c6a77b1b8d919e7c33670fc3bf9454b542adb1ed4081ae411622063597d4a82c

Analysis

max time kernel
1s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
Size

5.5MB
MD5

be4d82de41c950562bf196dd324be758
SHA1

c9c633e0fd6cbb7feb6589112386c21335190089
SHA256

c6a77b1b8d919e7c33670fc3bf9454b542adb1ed4081ae411622063597d4a82c
SHA512

ff4a51a866349c653ae7438df107241a24b2e0137b0dff04928435e3bf1df11fe0452df748e3ba5e9509f424f5b9fd4195d7b9fafc4029cb47e1cb5e6bebc2be
SSDEEP

49152:iEFbqzA/PvIGDFr9AtwA3PlpIgong0yTI+q47W1bn9tJEUxDG0BYYrLA50IHLGfP:oAI5pAdV9n9tbnR1VgBVmVrvvRe12fD

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
628	alg.exe
4800	DiagnosticsHub.StandardCollector.Service.exe
1872	fxssvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4a177c064d74bb6b.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2664	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2648	2664	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe	17
PID 2664 wrote to memory of 2648	2664	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe	17
PID 2664 wrote to memory of 3592	2664	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe	64
PID 2664 wrote to memory of 3592	2664	2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe	64
PID 3592 wrote to memory of 1232	3592	chrome.exe	63
PID 3592 wrote to memory of 1232	3592	chrome.exe	63

C:\Users\Admin\AppData\Local\Temp\2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-01-10_be4d82de41c950562bf196dd324be758_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2dc,0x2e0,0x2ec,0x2e8,0x2f0,0x140462458,0x140462468,0x140462478
  2⤵
  - Drops file in System32 directory
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:2
    3⤵
    PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4172

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:1660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:1
1⤵
PID:3196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:5072

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:1132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:4780

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:3804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:804

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2692

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5192

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5316

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:5436

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:5904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:3412

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5264

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff75a217688,0x7ff75a217698,0x7ff75a2176a8
1⤵
PID:5496

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff75a217688,0x7ff75a217698,0x7ff75a2176a8
1⤵
PID:5688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5712
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1976
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:5924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:5464

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5880

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
1⤵
PID:5636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
1⤵
PID:5164

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:6012

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:5852

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5604

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:1
1⤵
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:1
1⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:8
1⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1900,i,10303390199372080887,3373041566560175277,131072 /prefetch:2
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
PID:4036

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeeac9758,0x7fffeeac9768,0x7fffeeac9778
1⤵
PID:1232

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.3MB

MD5
b271c41e6c6d7e9c0c7b947d52824d51

SHA1
84f488bb47f0f2e4e90c37ab06b48c8608dfb138

SHA256
1e0db43cdb86a1ee812433a7add6fdcca8cec8d1916b6799907e1f06da39218e

SHA512
abe30fdbf30279265ef59ad808105f82783f687e4e4d1c1bd6e167a8f366c302c3086be96b7b62982ab96d9fd1460ffd5542468357c674505e7249066b8cb85d

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
3b4053f91c874e0f417207be046be115

SHA1
036f1d5aad590a41e8bccc02763b061c94772565

SHA256
c4c23ea86bf7f2a02d5814831ccdd83eda476cc6f8dbcd220f6d641dea2c5635

SHA512
3ff7d33e86bba934636f6e82a7415a1e0e35b1f9dedc60ff6f36ac5a97ece1e097e1974bea543b3831b96cbaaa53c2ce9dc3af5d29d956fba5ea68cbf052ffaa

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\ff3424de-c1ea-4924-a490-5a57b606151e.tmp

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
1ee9ab37d47954a0d41ce20310266a99

SHA1
58f7df368eb48d56725770dde3afecc2e71dfcff

SHA256
54ec806d3cae8aaccb3ccc21cc5d80e128f8f3127616bc574d0306748f9c5a69

SHA512
cd42c57c4e8ace0a2a151b7719eaa5256d45c91384290bf5d7a9e18c2847a3eea2e59028c599b356ca20ab6f954e68a66e9da9e401847b2fdcc3d498d92a0a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
7KB

MD5
f995adbe79e7b18adf814d955b6cf1ba

SHA1
ab84d285992d6af1ae8ae0b7dc2c189fa214fd64

SHA256
4b9dbb5846a032746ab08a59e07c7c4796161fd6378c4a631ae9c8485f8a86b7

SHA512
9f26ee23f537204f48950dfad58888ed7a32466b4e9c14f525d5b23c841ed8a272f2ff2b4f450db33ca9db1269cb4297e01ca2f97fe98eace58bbf51fbba9482

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
8c2f803d3581bb178fff77acf5855a2e

SHA1
b8a6ba695f3f151741ceb2d6c40f4acada17822b

SHA256
30339542c910dfb8c579accfb32af03e33c40e118e377533e69c2fd75334309b

SHA512
02ae8da4d9d08266a8d7ab9f11cd711439685db3ae2644f479e5e01dac0d9f1d7f7b0ef83aaa6dc9b06b097412c05370d1384be19c5c2beae88851cec0cece7c

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
77e12674e0791e35dca87c6fc4ebfcfd

SHA1
bafe436758e563d959ee37e540917d2e834f39c3

SHA256
05a9b88553dac64bb17f96cc683ad58417480b2155398e53130f3ab40e228630

SHA512
68945287f822ff1f91b1f98a7e490947038f4da28e15b0811a8910d3ee43fbc7d24ea6ee34fdcc78d9cbcf3f9fd67f0263cec88c38ecb2d2115ccee06b999242

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
a2da828275f4be73909ecccd52d92f54

SHA1
7e21b6abfe9c8fe5af9a7e907384ad5eab7784ad

SHA256
9bfc318f18007197259830a792aacafbfec32ae6dbe3535212f7380e18b6bf94

SHA512
da82a1efe2b963c399a41e777c6ae7307990e25191638cabe366d7d003e8243681a4652127bda0dbb1519c5fdd74d7bf364e5d0a8bf9207bcbcda8edba5ee8b0

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.1MB

MD5
226d150b0114681310abcfc1247af4af

SHA1
ffa190e3dbd67ddcf9fbc47a804699336f79b0bb

SHA256
178653182a6aa477acc277d86f8755305c0b612bd10b28af658f9c3396b641e0

SHA512
0569c072aa8e18e63d7ea4d29720cfef8ea8cc5161ee389f6b9043bbf9ab3864e6b9683773c2617e80dd0658cad56e67c234ba294723628098486e9fe0b15aad

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
0717b5d3cc5470110a2613020cf869a2

SHA1
00952b6c9b9dbc65a3e1ae226cc5f50ca2023521

SHA256
f611b8793ee07162da6ab6d5527f49e9e4ff5755d877bd206c5e1c92b21b4e4c

SHA512
0c54499e256b8e601d7645dcf3ae5e38623b6b8eb9dca2b9907f40332875039b3d8dd5ad5c10b7678a154439e24a456b05155f5f0301e7713dec00a87e73d9f1

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
4441ae9fff5f1e23110e68fb8496c7d3

SHA1
51142cf61be34da11b39c064ce5e8928807afec5

SHA256
7af1b904da1c0345ce4a44aa049587079fb20f1c30557a9c411e566475c6bdff

SHA512
f32a3fd6e2caeaae09a140a2732ceec48f171e370b2246572e459454a5009935b8f86c35f2f70acff9156ceb6ce3da1a93294834ea4bacb9834b661c39b12f3f

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
06e53240277f7a2a8161d7568fb64c08

SHA1
0574717a885e9d556cb5cab69f5b8c53beaf0fd7

SHA256
549d47551a29306b376168c2f7d05921ef3da66909bb1466ffba89e5c9958a76

SHA512
021c5acf6422bf00da0b19f481f2b6abec9b5529ee9f055cc1bbcd1ef98678c387d4dc69b20b4efd8a62cf68386db2020f66cbaefd4106884de4370289ef55db

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
c2dff6cd31dc3fdbdf9f3c3d57be5519

SHA1
dd47d1044ca156b1464466b4db811c0edc3089c5

SHA256
540d3c2768ce2c2fbea7e4c170b0c6c9200c339854e9f6e2503307ac243e8131

SHA512
344871fdde84d40ec9c69d8593b8e047214f020ebad9220cbda58d053b43708ae1a43143161937c62edc7785954c85329af2409f3f010cedb26e2301e2faf54a

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.4MB

MD5
272d3e5641e1515ac844c40500be1176

SHA1
4db2e27d8494863c232d9ecb9f5999e9ab4fc0dd

SHA256
832f829bbcfa46832c6ea101e15d40d7d219f543feadbb5734e7eab4ed218892

SHA512
dba7e8706d314552951aa08abf955d9eac6562109cc2cb28581a68171bf71549bbbcf46979cdfdc9c8a290f3426e196c9d6de1c9cfac45853a7d6ceeb13b2de4

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
36361baa52d5ee837cfd6e330716a8da

SHA1
d0c43ad7c1adf99f48f9639c12a35781db265d99

SHA256
c835d2cc6106021256a0c4d6a9972810183ecd082e43a28de1b3759de82d72a1

SHA512
7a18c232b3aca1c272891ecffba7dbd857b95f2302cc6af7db29d2edc6c7c17dd0a00b429c2028107b0aedfc58972d00cac4be18857878c3b7fbcf9142512b94

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
92d2f4058cb8e06a1632c710eebaaecc

SHA1
6e187bba69e876d356a73723f5edd070ab687314

SHA256
f8f0001217aba21ff1e6fee8fe435c192f51b47e23d5902bea538029a15fea1b

SHA512
ceb77a85e98f5f015655cdb4fe3b5f4d93f74cc71925ea2dcdd12bff6e6fc34c11951c07350c325a3a6f6da267dab7b3c955e8ae1d9fc0cd8d682e7ba365aeda

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.1MB

MD5
259201396f11d37e3a6d2589aa266b24

SHA1
26dc5fb840986bec48dbc5776630b15d870bafa1

SHA256
4a3556a2539718f4695366cf699855d767b8721aa8b2a93e4e3e4b8e9b50a71b

SHA512
f8ebaca528adc3ba7f5f72b314aaf7e4ac5c7326ba1fd41d9e835ce55e5dedc7537979cd7a2f445b130bc7fe18c7fdb16b1b034490344c755af276a081ea57e6

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
be038df442b2ec80b772a340a0b7d554

SHA1
fac6fe478ba4397e4878dccfa3a47285a835d49c

SHA256
3c197bdd6065fb0c27c9a5d85a3fcc7b109ab99c362c19283f4a1cd735bbeb21

SHA512
16e2b8c3ab1081b94ac3ee57f83832fe22035929443e9b51681b111235832bf0febd39777b2ddd6bbf2b9aba40607e5b4cd234f65857bb50c53a6426e9e89919

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.3MB

MD5
e107a200676e466bc267a0de7bf77c22

SHA1
da7490fef6222208284d840c4849ba5022a3fbe1

SHA256
c1becd144fd1ff811f9f0cb23950e3d56e10127b5618da1b848f41fada8952a0

SHA512
7831a50b028771957c81abdbd237cb0778c9991cec616671109b96a46b233f7e2f1ce59f1fcb68a1a171b03816a7147578b97f2c11edcc0ee9dd0082d6a750ad

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
4c673548cddb6b082f48537ce42f0278

SHA1
7077489247ee9e8640de79562dcd484db9f950e5

SHA256
2727141051205cc7df3e821fbc031eda6187e568a3507ee24d00062678d9d666

SHA512
6ccabdb781dc8ea917193221ee4a0b8b03f573eb0055470e68a5eba793e5a501a48ea3b0044780160ebd922b13159a23ea8f9c07d8956d612216291573bfdbb4

Download Submit
memory/628-22-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/628-20-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/628-31-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/628-101-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/804-165-0x0000000140000000-0x000000014013F000-memory.dmp

Filesize
1.2MB

Download
memory/804-232-0x0000000140000000-0x000000014013F000-memory.dmp

Filesize
1.2MB

Download
memory/804-173-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Filesize
384KB

Download
memory/1132-138-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1132-144-0x0000000000780000-0x00000000007E0000-memory.dmp

Filesize
384KB

Download
memory/1132-203-0x0000000140000000-0x000000014014D000-memory.dmp

Filesize
1.3MB

Download
memory/1660-116-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1660-125-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1660-117-0x0000000140000000-0x000000014015F000-memory.dmp

Filesize
1.4MB

Download
memory/1660-130-0x0000000140000000-0x000000014015F000-memory.dmp

Filesize
1.4MB

Download
memory/1660-131-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/1872-57-0x0000000000930000-0x0000000000990000-memory.dmp

Filesize
384KB

Download
memory/1872-76-0x0000000000930000-0x0000000000990000-memory.dmp

Filesize
384KB

Download
memory/1872-80-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1872-65-0x0000000000930000-0x0000000000990000-memory.dmp

Filesize
384KB

Download
memory/1872-59-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2104-112-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Filesize
384KB

Download
memory/2104-70-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2104-69-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Filesize
384KB

Download
memory/2104-114-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2104-79-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Filesize
384KB

Download
memory/2104-78-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Filesize
384KB

Download
memory/2648-14-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2648-12-0x00000000020F0000-0x0000000002150000-memory.dmp

Filesize
384KB

Download
memory/2648-25-0x00000000020F0000-0x0000000002150000-memory.dmp

Filesize
384KB

Download
memory/2648-92-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2664-41-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2664-0-0x00000000020D0000-0x0000000002130000-memory.dmp

Filesize
384KB

Download
memory/2664-8-0x00000000020D0000-0x0000000002130000-memory.dmp

Filesize
384KB

Download
memory/2664-1-0x0000000140000000-0x0000000140592000-memory.dmp

Filesize
5.6MB

Download
memory/2664-33-0x00000000020D0000-0x0000000002130000-memory.dmp

Filesize
384KB

Download
memory/2692-179-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2692-248-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2692-187-0x00000000005B0000-0x0000000000616000-memory.dmp

Filesize
408KB

Download
memory/3500-262-0x0000000140000000-0x0000000140129000-memory.dmp

Filesize
1.2MB

Download
memory/3500-191-0x0000000140000000-0x0000000140129000-memory.dmp

Filesize
1.2MB

Download
memory/3500-199-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/3804-218-0x0000000140000000-0x0000000140164000-memory.dmp

Filesize
1.4MB

Download
memory/3804-150-0x0000000140000000-0x0000000140164000-memory.dmp

Filesize
1.4MB

Download
memory/3804-160-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/4036-109-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4036-87-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4036-103-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4036-178-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4800-47-0x0000000140000000-0x000000014013D000-memory.dmp

Filesize
1.2MB

Download
memory/4800-45-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/4800-52-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/4800-136-0x0000000140000000-0x000000014013D000-memory.dmp

Filesize
1.2MB

Download
memory/5128-312-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/5128-321-0x00000000007A0000-0x0000000000800000-memory.dmp

Filesize
384KB

Download
memory/5192-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5192-211-0x00000000004E0000-0x0000000000540000-memory.dmp

Filesize
384KB

Download
memory/5192-205-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/5264-337-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Filesize
384KB

Download
memory/5264-329-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5316-228-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/5316-293-0x0000000140000000-0x000000014012A000-memory.dmp

Filesize
1.2MB

Download
memory/5316-221-0x0000000140000000-0x000000014012A000-memory.dmp

Filesize
1.2MB

Download
memory/5436-311-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5436-319-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/5436-234-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5436-240-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/5584-258-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/5584-327-0x0000000140000000-0x0000000140197000-memory.dmp

Filesize
1.6MB

Download
memory/5584-251-0x0000000140000000-0x0000000140197000-memory.dmp

Filesize
1.6MB

Download
memory/5736-348-0x0000000140000000-0x0000000140176000-memory.dmp

Filesize
1.5MB

Download
memory/5736-264-0x0000000140000000-0x0000000140176000-memory.dmp

Filesize
1.5MB

Download
memory/5736-272-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/5852-284-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/5852-278-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5852-290-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/5852-289-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5880-357-0x0000000140000000-0x000000014015A000-memory.dmp

Filesize
1.4MB

Download
memory/6012-295-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/6012-301-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Filesize
384KB

Download