b0e4b

                                            SHA1

                                            77ed1dc31704af6067d0d03de08e3221e3c54d0f

                                            SHA256

                                            532698227289349de5406e759bd13b75d3c78c79d4043a00c1301a6158d68376

                                            SHA512

                                            ff0b38c26fe6fd94494a7102f346b992d7550537a8cc5573622f30f6d0b505bb22200c99f63f745af654ef1a6bd30638048a4f506649e384c1828baf68f153e4

                                          • C:\Program Files\Crashpad\settings.dat

                                            Filesize

                                            40B

                                            MD5

                                            268950ab73d1854104eeb4f6d4793128

                                            SHA1

                                            757d3749ea559786c560d5b973561f2f997e50f6

                                            SHA256

                                            c9abc4c8dec9b51d2ec8d156bddce7e9c6d71ba3fa70e9fa0dc3beb20d99a8b1

                                            SHA512

                                            90884d54c91b90d1d9cea23ecea2cf0e3e78f6303c7106b0d1350132025d7b031a3dfef5445fc0ad71094993ed31f4de4c9194c9573b3fe4e1216294b847fa14

                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

                                            Filesize

                                            4.6MB

                                            MD5

                                            ea278ce84e609e7a40a99cabc11ad585

                                            SHA1

                                            17a6099ad45bfd759bff4585043770e84cd525d0

                                            SHA256

                                            1b51a6560975ae7bee8bd9b2ddbf6d6cea4a9b62a0c4124e51844ad2321e62dc

                                            SHA512

                                            b6d497e503c06a5f612ae556bc549cd5b10cb35f15932d3b1ddd721308054c12a8675477a7ec48f769c9c5d7dd0f103f891fdd19e7ea86512062a2c83a12568d

                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

                                            Filesize

                                            1.9MB

                                            MD5

                                            226ea9ab2c00f3b569d42ebcca212081

                                            SHA1

                                            75ab10853c27e44d1adaffdd37ad9847c8895047

                                            SHA256

                                            98a68e64aa660a0950d0639f03aac122064bfa4e60dadb2d08099cbb51243a74

                                            SHA512

                                            84c86e5f5b9c4a0d1305f6619b44bafed2ba02409b94d2ac2deb79a0d626ddd371e4d93f4bee6c7c77559bb8cf70623583114e74941a4778754a6e71b0679689

                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

                                            Filesize

                                            2.1MB

                                            MD5

                                            6b69d3f0a81fa88bd0dfe0d7e9163442

                                            SHA1

                                            e0e6867ded817f1f3382fb877703e137f4f60934

                                            SHA256

                                            abc8b0f7d64e69f487ba165548fc5fff6e325cb7f89aa6ee27efa74637ad2dc3

                                            SHA512

                                            1d3a0a419911d54b5d43e50d0958f2f9ca77634e303c48975b7e696a8b5fb8b6df638d237080782959a9de0a82fe3a2c71f49e6c2386183e08fb3c2f07740781

                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

                                            Filesize

                                            1.8MB

                                            MD5

                                            33bef410c8dff756fe9efd68835eff57

                                            SHA1

                                            db3911aceabceb7e99f519f882bcd0863d00ca64

                                            SHA256

                                            5e979cd2748e2caefabba14eb5f0cc8eb3ea0f2ae6e0e31e7bf3901495f23e6d

                                            SHA512

                                            f379ea03b8d550405f99cf7bca54282955d0bcc9e5b12d0d69b116847956f8ec37ab5e2312d4df92b45e9dc31c154bdd7d2e735048763f873e29a98b753c2845

                                          • C:\Program Files\Google\Chrome\Application\SetupMetrics\d6024049-776f-4ff0-ab95-3a2492c97d94.tmp

                                            Filesize

                                            520B

                                            MD5

                                            d7bdecbddac6262e516e22a4d6f24f0b

                                            SHA1

                                            1a633ee43641fa78fbe959d13fa18654fd4a90be

                                            SHA256

                                            db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9

                                            SHA512

                                            1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1

                                          • C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

                                            Filesize

                                            1.6MB

                                            MD5

                                            22b684fb8b4dbdd5c563cef42505aa20

                                            SHA1

                                            ae4939a7645549bf25d017b4ea68e02836ed3e9c

                                            SHA256

                                            b48df3389713eed5e9934be54e06a69a71b579a5ae87b75088f43d41ba001e42

                                            SHA512

                                            4bb22eec5edd631945a7bee76de1ec0fe7ca582cfdd496a2883696bd5d76119ac978621cc2ff96f569059b563ec3ec74e8a8125268846a66868ceba56c03c215

                                          • C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

                                            Filesize

                                            581KB

                                            MD5

                                            5d5ecd4c3e518416354ee7c0c3637aad

                                            SHA1

                                            62aedb6fe3145cf594014297983d5a1dadd826dc

                                            SHA256

                                            dbe163ef7f4e3317b0039b18203f9c8088375cda21fd70d1516b4443d7335d4a

                                            SHA512

                                            d208592902570f7eba0739144f75002c9b01e2cf79ed1b41089fd9cd38cf67e076ee6d3fb9808ffaeb22986cb8685a69054f7ad0e52801dfb88ebeccc7e5c120

                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe

                                            Filesize

                                            1.5MB

                                            MD5

                                            5a34973e6b6729db42673b40d74127a9

                                            SHA1

                                            9590d3fa82950f42592c58ed9b7b1973ee44afd2

                                            SHA256

                                            d3e488bd15b33385c56bf3e77e9dfdabd180a3b1b5bf1d79e5321709d187156c

                                            SHA512

                                            772cfeab750248a3862bfefbd5efdc4f6c5ce2471b80eb7bb87cca72fc05d216a16aadba1b2e8b2529ba465873a75fb31561dda78fbad18a5194b12b1ffcced2

                                          • C:\Program Files\dotnet\dotnet.exe

                                            Filesize

                                            701KB

                                            MD5

                                            6d9507caaeb1bccf263c4589f44476be

                                            SHA1

                                            e4ea559634c1c2b700bb99c71216bf374e50d827

                                            SHA256

                                            cab2654eac038a3748b9e29e38933630620b1267f5cd10704684d51d08c34817

                                            SHA512

                                            bf6fb065bad131ede78368d2579d17c60e53e8cc36497b5593994bd30812859aa0940d0311a90830f78f3ceebbc5db66da1b9dc886c44521c9f91a78910e6523

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                            Filesize

                                            40B

                                            MD5

                                            980ebd34ef8cdfa9900dba4fe367d2f7

                                            SHA1

                                            35955645e6324fce99a971a5a80ecae0fc21d971

                                            SHA256

                                            d5384308d29f2f9478f0d1354e9f94053300496f3b7cd2f88f5f8d00dbe1482e

                                            SHA512

                                            470cce060f4dcca34b26c8c3b2d3d4024c12fb4631ed8251e942e7e992149a422f30526b27f9f55c13d5d9581f022d3b18439893c6b0455180ae70c0fb24430a

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1d93ec0c-5ed8-4c3e-87b8-bfd8b4e09d42.tmp

                                            Filesize

                                            649B

                                            MD5

                                            d4f2b2abb6b761a94af66cdbaebf15cf

                                            SHA1

                                            ec6442a1e7ee3cf397b08595ba9eb66a5e75253f

                                            SHA256

                                            550c990e99f2e4013ce4d1cdfea7bd284a0ffb20ebf30493f7b48eadb60d9be7

                                            SHA512

                                            bcc7a6d1f1222ba329a8d58f7de7085a4443ccb292127347db2c12d3a5b20a90fd65b4c92ad2748db237b3ebdae1a510eb46a026d91f60cf23b30c0e50f46128

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

                                            Filesize

                                            192KB

                                            MD5

                                            a8cf54419129b874864cf206392ece0f

                                            SHA1

                                            2d8f78e5d6951faedba3257d5794227f34c50967

                                            SHA256

                                            b8a7649c907c010db609d7143f3f0601a385b9cf803f4b0bddb449c41151cc1f

                                            SHA512

                                            02a77857be5123636fdc44791f6cf7a4532fa53e34576be7f6ab21da51ef400fc138d7dda6a2880b2b42ddb22a803a1897e4f95ea3479487af61a199c7929a8c

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            2KB

                                            MD5

                                            52e669e91d3e240ca7a2e4e395309762

                                            SHA1

                                            d8431736659d82d82935a93293c1309953c803d3

                                            SHA256

                                            623bf19fe9eb234e29831ebfe026dab093133be03ada88bf85a112d2c9d2e599

                                            SHA512

                                            7293309101255836a14a29d54aa501f7ce435e15fc297de763e9e372ba21b0639731ae8b0efd76b446c8023362069783cb5aa90be5b388fe04775f5e60dd7bc9

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                            Filesize

                                            2B

                                            MD5

                                            d751713988987e9331980363e24189ce

                                            SHA1

                                            97d170e1550eee4afc0af065b78cda302a97674c

                                            SHA256

                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                            SHA512

                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            356B

                                            MD5

                                            2b41bee05a097fb1d44aa5a1c3a099a7

                                            SHA1

                                            90e18814ad331bcf87b5dd19498e551f9a106468

                                            SHA256

                                            eb1ddbb759ca055cce664428c43a54d21c9ff754930ef26341ebeb3002872ae1

                                            SHA512

                                            cc6cb8144bf0d5f9063c7c9f376d6414c5e76818acb4e9ce4c5eeef6320969b3dff21824c6f739708aba14dbaae13830b75ace0b74a5349eac491b5184c5d935

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            6aec14b9d80a6a18a5f77c0826c1740f

                                            SHA1

                                            dfd071b72692d63c99074c607e1b95a7fb31d769

                                            SHA256

                                            6ca7a505615d6716b806e4aaf67124c086896459722073be746ae360b768c0f8

                                            SHA512

                                            ce39c96fb154cd4056dbeea7d363dff1ecccc84f9d32b8f65278aec7649ea95caba665ab8e947a206f7938b8a621368fc35f93c4804f70805e9d66018563b337

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            50d6d0caecf2c5b76ce2be1eb10c4c02

                                            SHA1

                                            5d4e093ddbbc88bccd0b1543bdc57680b7f5dd04

                                            SHA256

                                            952abbfb3799a319e9eba520ebc61c2fac835dc2abdb0edc26a0e119dcbad575

                                            SHA512

                                            1ba06231b3491aac8367259b7f7d16cec59b587877da84ff8dde18623c549b2da83d9a55c69a6c080e308d0f48734057e38482b3bd83afb086703c0fb70f2e61

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            de9bd00b5eb795767a9ac1fdcb9f6e3c

                                            SHA1

                                            167e11f3fba366eaee459184e66eed078365a8e8

                                            SHA256

                                            7f19d801dc4226468a0648d6f069522e60329279f15bf79eb4d363f0dda13267

                                            SHA512

                                            9cd80ffb885ce44e3bc34cf945d895edb23db95df78154d1d1856655735a3ce809d91b22f333225effccc9ef84e8aafee5dc13a67a941745723daa2f52d47a90

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            934b10e7fc69ff2fa664de999e19cf07

                                            SHA1

                                            c75f0a61d1a61f55efd04fe95e35db6970a51a3e

                                            SHA256

                                            c0fa2ecdc8d6da43139110467fddd9e224649b6b0ec2e2e5d0f2e9973d8cc8ea

                                            SHA512

                                            8e60bb8233099af9a79828167e286a7ffc46cf67091c01319f398f0d3ae0ed733701d912373f714fd5101b56aa119b3a7183e60f26680845c4b199b35aa91333

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            c3ac620803ef7a91eca6c54df018ed4a

                                            SHA1

                                            387cfa8b2612f2c41ed1cd29ed613685a76976eb

                                            SHA256

                                            d2ea0f363463da7bf441db0f4d00ce88e5934e9e21313a174ca7c7a635a4336d

                                            SHA512

                                            6537a7b37fd221f512d6af7686547fc5da74a9a96d2010da1d6f34366b0a1040ce2da1efbbd95b6a3c7dd99fa73100efd2a5422b45fbe33f9a777f6ee6d3c96f

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            9e15f0e725c9e685b3089ecd0c52874b

                                            SHA1

                                            35f3c4467f4fa40d9f261d5150bb41c2629f3439

                                            SHA256

                                            9268757db927b79fd169bf4e8996331af000ad63572ab166b5694bbb6723ffa5

                                            SHA512

                                            adc2ff83d73d4ad212d8b118ec4f9eab334a0ac81e6f47367d56c4de8d6274f421c6089692cb374dd9327bee7f7a776416804f0a238abb23a59fe6b9b2a8e664

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57d031.TMP

                                            Filesize

                                            1KB

                                            MD5

                                            0d4b3eeb6b4343ffcc5a9aa997f52bf4

                                            SHA1

                                            28c9da82e5539ed572b6fec079b554fa8aec4ea1

                                            SHA256

                                            6fdef3a9e405c12f661f27b154905fba6a07360e4637f2a26766121eea57461b

                                            SHA512

                                            1067628201faab52f28d364cf83650f2368d9921c4459a8d388a863a15e15e850a9a61ec0d36158b9f4d590ce93bf8619a6ba2dda94786f6d6527fa824775aa2

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                            Filesize

                                            15KB

                                            MD5

                                            d4ed2781d9d935a2a9f33e946360e39d

                                            SHA1

                                            6e3dde6e97596953ca5883a1fdb7489b886f86fc

                                            SHA256

                                            2a6353d703b0317e2c3f337c3d8ebe8b1fbbf1d307cc48575622617db63432f9

                                            SHA512

                                            44b3da4b8430e0fc32814214344d2fc2b233979c8ebaa9a8ce73f52cdf71802f00b2ad3950b35667d1307f1e09d6acb1821e7483e173a546dbbfe3025e0afcc3

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            230KB

                                            MD5

                                            7060688eca838f7b3cd34fe724b687be

                                            SHA1

                                            99eea3943a1517bf74be38b212cfa509fb01f119

                                            SHA256

                                            54ed4fbd22e74a0d5e271835ccadd47d4f702401bb8fcf79b4a6342ffa2f38f9

                                            SHA512

                                            ae95cb40d6a7ab571d799e65381b8fa19a48d318d4ab5ef3d07afc8c1a95c3c3a52c10044d2b49e19746738b1cf2d70e1cd0fb4d337e5f28da82280548f27831

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            230KB

                                            MD5

                                            e894c283ad978233b0ac7ff1551a747b

                                            SHA1

                                            8b8e1102cd8113f28a64a5085fb54a9ff78ba593

                                            SHA256

                                            11bfe5c45ba7d02815c81afaa3421ddca8bb9453ed39f04ca0d2139b83f7c421

                                            SHA512

                                            d560ac97209b0c0be9b061014afbfd1624ebb5d468ff6446e9da0c3b0400f96840b92dc86e217a185004c93a4a31c3cddd2c03bb4669ad51fa61a6092d3b10fa

                                          • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                            Filesize

                                            7KB

                                            MD5

                                            fd811e39389be378da5f4e0e94f4e633

                                            SHA1

                                            b7b3fc6ebc0bd81b41bfe6c21230e62ba37b81fc

                                            SHA256

                                            68b28c8a5c4c5adcbad0a35662812901b8656478ccb6caa297ed455a1c2e6a1b

                                            SHA512

                                            923eb69fea6a8f796a088a41d8579653ef6de6468e0ac7a907976e8834433268a61ecc7e3fdbb413a6edb0e6b73998d762496f4c351418518163f992fa196251

                                          • C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

                                            Filesize

                                            8KB

                                            MD5

                                            4f8a0a013846637c607579d5e476932b

                                            SHA1

                                            9dd432a8f5c537da2ec8446da5fb09ec9e30683e

                                            SHA256

                                            7bae7ff0b37d40bbcc4a51e1486ffac4aa04c4666481512366c842b61a7d49b2

                                            SHA512

                                            2ce804f7674753af467df4bf1bfe72d80220d77da851a11c9257b383e5b100028b13d678edfda4993eb91a40fe38defa5e7285034dbcbfbfc8bee8f0602c970b

                                          • C:\Users\Admin\AppData\Roaming\fe466e5b38f5360d.bin

                                            Filesize

                                            12KB

                                            MD5

                                            6b6fe1a084d8ee3eb78b1c333e9fcc16

                                            SHA1

                                            d97457622f568e403a8934d485688165e649b2b4

                                            SHA256

                                            e8693bf9c00c91bd764867a87b9d47130227a24cfcc1686f8fb95818eeda6332

                                            SHA512

                                            3329953db6e91aaf3ee22a141a2fbb71a8814c40776a3e0e37622ef6fe5ff83a2fd0aca440a77fee1f9ef4caf3c1d167a62a34617a39e24b6b63bf9c56add5ea

                                          • C:\Windows\SysWOW64\perfhost.exe

                                            Filesize

                                            588KB

                                            MD5

                                            a44439a26283b9a5b1a1b97dad218c15

                                            SHA1

                                            57227233baf82b02247d34194dd6b6e240749a8b

                                            SHA256

                                            e87ef632d57f28ba886eb1c49534f108a2f9cd88a9a96bfaca67ddfb86dd7e0f

                                            SHA512

                                            e123185140de0ec00bebc4c7c3640f9e066b9f57a12c091b8669dcaa6d2aabb6b50ec74ba7427381e521c759f0dbe28d721e9e7c1a24965f40f31b51693dabe0

                                          • C:\Windows\System32\AgentService.exe

                                            Filesize

                                            1.7MB

                                            MD5

                                            1eee3521726b6680d1e395729a5ad400

                                            SHA1

                                            f0f6304e1e6f9c15b37c8d0c987ce23b9071f556

                                            SHA256

                                            d96d5625504dadb990db5084368cd463f0f4605af659d4873a31a2f7fd7991de

                                            SHA512

                                            7c08dc7909537614f7233d7cc16241b9540da95ca8af7dd2a33d55c465a3512cf2b6f0206d63c732c8ba9adc3d6ad2a6010555a611b405c13b039c4f13213978

                                          • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                                            Filesize

                                            659KB

                                            MD5

                                            2ee2281c1c05cbe162745f7014a6ce32

                                            SHA1

                                            8f304afd39934240b108600323d584a3db6232cf

                                            SHA256

                                            fe83def7ee783f443f96c6823d53b92a564513219f6b84b9bb3746cd865fd254

                                            SHA512

                                            35798bff1aac00f53416abd8b18597fc2d8c6a92fe556f15b1626ead78aa334770d1d030876759f2ad9dda1e54f9c061f2b273a0f1f77c52a13169806b9e6afa

                                          • C:\Windows\System32\FXSSVC.exe

                                            Filesize

                                            1.2MB

                                            MD5

                                            2c8e0729e0092c87a46957838878a0f7

                                            SHA1

                                            32cde4f2ce48404e2367f3674a59617ea82b815d

                                            SHA256

                                            9d6938a9003edef828a976f5e5d1526cb00845331915fc4a19842a0ded351b03

                                            SHA512

                                            13d0d4af6adb788a0f468f2bbd373b8631d7e10e1922197eef52a4b42113f11833cf94d69b8eb6cbe858b79ac2970f7d2610ac5f5768275f2bb829f7d8feba10

                                          • C:\Windows\System32\Locator.exe

                                            Filesize

                                            578KB

                                            MD5

                                            97b835499ecbc55479b714ab21ba9b84

                                            SHA1

                                            2adbf04afaa9827f815fb4573185b9827091c578

                                            SHA256

                                            083333e12e19313938acf961669b517755653a8850a5d3706563f211dfe7c9c3

                                            SHA512

                                            cd5041e65f6f5feed79cfadb12a0378634430b7fd91c2b57ebbe78bafbb711f096130e544e5f53262d7908cd169c9906be53d2339aaa509f5004737c7f0b42c3

                                          • C:\Windows\System32\OpenSSH\ssh-agent.exe

                                            Filesize

                                            940KB

                                            MD5

                                            04e91bb0d6fda2511b865b01fea0dbf5

                                            SHA1

                                            8a380505898a7a257f2f3c627168a60ecc97c0a5

                                            SHA256

                                            73927073974099e607bf4ad1da46f134dbdd2362de969f1738adda9f4af2ec3c

                                            SHA512

                                            58ba71d70e2e454a32c45d348b24b2e7c9479beb327f142dfc88e99f3c327a9887e1ab35587c4ab863869ced45c8ab52dfa534a4d302a4ecba0e564d4b8b9200

                                          • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                                            Filesize

                                            671KB

                                            MD5

                                            db4f200cf13eb33f1c8dcd470919f9a5

                                            SHA1

                                            75e2821da21bf366696c5a8f3e7c1c6fb51feba1

                                            SHA256

                                            204f6beded02994e47bbcfa534a9c95209246c3ad528652ddd53e4f580aa9b2f

                                            SHA512

                                            e3f31d2ef10df14565c1f2ac6eaf9f602fe6f3c23c7ffe4c0377dccb35b2df81603eb58039f464f21b174ba8891220e2b2784364a9675d6a9f68a81388d672c3

                                          • C:\Windows\System32\SearchIndexer.exe

                                            Filesize

                                            1.4MB

                                            MD5

                                            baa77f5858eb39b43cf88fe67d67ac23

                                            SHA1

                                            94abd8569e2415cbb743fc3faff735b8735d4a36

                                            SHA256

                                            0d80a810eb37ceb3bfda333bfb7aa5fb29c4dca0d00f265a83cdbd668778ee15

                                            SHA512

                                            be16a03c9582fa371436779efab0184e09a7aa58bb4c71c3459726d221d31cdddc8eb22268b7e0d3a4fddf73d4bae408e8459cf2594820a02e10fab068c0ff9d

                                          • C:\Windows\System32\SensorDataService.exe

                                            Filesize

                                            1.8MB

                                            MD5

                                            de092c89f241f7afb7d42da30c92c21a

                                            SHA1

                                            399b591acde4801e1cf478404dcd29addc5777db

                                            SHA256

                                            fd0b040cad094dc450f552f28720238cea42d7c3fafd591577688a6cf232e855

                                            SHA512

                                            2cb1bf095fff96ced136fdba4d723db7725096ab354352eda4200a1b875c7c5572e15a31a9abb0a14b06c67521b53cf2bbcb9ca5613be45b854b3a29ebfb8766

                                          • C:\Windows\System32\Spectrum.exe

                                            Filesize

                                            1.4MB

                                            MD5

                                            2897f95495905fed166b8525b4c12b9f

                                            SHA1

                                            0b540b36d24e62817bc67e8d9495e222e65fac54

                                            SHA256

                                            24331846a8753189405050a96d359551b45c3c31e5c97fd39be79535e5912b2c

                                            SHA512

                                            dac7122d1f8dbb2bcdddcaaf9942f4f82795426335e0e9afb9081a93624c5ea83fe8ffe1b2ff9bc65253d49e7f3b9e4ee5fbff0edb4b64b0f389bcbb7aa35e34

                                          • C:\Windows\System32\TieringEngineService.exe

                                            Filesize

                                            885KB

                                            MD5

                                            86382f3c22e034e558a2eef2783cfa2f

                                            SHA1

                                            5f503250414c2c5b3c4004af8a99022b8d20981a

                                            SHA256

                                            46b9d701ac547ab7783409eeb05b5be2dcfedf40864e6a5257e36f5019e0bca7

                                            SHA512

                                            9b1c16e6f766a018c225063e6a98922c6ae3cc345ed94bf5cd31c3258fceb7b9511d7f7532d05043989580aca1f85c5506a2b2a944d0c0925a99ef99ebb28654

                                          • C:\Windows\System32\VSSVC.exe

                                            Filesize

                                            2.0MB

                                            MD5

                                            b788b472e27323fb8aba5b5030ab561d

                                            SHA1

                                            1e0193806621689cbda0abb8bc44a71502000115

                                            SHA256

                                            32e578545e0143b72adeee3b9bb06b079b2b2f9e3912ba6d2197b2c84695b3ff

                                            SHA512

                                            95902f3d67ad10c20baa530c8900a4a1c4e51314f99701a44159abacea51f5ce13f0b0e331a7fffd2b4e0dadfd8a2b7d2cb2bfe6d208c7ff2d15cad1fad2a8b0

                                          • C:\Windows\System32\alg.exe

                                            Filesize

                                            661KB

                                            MD5

                                            9016e9c12e1b2515192a4678cd552b65

                                            SHA1

                                            a509afa06e1f7a3db78300c45a2f7f8e3dd0a7c3

                                            SHA256

                                            f9edae6524483798574ce2e4b60975d0ae9892aabde51c8083fe17344730c197

                                            SHA512

                                            24fcc53d9f7b892f6e483d3c860c1d63de7fb7c0dfb6b920c40d1406260212a15503387b45d8f043d4a70a5774d3f19ad05b6b9e2bd2d0b3562ffc67da0410b2

                                          • C:\Windows\System32\msdtc.exe

                                            Filesize

                                            712KB

                                            MD5

                                            7dd128a18744fa4031868994434c8a9f

                                            SHA1

                                            e13f00a88e137b4927dd43174c1710a44ccd9044

                                            SHA256

                                            a1f14acb4531fb31c452d1d387dedb1468dbb7ee80447e2b78cadbf613f725d4

                                            SHA512

                                            a5b610946a956706b945ab6c2a47f5061b350220044c0e0e2637d01fb331dcd873af80b8eee0d21b7dbf2f0626bbef08284833f9a0533ca7096a7299ec0faa37

                                          • C:\Windows\System32\snmptrap.exe

                                            Filesize

                                            584KB

                                            MD5

                                            76e66ad5656bb42db70261b82999a4c4

                                            SHA1

                                            98a6180efe968d29e3bc50ee09ac9ee6ebf68333

                                            SHA256

                                            d38276d60b03e76e6b21926d8424d94f581f6f159917a61500034a8371684cf3

                                            SHA512

                                            80a7f2c6c71d09081e9e8533c8c344c4bcd8c8051d016a213f7673e14cb23c88495b8f895f0efe630acd91069fe359d8510b23cf94fc3f7ce5c70bac73ad702c

                                          • C:\Windows\System32\vds.exe

                                            Filesize

                                            1.3MB

                                            MD5

                                            3ab71fe305192b567394aae24e173348

                                            SHA1

                                            acc1fc8d13d25fcbc6d3c5045231d33bdfd130ca

                                            SHA256

                                            2d528b8dddc76083a183542149cca2f5a08b7e71477a1fdd7676444d3366af2e

                                            SHA512

                                            c4b3e3097c1904d47ab8fa100f10c925cb88aa181d46b9b73977626fa04ff2a6e483e6960692e3c9aef8c49b4372409827a7724ac4a54ac6001bcdea310e5615

                                          • C:\Windows\System32\wbem\WmiApSrv.exe

                                            Filesize

                                            772KB

                                            MD5

                                            ffb8e2c80fb783b53255b037a3f380ef

                                            SHA1

                                            c24a0c6c7ef0e990a6fdb20dde30754abba6cc5f

                                            SHA256

                                            255e9d8b8f1c277d47bf08cc0671287458150c395d23dc6eaf8b2e82659b7234

                                            SHA512

                                            5487bd789b5cb25e2842038cfaa5f2fce89e973c405a46dd257a7e3b1ab29fcc94462c1510aef51b0c36f59f741b6cda7bb3dba5b8d8132e96886d45e96898e4

                                          • C:\Windows\System32\wbengine.exe

                                            Filesize

                                            2.1MB

                                            MD5

                                            9116f8e7c70d22f388c8440cce67a81e

                                            SHA1

                                            b3f52a6eb843fc141c7b2723165befb4f7cc32fb

                                            SHA256

                                            de3ee5fe618b835bdcf82c9cfe886b2637546cc441693d1d9b566b57096f8146

                                            SHA512

                                            b2e8678a939c35089e6ac933e4204a3e65c30e39bf59c67cef3845f47f067cfcf285ee4880b3673759c3018ea1afb40b38ade90886e61c06a70eb774c3a819a2

                                          • C:\Windows\system32\AppVClient.exe

                                            Filesize

                                            1.3MB

                                            MD5

                                            6fb23646adfab92cc62377fec6b9b9f3

                                            SHA1

                                            eb1ea63b8ad9dd15efa706f6e4f7a4d07f83d149

                                            SHA256

                                            37d391d719fce6804b15e4733514d9ef3e9c83f8be09d06590efa5bec0354616

                                            SHA512

                                            dac924a01be133fb0f104cf157caf453506dfc5b38cc6be68e635274b4a147ee859d51732b5d51edaa94b89cd098b01d7fbea065ec4963ee03fecdcf4e623207

                                          • C:\Windows\system32\SgrmBroker.exe

                                            Filesize

                                            877KB

                                            MD5

                                            1b36f029e66ab7c367ec666832f2fac2

                                            SHA1

                                            0e33b8a9da4cf0aa20225a1d3c85d25d16f106f2

                                            SHA256

                                            5c480706d735cfe435901b2e8ba79a9f7aef24aac94bf28cbf52e7655d066f4c

                                            SHA512

                                            f1486920c75e93cc501af5e426d4fcceed6ef140e3db7a319c5de7e400c18bd4bda68bd344e64a7f44c4a1d4770cd27f7961e5313205e34122ccb1c827d7014a

                                          • C:\Windows\system32\msiexec.exe

                                            Filesize

                                            635KB

                                            MD5

                                            84321c48d91aa33276c5139706f61e78

                                            SHA1

                                            70763a07e6f0e38de9491470fd9f20fecf542a90

                                            SHA256

                                            4d3de470849ec4ac83cf67e8049deacf14c7c95438265e6505c9150eaf2d9c3c

                                            SHA512

                                            36b61864dd936573f08ce4428863f1738895dfa8fffe4c62d6a9ee6ef2a30cef4b39c72ae907a6090fe1522d10c29f41b7fc5975a07b55bccb1d3d0f01fbbc8c

                                          • memory/992-85-0x00000000001A0000-0x0000000000200000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/992-125-0x0000000140000000-0x000000014022B000-memory.dmp

                                            Filesize

                                            2.2MB

                                          • memory/992-248-0x0000000140000000-0x000000014022B000-memory.dmp

                                            Filesize

                                            2.2MB

                                          • memory/992-91-0x00000000001A0000-0x0000000000200000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/1056-178-0x0000000140000000-0x0000000140095000-memory.dmp

                                            Filesize

                                            596KB

                                          • memory/1056-317-0x0000000140000000-0x0000000140095000-memory.dmp

                                            Filesize

                                            596KB

                                          • memory/1192-133-0x0000000140000000-0x00000001400B9000-memory.dmp

                                            Filesize

                                            740KB

                                          • memory/1652-196-0x0000000140000000-0x00000001401D7000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/1652-334-0x0000000140000000-0x00000001401D7000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/1652-586-0x0000000140000000-0x00000001401D7000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/1952-231-0x0000000140000000-0x0000000140102000-memory.dmp

                                            Filesize

                                            1.0MB

                                          • memory/1952-558-0x0000000140000000-0x0000000140102000-memory.dmp

                                            Filesize

                                            1.0MB

                                          • memory/2392-249-0x0000000140000000-0x00000001400E2000-memory.dmp

                                            Filesize

                                            904KB

                                          • memory/2392-574-0x0000000140000000-0x00000001400E2000-memory.dmp

                                            Filesize

                                            904KB

                                          • memory/2424-162-0x0000000000400000-0x0000000000497000-memory.dmp

                                            Filesize

                                            604KB

                                          • memory/2424-305-0x0000000000400000-0x0000000000497000-memory.dmp

                                            Filesize

                                            604KB

                                          • memory/2708-159-0x0000000140000000-0x00000001400AB000-memory.dmp

                                            Filesize

                                            684KB

                                          • memory/2708-293-0x0000000140000000-0x00000001400AB000-memory.dmp

                                            Filesize

                                            684KB

                                          • memory/3428-53-0x0000000140000000-0x00000001400A9000-memory.dmp

                                            Filesize

                                            676KB

                                          • memory/3428-54-0x0000000000680000-0x00000000006E0000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/3428-45-0x0000000000680000-0x00000000006E0000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/3460-208-0x0000000140000000-0x0000000140096000-memory.dmp

                                            Filesize

                                            600KB

                                          • memory/3460-461-0x0000000140000000-0x0000000140096000-memory.dmp

                                            Filesize

                                            600KB

                                          • memory/3764-29-0x00000000006F0000-0x0000000000750000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/3764-161-0x0000000140000000-0x00000001400AA000-memory.dmp

                                            Filesize

                                            680KB

                                          • memory/3764-38-0x00000000006F0000-0x0000000000750000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/3764-37-0x0000000140000000-0x00000001400AA000-memory.dmp

                                            Filesize

                                            680KB

                                          • memory/3924-255-0x0000000140000000-0x00000001401C0000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/3924-268-0x0000000140000000-0x00000001401C0000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/3940-527-0x0000000140000000-0x0000000140169000-memory.dmp

                                            Filesize

                                            1.4MB

                                          • memory/3940-219-0x0000000140000000-0x0000000140169000-memory.dmp

                                            Filesize

                                            1.4MB

                                          • memory/3960-271-0x0000000140000000-0x00000001400CF000-memory.dmp

                                            Filesize

                                            828KB

                                          • memory/3960-135-0x0000000140000000-0x00000001400CF000-memory.dmp

                                            Filesize

                                            828KB

                                          • memory/4228-95-0x0000000001A90000-0x0000000001AF0000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4228-107-0x0000000140000000-0x00000001400CF000-memory.dmp

                                            Filesize

                                            828KB

                                          • memory/4364-110-0x0000000140000000-0x0000000140135000-memory.dmp

                                            Filesize

                                            1.2MB

                                          • memory/4364-62-0x0000000140000000-0x0000000140135000-memory.dmp

                                            Filesize

                                            1.2MB

                                          • memory/4364-69-0x0000000000E90000-0x0000000000EF0000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4364-63-0x0000000000E90000-0x0000000000EF0000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4580-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4580-8-0x0000000140000000-0x000000014033D000-memory.dmp

                                            Filesize

                                            3.2MB

                                          • memory/4580-27-0x0000000140000000-0x000000014033D000-memory.dmp

                                            Filesize

                                            3.2MB

                                          • memory/4580-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4580-22-0x0000000001FC0000-0x0000000002020000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4916-132-0x0000000140000000-0x000000014033D000-memory.dmp

                                            Filesize

                                            3.2MB

                                          • memory/4916-12-0x0000000001FE0000-0x0000000002040000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/4916-20-0x0000000140000000-0x000000014033D000-memory.dmp

                                            Filesize

                                            3.2MB

                                          • memory/4916-18-0x0000000001FE0000-0x0000000002040000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/5024-183-0x0000000140000000-0x0000000140234000-memory.dmp

                                            Filesize

                                            2.2MB

                                          • memory/5024-74-0x0000000000510000-0x0000000000570000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/5024-82-0x0000000140000000-0x0000000140234000-memory.dmp

                                            Filesize

                                            2.2MB

                                          • memory/5024-80-0x0000000000510000-0x0000000000570000-memory.dmp

                                            Filesize

                                            384KB

                                          • memory/5176-272-0x0000000140000000-0x0000000140147000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/5176-578-0x0000000140000000-0x0000000140147000-memory.dmp

                                            Filesize

                                            1.3MB

                                          • memory/5280-294-0x0000000140000000-0x00000001401FC000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/5280-587-0x0000000140000000-0x00000001401FC000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/5480-306-0x0000000140000000-0x0000000140216000-memory.dmp

                                            Filesize

                                            2.1MB

                                          • memory/5480-588-0x0000000140000000-0x0000000140216000-memory.dmp

                                            Filesize

                                            2.1MB

                                          • memory/5604-318-0x0000000140000000-0x00000001400C6000-memory.dmp

                                            Filesize

                                            792KB

                                          • memory/5604-589-0x0000000140000000-0x00000001400C6000-memory.dmp

                                            Filesize

                                            792KB

                                          • memory/5824-335-0x0000000140000000-0x0000000140179000-memory.dmp

                                            Filesize

                                            1.5MB

                                          • memory/5824-590-0x0000000140000000-0x0000000140179000-memory.dmp

                                            Filesize

                                            1.5MB