Overview

overview

7

Static

static

3

2024-06-02...uk.exe

windows7-x64

1

2024-06-02...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 22:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-02_bc8c7d4c2996322407594d5cfc469293_ryuk.exe
  • Size 5.5MB
  • Sample240602-2bbchsac38
  • SHA256 a4352e841d85fb2e9992323d8875c8490b592fe871756de784efcd082733d32a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc8c7d4c2996322407594d5cfc469293_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc8c7d4c2996322407594d5cfc469293_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc8c7d4c2996322407594d5cfc469293_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc8c7d4c2996322407594d5cfc469293_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4508
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7302ab58,0x7ffe7302ab68,0x7ffe7302ab78
        3⤵
          PID:3484
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:2
          3⤵
            PID:1164
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
            3⤵
              PID:404
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
              3⤵
                PID:2004
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:1
                3⤵
                  PID:2696
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:1
                  3⤵
                    PID:228
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3596 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:1
                    3⤵
                      PID:4932
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3932 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
                      3⤵
                        PID:844
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4476 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
                        3⤵
                          PID:4148
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
                          3⤵
                            PID:5660
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
                            3⤵
                              PID:1344
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:3032
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5824
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5940
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x290,0x294,0x298,0x268,0x29c,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:6084
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:8
                              3⤵
                                PID:5588
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1880,i,545188213971698795,885126858775836609,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4424
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:1168
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:2744
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:1040
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4356
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2980
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3096
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3432
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:624
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:464
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2056
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4568
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4012
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4028
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:544
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:3532
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3588
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:3240
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1028
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1880
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3592
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3492
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:816
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1560
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5224
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5964
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5480

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 4ee918e54b8b8b4b7d4952f78dad07d39ca567e39de8367fcc49a0016e4826bc
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 797KB
                                    • SHA256 54ffb2ca3e30f10246a7d1621de647a737533ca23fb543c5f0f032e3d217948d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 805KB
                                    • SHA256 261c5d937d2b068a1a883fb83f993937e76a7a72f18c0a8ceadc2b07542ba544
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 276c8be5a4c0ca1e306b76808a6d8b2a250d791ddb9a1ba924f9a549758af2d9
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 82597654ae98e7d3c8cb2e5b97f00613114df86ad93384d3aed31474a9069613
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    20240602222414.pma
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\20240602222414.pma
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 be7c1faec23a46d25250554bdeb10d8f49b4fc3176004c914f34cd0c8caa990f
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 1c5effb35b77e628f818edc2f57c44ab45e7036b49a9a06c26ae2cb1a14a9f3e
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 03920800115dbf2f9059d6036b93198cd8e521eadf71a4ddd6590c8a7cca68b3
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 8b55ba7fce2b4d5929318477eb0b0c413bf76f6cf4b0e40f9912d804b57a598d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe575a16.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe575a16.TMP
                                    • Size 2KB
                                    • SHA256 bb4c89650137cd1ed35cc2299d77c4b282072dd0e43418272d06a04c82c3733b
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 3238c8011202961085f594f3d1eb1e12df442bca0827caf6cbe1b4d6522cd390
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 261KB
                                    • SHA256 d75f24cc454143e2652aed81310986c570168b60a2d5c57ebdabb56f6db5e910
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 7e66235f960fad9b614ba2225d8d4fb5bd9f621eb83384fc1e9fb5301f35f5a5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 d66a1c2cfc33ca35ccbf9048fccfd8c17ef05ad970eb9f1df30c0998e35ae6aa
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    d436e54b4a48edc7.bin
                                    • Path C:\Users\Admin\AppData\Roaming\d436e54b4a48edc7.bin
                                    • Size 12KB
                                    • SHA256 f9d7e999dc83b48f257195e3fb687603f5289878871a487942f0f3d512d5955f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 588KB
                                    • SHA256 fb8bb7bc236e29bea29c5135e939488dd99c64e27d5d3b78e2abca4b6b15faa4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 faa6687d04d0d91e02cd202e3ca82b96bb6cd4227acf88cf1586e1b8e4ea6809
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 659KB
                                    • SHA256 238014bf7c4bca5f900c43b5a65420d955a83ec418f8ea357da32289fad280ac
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 f1d63683127ec4b48fe948bd48abbd42ab57201d9df96927061801d0b7672211
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 578KB
                                    • SHA256 c8617d16cba8f621ab36ba8c3c78023b74505c434556013d477f0b6f6380e721
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 940KB
                                    • SHA256 f9db077f820494a5f3a471c0ccf7abc23227f2fbae6d4043f74f30b5e74b0811
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 671KB
                                    • SHA256 3bc1c54bf029a79760034bd59a6e043cfb882227b7405052e90fa86571f5d948
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 2c58ca55b0597067ee80e85003ffd08ff11f77568c95cef7e92b604848daf77f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 1f8e159a2652a456baecc55833b1057ddd7697f54021ada61761fe31df8f20d5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 3ab50f5d2b117703890255b4564ee62126cde82828b791bc93728930780c192e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 885KB
                                    • SHA256 83ba2ba86694b71ddf84096f6fd6f8c868e948f2a04701dc637a72931c849996
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 36a49bb6643e9938a88356bf2ed98a94dc6a22bba3d049242bc68fc5a3312e90
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 661KB
                                    • SHA256 f21fbd1d158d52f9862856a4495c1c5cae7bb5170e6e4c46478485929165138c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 712KB
                                    • SHA256 b6b1c5ae2108de404464dfccb45fcb1f3aa8f3dfe178cb51fd9ca58f9ebc8a2c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 584KB
                                    • SHA256 41e80360ff4459029a6426dd5006930f6d6136eb8b7c7d3f06f4f1d5e0b0b0ba
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 7ab9b57a8f5a23b69c6ac653f0d34b8c12c0d0303006a146812b0cc621e0d49e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 772KB
                                    • SHA256 7ce4ff72b82dbb63588c9ce88f34d22398cd2805a9e393307103e60eb07f204d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 2d7ab7ede5aded30f279166b3d8de883eb9604f48f2e069415a78eeff1bcc55d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 f022aa4752d0400339634741871e82f3bb6e1dc719e1ffe9b3987e457c01bdc0
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/464-257-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/464-143-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/544-192-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/544-510-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/624-110-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/624-242-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/816-728-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/816-297-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/1028-229-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/1028-558-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/1168-37-0x0000000000620000-0x0000000000680000-memory.dmp
                                    Download

                                    memory/1168-27-0x0000000000620000-0x0000000000680000-memory.dmp
                                    Download

                                    memory/1168-165-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/1168-25-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/1560-309-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/1560-729-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/1880-254-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/1880-243-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/2056-271-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/2056-147-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/2744-51-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/2744-53-0x0000000140000000-0x00000001400A9000-memory.dmp
                                    Download

                                    memory/2744-45-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/2980-73-0x0000000000740000-0x00000000007A0000-memory.dmp
                                    Download

                                    memory/2980-163-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/2980-67-0x0000000000740000-0x00000000007A0000-memory.dmp
                                    Download

                                    memory/2980-75-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/3032-603-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/3032-521-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/3096-87-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3096-225-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3096-89-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3096-81-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3432-92-0x0000000001510000-0x0000000001570000-memory.dmp
                                    Download

                                    memory/3432-106-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/3432-98-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/3492-272-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/3492-717-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/3532-203-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/3532-532-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/3588-226-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/3588-537-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/3592-266-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/3592-692-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/4012-306-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/4012-177-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/4028-321-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4028-716-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4028-188-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4356-65-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4356-56-0x0000000000940000-0x00000000009A0000-memory.dmp
                                    Download

                                    memory/4356-79-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4356-77-0x0000000000940000-0x00000000009A0000-memory.dmp
                                    Download

                                    memory/4356-62-0x0000000000940000-0x00000000009A0000-memory.dmp
                                    Download

                                    memory/4508-17-0x00000000020F0000-0x0000000002150000-memory.dmp
                                    Download

                                    memory/4508-109-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4508-19-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4568-166-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/4568-288-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/4672-6-0x00000000020F0000-0x0000000002150000-memory.dmp
                                    Download

                                    memory/4672-26-0x00000000020F0000-0x0000000002150000-memory.dmp
                                    Download

                                    memory/4672-0-0x00000000020F0000-0x0000000002150000-memory.dmp
                                    Download

                                    memory/4672-10-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4672-38-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/5224-322-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/5224-730-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/5824-748-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5824-533-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5940-590-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5940-538-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/6084-559-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/6084-749-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download