Overview

overview

7

Static

static

3

2024-06-03...uk.exe

windows7-x64

1

2024-06-03...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 16:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_907b943989edf0cc256506b1070e88e8_ryuk.exe
  • Size 5.5MB
  • Sample240603-t2avnsdf39
  • SHA256 f50229c30a0dd9f84418a80db7f9a434b889f96ec3dd31aa21ea5f08494e22e4
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_907b943989edf0cc256506b1070e88e8_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_907b943989edf0cc256506b1070e88e8_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Users\Admin\AppData\Local\Temp\2024-06-03_907b943989edf0cc256506b1070e88e8_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-03_907b943989edf0cc256506b1070e88e8_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3888
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85cd1ab58,0x7ff85cd1ab68,0x7ff85cd1ab78
        3⤵
          PID:1652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:2
          3⤵
            PID:4908
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
            3⤵
              PID:1708
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
              3⤵
                PID:4328
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2480 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:1
                3⤵
                  PID:3652
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:1
                  3⤵
                    PID:3032
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:1
                    3⤵
                      PID:5384
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4232 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
                      3⤵
                        PID:5844
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4572 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
                        3⤵
                          PID:5852
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3652 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
                          3⤵
                            PID:5272
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
                            3⤵
                              PID:5296
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:5416
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5568
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5688
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5804
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:8
                              3⤵
                                PID:5484
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1924,i,5365938291371477726,11616603507529550228,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5504
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:2708
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4844
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:4336
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4568
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4888
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4208
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1188
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:4624
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:884
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4640
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3264
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4936
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4380
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2012
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4052
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4636
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:3368
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1864
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5020
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:5052
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2560
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4880
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1188
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1932
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5768
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:6020

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 df96d1e742ac7fe9450f92a564f26d1fbfc5037c90877a5a2aae5c4ad6870c41
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 797KB
                                    • SHA256 35c76a19f5f5429e8ee802eb410798cb9f6fba2da00ea029be13088be2139cdd
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 805KB
                                    • SHA256 c7db4f341b9182fac0d6e93ae20f0a344ebdc49bda955b1834256311f8f204af
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 1e80432752ec961acd1447b02d82b963087421139f28ae03358ea09a30b78e28
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 d845e15c84f6685f243d302f82e0e80d1bd8c303a00d2b148222ab5d97eefb58
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    a96d0c46-5b2d-4a9c-b024-02f4991626fd.tmp
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\a96d0c46-5b2d-4a9c-b024-02f4991626fd.tmp
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 d15ec0b42a1305238584533da0ddd5ec2959a76896cabc74599185af8af9e92a
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 f06d7f2c1b0e9157815ab0d83ef905fc48c2e261f4d2102853bdc9db387c877e
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 20efb29ecc98f6e5c35fac9f75bfa7d41899fb4758fd84f35af51d490022aeab
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 19eccdf94f1217c61a72f89804028b0bca0fa7255e3b956129a403a6b651b423
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe578aea.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe578aea.TMP
                                    • Size 2KB
                                    • SHA256 e7fedf1f3f9f65c94434b56a0a6b0be4a9773cb80c1fe09b6391adaec9849dbc
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 482ad2b448dd62a902873e7b10849dab151a287bcd4af34ed6589fd51f2b3c2d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 259KB
                                    • SHA256 7acbb77ef2b52b3524d3d3ab2904fe9f6c16e87b54d2530997e4ce36e8a7fa69
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 098b4ab819ddaf88d0993f0cb7ee3dd614e142d9e60d643fccda5bc6b487e238
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 9KB
                                    • SHA256 f6bbe918adbe6a89ee10cc3e0baf5b245116ecae0a6999885416b51a1ddf37cb
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    3055ec23b4b1389a.bin
                                    • Path C:\Users\Admin\AppData\Roaming\3055ec23b4b1389a.bin
                                    • Size 12KB
                                    • SHA256 9cf384207675f82e7e35db2982a7fde6398751279d2cf581b67fe420e80b9a69
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 588KB
                                    • SHA256 af26811e4819d55b6677edeef014cfe8d3aed35f0fe35a36bfd023d96c9e73fa
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 3ed355dd6bcc5c1a4ad82f549078a9f8dcd0c09dae531a446f9a5fd49458e012
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 659KB
                                    • SHA256 1c0e8378edf02c896343a0bbcd7ab6e3d4d78cf27e669d164aedaf4abba853ee
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 dc74be59c25c6ccd570bbed529ecd5ac64c03b6107f7e69218711e5aaea099f8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 578KB
                                    • SHA256 09919f024bb0295ea15646f65eaad3bceec7d3a1c8be483949573f56259b3539
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 940KB
                                    • SHA256 498e40e01989d2eaf8cb2483d9520bb4612d6e3d452c41680e9b8b8d93083d1e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 671KB
                                    • SHA256 6e91781056876cc974ac5f6de17caa41002b207b7a4a691452ff7dada3122995
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 b1b5e30bc866ec104e1623db06bb16c4ccad281a661f26d970aaf28bf11e1edf
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 f1339b65b736eb9f0450a75699434462e23bc1ca4a5765235d38bd0b18c6f70c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 cb07882cec2ed423628bd43231b442c499a3dce625c69f3f170fadf6e4b61d72
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 885KB
                                    • SHA256 9de9254af70b3ebeea33b35be53fc864316b101dfb5593f32798fc0c88875301
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 0ae4a340454fc52e56bf6ce5634bc7a5628de67744ce6389313a3c066e0bb46d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 661KB
                                    • SHA256 29736bc42090ebe6f22c823afccea6260dbb26bb9ac339c1633bf0563c2a5438
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 712KB
                                    • SHA256 21be352cd2f79fa251ff0038de9411ead502cdc821b5c3cd43bbea9aa3f591ea
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 584KB
                                    • SHA256 58a96c9121ae0dfda850021281baedd65592833cea44df7e9752e6539d88f25d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 0239b08643453e75257a82d2bdefa24a84ebdf7e4d9251e8c84d2f5956fb7fae
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 772KB
                                    • SHA256 a7b215bdee18347613c8595c9e888d6c28ee4f70073c8f47ac1ed5932fe6baf1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 99b10b8697d7b06ab52eccb03982a60c95ff98adf90b28befadadc407d83b9c8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 ee8fad0e09119ff89b6f13fc18df351e81b41199adfc10acbfeccbbb88e02a9d
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/884-312-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/1188-97-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/1188-91-0x0000000001A40000-0x0000000001AA0000-memory.dmp
                                    Download

                                    memory/1188-104-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/1188-752-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/1188-329-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/1864-323-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/1932-753-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/1932-330-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/2012-317-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/2560-325-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/2560-751-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/2652-35-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/2652-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/2652-22-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/2652-6-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/2652-0-0x0000000000830000-0x0000000000890000-memory.dmp
                                    Download

                                    memory/2708-26-0x00000000006D0000-0x0000000000730000-memory.dmp
                                    Download

                                    memory/2708-542-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2708-32-0x00000000006D0000-0x0000000000730000-memory.dmp
                                    Download

                                    memory/2708-25-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/3264-314-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/3888-11-0x0000000001FA0000-0x0000000002000000-memory.dmp
                                    Download

                                    memory/3888-17-0x0000000001FA0000-0x0000000002000000-memory.dmp
                                    Download

                                    memory/3888-20-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/3888-539-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4052-318-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/4208-748-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/4208-90-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/4208-84-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/4208-78-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/4380-607-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4380-316-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4568-87-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4568-60-0x0000000000DC0000-0x0000000000E20000-memory.dmp
                                    Download

                                    memory/4568-55-0x0000000000DC0000-0x0000000000E20000-memory.dmp
                                    Download

                                    memory/4568-62-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4568-75-0x0000000000DC0000-0x0000000000E20000-memory.dmp
                                    Download

                                    memory/4624-311-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/4636-322-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/4640-313-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/4844-49-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/4844-51-0x0000000140000000-0x00000001400A9000-memory.dmp
                                    Download

                                    memory/4844-43-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/4880-328-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/4888-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                    Download

                                    memory/4888-88-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/4888-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                    Download

                                    memory/4888-386-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/4936-315-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/5020-222-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/5052-324-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/5416-602-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5416-541-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5568-543-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5568-754-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5688-587-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5688-555-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5804-575-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5804-755-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download