Overview

overview

7

Static

static

3

2024-05-30...uk.exe

windows7-x64

1

2024-05-30...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 15:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-30_06bd4ce14815781fa23c63f8040fabdb_ryuk.exe
  • Size 5.5MB
  • Sample240530-sefa7sde54
  • SHA256 0d39be116c4cb518e63b575d5a8772f64fc847a6e52f013fc254003d40896675
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-30_06bd4ce14815781fa23c63f8040fabdb_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-30_06bd4ce14815781fa23c63f8040fabdb_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Users\Admin\AppData\Local\Temp\2024-05-30_06bd4ce14815781fa23c63f8040fabdb_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-05-30_06bd4ce14815781fa23c63f8040fabdb_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2860
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:260
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce41ab58,0x7ffcce41ab68,0x7ffcce41ab78
        3⤵
          PID:664
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:2
          3⤵
            PID:5080
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
            3⤵
              PID:4500
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2120 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
              3⤵
                PID:4560
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:1
                3⤵
                  PID:4804
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:1
                  3⤵
                    PID:4156
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4280 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:1
                    3⤵
                      PID:5536
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4072 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
                      3⤵
                        PID:5672
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4448 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
                        3⤵
                          PID:5692
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
                          3⤵
                            PID:5172
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                            3⤵
                            • Executes dropped EXE
                            PID:5416
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                              4⤵
                              • Executes dropped EXE
                              PID:5520
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                              4⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of FindShellTrayWindow
                              PID:5700
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                5⤵
                                • Executes dropped EXE
                                PID:5792
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
                            3⤵
                              PID:5404
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:8
                              3⤵
                                PID:6016
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 --field-trial-handle=1924,i,5747833572333806646,9751192094491794583,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2976
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:404
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:616
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:4700
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1996
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1484
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3692
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:1760
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:2040
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:3220
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1756
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4920
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3108
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:2996
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4516
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:3368
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:548
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:452
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4352
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4248
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4584
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1052
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3308
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:884
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2740
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:6048
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4212

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 cb29dee81508535d6a49382431cdb4d5ab7d217f37e7a8a71f44299c3af8767a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 1.7MB
                                    • SHA256 87f745417480d59f253567b66cac1eda1260c1d168def2b2b6c7964451bd7ec5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 1.7MB
                                    • SHA256 1a7c6127c82d29c63efb5f0160091155f6689ad4fdeec08a9f86ab4cadea703c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 157e52711fd18ae0e7fb4a52a60a5134e2305e378e40a12287f511682d298f59
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 e6bd861137ff0a9f4eb1e61a76451ef09ca04f858e8cbec7f4542838a74ad90f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    d3b6577d-c532-414e-958f-93e4f6ceabd1.tmp
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\d3b6577d-c532-414e-958f-93e4f6ceabd1.tmp
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 d15ec0b42a1305238584533da0ddd5ec2959a76896cabc74599185af8af9e92a
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    203c7862-8c54-4785-8a89-98f253ad6845.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\203c7862-8c54-4785-8a89-98f253ad6845.tmp
                                    • Size 1KB
                                    • SHA256 b2c6c53e3b31366dc58df13b8a5100c0314ff4a33a23efa1074085cd9a2ea47f
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 b71d3d653ac48cd8a46bbac22bbf88482f30c1e59d7aa0fd44632c47077b9c62
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 a49842b00af525419a5bb00d6eb94305e36605a61ed86be17b227ee63ed7b06d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe578e94.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578e94.TMP
                                    • Size 2KB
                                    • SHA256 e7fedf1f3f9f65c94434b56a0a6b0be4a9773cb80c1fe09b6391adaec9849dbc
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 501eda7c4052fd75c2447dd50f590178d0b95814181f984bb1e43b7e7d0fe894
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 260KB
                                    • SHA256 12542ac41a850507f0164044c9c8b665199b1dfe6aed27d553f67b563116a750
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 60b87e1f61fef9c53839eeee43d7ae1e539b6051324865104826a0a4e9fcb75d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 08d0332a7164614ef1c85be082c6a6df70e52f5d63ed185223cba74e7c7d2719
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    e2c6eebcb4b1389a.bin
                                    • Path C:\Users\Admin\AppData\Roaming\e2c6eebcb4b1389a.bin
                                    • Size 12KB
                                    • SHA256 5947657d39c2b4ee0f18ae7825e61a3ed80160e3db14e803fdd57dc83d1fe090
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 1.5MB
                                    • SHA256 50c5616f2b916d8bf26089f71d1a9ae2e4d9b3c553f6a3599090e45c9228c3ee
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 e71472001233579d34642830838ed7299d59a13c2c8ed9e78b7c80c892079a62
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 1.6MB
                                    • SHA256 ced122a550386229b7572d087db700beb85a79778a78fed5fe2c4edaa763a755
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 8f893f42202ed034f64038702abd086632a9531050bf344c0f5d2cef8b3a3f73
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 1.5MB
                                    • SHA256 cebb58056608fb9fec7ebf2d45266904bdce918b8cb3b8775430ac073cab081f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 1.9MB
                                    • SHA256 6ed50ff24267c7d22e99336870a1800a87067aebdca6628cd87f1a4a1dd41098
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 1.6MB
                                    • SHA256 babfe9ea5f43e7623e4df34fc62ff3150412f1f48ed4cb136f143117949e9bfd
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 805270610589a60e69c65b7432c247b8f3947565247d9711b474739679713ea3
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 5476ba727f5d42d3a0a39f24de9373d7d7234748f097a7bfa8233c2847b6b604
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 3ca52e305add7060ac858793c22786c18fc6c5cfe8a73f384901b50aa4c59d60
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 1.8MB
                                    • SHA256 66d24196b51e4b8e872dcbd1de0860a8a4598ffcb0d1c3403dea29005110f7f4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 cc6d4cad3daa6d58cde67e6a69389950a3301bbc0ec2563bb5dfc6cbeea46e91
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 1.6MB
                                    • SHA256 b55a37bf8ac64725ffa11241dfb9111d1368b0b7a45440397ba5757c713aa549
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 1.6MB
                                    • SHA256 fa297310acc9b4c40efd469ffe0f9274e95e0c577b89447ac9eb1d58ca6a995a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 1.5MB
                                    • SHA256 0c5ff6f13f285088c981e837d5839a89008d60119db99658cf4168bcb3b10167
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 ee0f5be0ff6c36be9966aa593bc05be216cdb387ac30fe605d474591ec3e6882
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 1.7MB
                                    • SHA256 4ee6b606c3d70336dbbd3e472d164fe1f14d785f05174f502f4e40723416e2ca
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 ef66a334fb4063d095ac3e05c1d8330dc0db9ab60865d0b82e55e0489a5ea82c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 ee8fad0e09119ff89b6f13fc18df351e81b41199adfc10acbfeccbbb88e02a9d
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/396-0-0x0000000001FD0000-0x0000000002030000-memory.dmp
                                    Download

                                    memory/396-24-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/396-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/396-21-0x0000000001FD0000-0x0000000002030000-memory.dmp
                                    Download

                                    memory/396-6-0x0000000001FD0000-0x0000000002030000-memory.dmp
                                    Download

                                    memory/404-50-0x0000000140000000-0x0000000140199000-memory.dmp
                                    Download

                                    memory/404-684-0x0000000140000000-0x0000000140199000-memory.dmp
                                    Download

                                    memory/404-32-0x0000000000520000-0x0000000000580000-memory.dmp
                                    Download

                                    memory/404-38-0x0000000000520000-0x0000000000580000-memory.dmp
                                    Download

                                    memory/548-350-0x0000000140000000-0x00000001401F1000-memory.dmp
                                    Download

                                    memory/616-51-0x0000000140000000-0x0000000140198000-memory.dmp
                                    Download

                                    memory/616-48-0x0000000000690000-0x00000000006F0000-memory.dmp
                                    Download

                                    memory/616-42-0x0000000000690000-0x00000000006F0000-memory.dmp
                                    Download

                                    memory/884-372-0x0000000140000000-0x00000001401B5000-memory.dmp
                                    Download

                                    memory/1052-359-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/1484-75-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                                    Download

                                    memory/1484-69-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                                    Download

                                    memory/1484-320-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/1484-426-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/1756-326-0x0000000140000000-0x000000014019A000-memory.dmp
                                    Download

                                    memory/1760-89-0x0000000001A90000-0x0000000001AF0000-memory.dmp
                                    Download

                                    memory/1760-101-0x0000000140000000-0x00000001401BE000-memory.dmp
                                    Download

                                    memory/1996-65-0x0000000000E90000-0x0000000000EF0000-memory.dmp
                                    Download

                                    memory/1996-67-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/1996-61-0x0000000000E90000-0x0000000000EF0000-memory.dmp
                                    Download

                                    memory/1996-64-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/1996-55-0x0000000000E90000-0x0000000000EF0000-memory.dmp
                                    Download

                                    memory/2040-322-0x0000000140000000-0x00000001401A8000-memory.dmp
                                    Download

                                    memory/2740-373-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/2740-766-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/2860-16-0x0000000001FA0000-0x0000000002000000-memory.dmp
                                    Download

                                    memory/2860-10-0x0000000001FA0000-0x0000000002000000-memory.dmp
                                    Download

                                    memory/2860-19-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/2860-552-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/2996-653-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/2996-344-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/3108-343-0x0000000140000000-0x0000000140184000-memory.dmp
                                    Download

                                    memory/3220-324-0x0000000140000000-0x00000001401BE000-memory.dmp
                                    Download

                                    memory/3308-360-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/3368-349-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/3692-321-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3692-765-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3692-79-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3692-85-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/4248-219-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/4352-351-0x0000000140000000-0x00000001401D1000-memory.dmp
                                    Download

                                    memory/4516-348-0x0000000140000000-0x0000000140185000-memory.dmp
                                    Download

                                    memory/4584-354-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/4920-342-0x0000000000400000-0x0000000000586000-memory.dmp
                                    Download

                                    memory/5416-527-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5416-599-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5520-767-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5520-540-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5700-588-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5700-574-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5792-575-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5792-768-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download