Overview

overview

7

Static

static

3

2024-06-03...uk.exe

windows7-x64

1

2024-06-03...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 15:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_0def79f7a6bd6859f294d54e0cb92ebe_ryuk.exe
  • Size 5.5MB
  • Sample240603-s7cqsabc6z
  • SHA256 ade409f5224ccb66d8e1844d8a760c7b078105bfa5d4591d265d46ee81c7080e
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_0def79f7a6bd6859f294d54e0cb92ebe_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_0def79f7a6bd6859f294d54e0cb92ebe_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Users\Admin\AppData\Local\Temp\2024-06-03_0def79f7a6bd6859f294d54e0cb92ebe_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-03_0def79f7a6bd6859f294d54e0cb92ebe_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4748
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae238ab58,0x7ffae238ab68,0x7ffae238ab78
        3⤵
          PID:2136
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:2
          3⤵
            PID:2856
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
            3⤵
              PID:1872
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
              3⤵
                PID:1204
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:1
                3⤵
                  PID:1852
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:1
                  3⤵
                    PID:1544
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:1
                    3⤵
                      PID:6000
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4476 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
                      3⤵
                        PID:2592
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4100 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
                        3⤵
                          PID:1892
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4936 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
                          3⤵
                            PID:740
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
                            3⤵
                              PID:3684
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:4368
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5664
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:2420
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1948
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:8
                              3⤵
                                PID:1644
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1916,i,5336862644463868139,6733903728999584998,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4552
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:2164
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:2844
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:1268
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4948
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3668
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3980
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:5828
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:5412
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:3468
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:5616
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4528
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3852
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4632
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2140
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:5252
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2076
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:5196
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5308
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2420
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1988
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5588
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1168
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:432
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5816
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:1500
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:2324

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 ecc8521a782bdca7131b64f976b0dce9e15f468b3150f8811cd2fa3a7ec11f6c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 797KB
                                    • SHA256 b726af382ebc6364477b696305afd709bd284d585ef7ef8bfd55a434d6f96e97
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 805KB
                                    • SHA256 592645d5953623fceae25d71ccb98c3e05862bd2b92b7947051388f8a19ea292
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 845a6a51a955b4812a6465a0e86e3cf958c49a29dff73542e9ea965802b444db
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 a30c3662b4c46232de074306e65283655dd1ab921b46516112bf5f5f4bdaf1c5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 001c51870a28710313d50d9037f261881517a384d3e502d9112b04ea2e8538a1
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    7bb96e26-a765-4226-a622-8f3305cc424d.tmp
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7bb96e26-a765-4226-a622-8f3305cc424d.tmp
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 4196d656b6c2ee091ce43e2e0de4af15849337c2f54166baeb7e4c26ac4a66b6
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 354B
                                    • SHA256 254aeb2df5ebc75d5bda85fc9e74eb8e4fe1be896ff3a48f847aefc38209e6e5
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 bd1aae95876c7efa655e77f4c542760cac494d6e038b1ce6af27164e8ecfdf1d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe57689d.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57689d.TMP
                                    • Size 2KB
                                    • SHA256 13f018fd7e8d456a16ab52c9430b449ed2f126386dc10abb8d01ff752f92db72
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 15606ae73e5bd2f099407d49d6796c3e304e9b1739af6787b06962bf9672c09f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 259KB
                                    • SHA256 9ccaafa7b35deff43192578ac528b6a796c97422708a839d87d9af1393659de4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 add7377c3142f1b02dfe56d2426cf728005bba64f9a8f2fdfd4b8875059c96ee
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 a96d51bd2c08aec176daf75a16026497cfffcda10a6e8dc79fd6a0b4ab0f6c61
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    6da0bba98beeeac9.bin
                                    • Path C:\Users\Admin\AppData\Roaming\6da0bba98beeeac9.bin
                                    • Size 12KB
                                    • SHA256 cd2533c4a64709689649b28571bf28e379b844abb060783b49b8b432f8564fcb
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 588KB
                                    • SHA256 b20f3070f5d3e10c9ff3ff2877cd4ec3c323af93aa9b584a946b4d667759959a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 cd0f03921e523320068413c993f5d5c18ef3d1b3567b7afeaa6626ae455dbf9e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 659KB
                                    • SHA256 6dcf0d5fd0221a2b211ee8cc0053354d97df240e91d3c6647dfe96a5163f39b4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 b795f07f8622a152c17748105ebc2de4b8da09acbbc53f23ea85ab6ed1c2b19e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 578KB
                                    • SHA256 19a664ab375d445f10c6b478e753837e3cfa677e44cda534a6fd730ecc359b9f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 940KB
                                    • SHA256 36bdb5d24798dbec1f6c51bf7e0a36ff110a6fa48832553689fb2123125b0aaa
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 671KB
                                    • SHA256 c31e78b7e07f669bba6ce2091e5642d6464ada776a02c069c2186e4c83fb5329
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 fd9d0e208a130b6d4256cbcc8309da45ce1ed99b292d2ca3a1ab9a11761fd93b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 7436276db6b3e5931e8f02a4ba663db2f16d64d3957636713114d9a402e894a5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 0b23b5c98c4f92ba2f053f2bde86203aa5e86c63645c0b3539396fca75f971b8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 885KB
                                    • SHA256 35f3138764babd1e6f9b31805c3af382113c2c04c437aef1cb974d358484ea03
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 58ca385e6e89add67366545d2ff1f1551c71338b36b761c9c4138e38174b55ea
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 661KB
                                    • SHA256 ae8200dffe1d59989fdb0684004461a06c2745d8b85ad7cb27e2d3a4b58673f5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 712KB
                                    • SHA256 09a7adc39c3d34bcdd2420a63e95918c27e65ae9e77f30a43991b1d8d1769724
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 584KB
                                    • SHA256 8d26c44e03eb458e4bc8a4748778ceb6abe561c1662757a8cb1daef0ad541024
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 767add96a8481a99db45288698146f4bfd0cb73abc6a4e887cc94aab5dc4519f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 772KB
                                    • SHA256 caed70916987b56c2bcadee872b5c9289ceb3e309cd58403c7936813cb89bbf6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 41a3d4bbd0c1c79c9f89386cc7738588a200f73f8ef4be10edcfeae90bf40b69
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 81519c37e7b764606c063607c2fdc287f28845aed7cce899222c4f714f16f860
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/432-684-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/432-294-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/448-40-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/448-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/448-28-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/448-6-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/448-0-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/1168-293-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/1948-783-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/1948-579-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/1988-291-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/2076-289-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/2140-185-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/2164-32-0x0000000000600000-0x0000000000660000-memory.dmp
                                    Download

                                    memory/2164-33-0x0000000000600000-0x0000000000660000-memory.dmp
                                    Download

                                    memory/2164-22-0x0000000000600000-0x0000000000660000-memory.dmp
                                    Download

                                    memory/2164-31-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2164-541-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2420-230-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/2420-588-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/2420-577-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/2844-53-0x0000000140000000-0x00000001400A9000-memory.dmp
                                    Download

                                    memory/2844-54-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/2844-44-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/3468-180-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/3668-67-0x0000000000440000-0x00000000004A0000-memory.dmp
                                    Download

                                    memory/3668-73-0x0000000000440000-0x00000000004A0000-memory.dmp
                                    Download

                                    memory/3668-373-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/3668-76-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/3852-183-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/3980-87-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3980-626-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3980-81-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3980-90-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/4368-540-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/4368-595-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/4528-182-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/4632-184-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4632-606-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4748-16-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/4748-10-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/4748-287-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4748-20-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4948-79-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4948-56-0x0000000000D60000-0x0000000000DC0000-memory.dmp
                                    Download

                                    memory/4948-62-0x0000000000D60000-0x0000000000DC0000-memory.dmp
                                    Download

                                    memory/4948-77-0x0000000000D60000-0x0000000000DC0000-memory.dmp
                                    Download

                                    memory/4948-64-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/5252-288-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/5308-290-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/5412-179-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/5588-292-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/5616-181-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/5664-551-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5664-782-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5816-685-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/5816-295-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/5828-93-0x0000000001A60000-0x0000000001AC0000-memory.dmp
                                    Download

                                    memory/5828-105-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download