Overview

overview

7

Static

static

3

2024-06-03...uk.exe

windows7-x64

1

2024-06-03...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 18:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_9662a54074be2ccf9ee3e356d154af92_ryuk.exe
  • Size 5.5MB
  • Sample240603-wsavesed5v
  • SHA256 9ac3087a45ce655f2a2a891c9d1d0c858c1d4d81b0c683d76e25b195c3a8df69
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_9662a54074be2ccf9ee3e356d154af92_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_9662a54074be2ccf9ee3e356d154af92_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\2024-06-03_9662a54074be2ccf9ee3e356d154af92_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-03_9662a54074be2ccf9ee3e356d154af92_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4004
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe31beab58,0x7ffe31beab68,0x7ffe31beab78
        3⤵
          PID:3096
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:2
          3⤵
            PID:4424
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
            3⤵
              PID:1864
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
              3⤵
                PID:1472
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:1
                3⤵
                  PID:4820
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:1
                  3⤵
                    PID:932
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:1
                    3⤵
                      PID:5484
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4300 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
                      3⤵
                        PID:5536
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4416 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
                        3⤵
                          PID:5548
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
                          3⤵
                            PID:5144
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
                            3⤵
                              PID:1512
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:5668
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5948
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:6124
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5252
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:8
                              3⤵
                                PID:5864
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2572 --field-trial-handle=1920,i,6897367227775670358,3303457585743629749,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4304
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:2356
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:1932
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:4984
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3188
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4944
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:5000
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:828
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:2620
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:1452
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2788
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3356
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3380
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:1936
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2468
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:2420
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:760
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:4300
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4280
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3740
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4872
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2068
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3188
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4432
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4412
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:776
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5332

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 877315cefa0cb80b5b3fb8a9c956fa7529c40d280d525087424362ea7fc673a0
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 797KB
                                    • SHA256 e0e8160ec4a0871b7a4c31a86374c526b123c7ca7f5f6bb51068abed58a84a69
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 805KB
                                    • SHA256 004f41b71830de96700b3fae9dfe7898d60d7b683177eecb47c425a736289b76
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 a957b029f51e9d276afaa31df985c5c3d3b01f99a2754ce111a8034f4d2b5494
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 2b166519d74ed46bb14348353489e8e9de5c39cfe18da11c1360600a37c209e2
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    b6b21e7d-9252-443e-9203-48ee6d976db6.tmp
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\b6b21e7d-9252-443e-9203-48ee6d976db6.tmp
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 62d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 5ea1d2886135310d2742ea8afa786d10af8caffaa965e01b0e1d3249d5035a34
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 98b8c83a36ebb19623c74085ada9f1ac1514333d0ba98516cb647baf1ad937a0
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 888f403582898b96d08b643c626b2b2f77f8e9d8bb36fab5efef3041a3773317
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe5775cc.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5775cc.TMP
                                    • Size 2KB
                                    • SHA256 975c8308bab1dce91143c9ad18effdd216bc367fccb3195ec2d4fd50177d2158
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 e93130d738d7305cd0348f0d160d4cea1ce3358a711bd3868e8c009989d280f7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 259KB
                                    • SHA256 f83a1f3cb0723f3e35293e58b9e1b7d79fffe49e861562a32067cd1bf5a65831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 3a2085bf1db94375041e04a56cecb767ca20f4ec47ad1aee1c2eea9b655023bf
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 976383d40798427d9df9f918275495dda6e22fc3a824890a80c8a05e83bb3ed0
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    1c21ced1293b476c.bin
                                    • Path C:\Users\Admin\AppData\Roaming\1c21ced1293b476c.bin
                                    • Size 12KB
                                    • SHA256 973a407a1442d11f8852277077877d3f56b1963a60f84b4deee99596eed94a86
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 588KB
                                    • SHA256 c9f72940e13efdb2d508d0fed9513f29f6f29c1cac02f108121b8c30931d6208
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 5b03bf4a1798931eb9379c130a69132bb37e63efb2dedaabb1b372621a07cba7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 659KB
                                    • SHA256 f574a197d5e97497cf42589b512e6d589a23676c75fefbb7ace07b39c9c57671
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 149aa274e4eef9dce2187f9875949c602f8a0fc31e4c0ced907f25b5b8334747
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 578KB
                                    • SHA256 db40bccc7177e3e5a01a998615c55c63d9c82f68a623c858a8531428b706f481
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 940KB
                                    • SHA256 b9e2bda83c3c49a9543aa32c3516a60bec0f10847d3d844aa8e602ea750b841b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 671KB
                                    • SHA256 4d7e8e04e1a738159bd8b4f7e84487578bc9331b0082ef736277f8fa0fb748e1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 33710ca6adba5c922657a8524164f8beb0b72ac9df1154af6f14bbce2d0786ac
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 659b53cf6280665e4d172589563291822edf73c272f7b7d123284ea81131d10f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 76b67c95ac8c6d9a94d14e36ef090edc5779291165e8b863fa80a6c0840740ca
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 885KB
                                    • SHA256 01a076a94771e8dd93a1aa818bdf63067415f2b39d7cb3544cabd5251b4e0066
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 3428e4dcaf436e741e3aaf4afa5492524039d8c3e4c0f41222294712a4ecfda1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 661KB
                                    • SHA256 d8f9ab834d9703b17d92614d9dd9ab437d8fb184ce3732154d02e707a30960ea
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 712KB
                                    • SHA256 cfe91595334789c03a0146db2b3dc00c356d1cb19641e91ce0d841a5309eced7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 584KB
                                    • SHA256 1ee8073dbd9a8d704a64890d13d85337fbfebea1719a7ad09b77734b367e38aa
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 4f61c589f8b45a5a242503a1d95f5943b96069a3488d59fe361b63f88a69932b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 772KB
                                    • SHA256 3cc99c6e17956c7b8ec30f02ef0c8cb88393967e813a9e92ec137aa418ac3006
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 bbd27d81ab103831a03f170de4f9d2e03ed6d188f7493e8f292152ade9cc7d25
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 fdf37f8111f0fabb5be766202a1a0b5a294818c4c448af0fec9003242123e3e6
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    AppVClient.exe
                                    • Path C:\Windows\system32\AppVClient.exe
                                    • Size 1.3MB
                                    • SHA256 f8006b394ebcb92ac05d98e1f1bb36c4353f525a8ef11cd4cd0e62b211dc384a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    memory/760-324-0x0000000140000000-0x0000000140102000-memory.dmp
                                    Download

                                    memory/828-107-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/828-95-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                    Download

                                    memory/1452-317-0x0000000140000000-0x00000001400CF000-memory.dmp
                                    Download

                                    memory/1492-9-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/1492-40-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1492-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1492-0-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/1492-35-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/1932-625-0x0000000140000000-0x00000001400A9000-memory.dmp
                                    Download

                                    memory/1932-46-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/1932-52-0x0000000140000000-0x00000001400A9000-memory.dmp
                                    Download

                                    memory/1932-54-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/1932-53-0x00000000006B0000-0x0000000000710000-memory.dmp
                                    Download

                                    memory/1936-321-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/1936-610-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/2068-328-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/2356-23-0x0000000000610000-0x0000000000670000-memory.dmp
                                    Download

                                    memory/2356-31-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2356-32-0x0000000000610000-0x0000000000670000-memory.dmp
                                    Download

                                    memory/2356-579-0x0000000140000000-0x00000001400AA000-memory.dmp
                                    Download

                                    memory/2420-323-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/2468-322-0x0000000140000000-0x0000000140096000-memory.dmp
                                    Download

                                    memory/2620-316-0x0000000140000000-0x00000001400B9000-memory.dmp
                                    Download

                                    memory/2788-318-0x0000000140000000-0x00000001400AB000-memory.dmp
                                    Download

                                    memory/3188-58-0x0000000000850000-0x00000000008B0000-memory.dmp
                                    Download

                                    memory/3188-91-0x0000000000850000-0x00000000008B0000-memory.dmp
                                    Download

                                    memory/3188-93-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/3188-329-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/3188-64-0x0000000000850000-0x00000000008B0000-memory.dmp
                                    Download

                                    memory/3188-67-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/3356-319-0x0000000000400000-0x0000000000497000-memory.dmp
                                    Download

                                    memory/3380-320-0x0000000140000000-0x0000000140095000-memory.dmp
                                    Download

                                    memory/3740-225-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/4004-18-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/4004-20-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4004-558-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4280-326-0x0000000140000000-0x00000001400E2000-memory.dmp
                                    Download

                                    memory/4412-331-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4412-642-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4432-641-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/4432-330-0x0000000140000000-0x00000001400C6000-memory.dmp
                                    Download

                                    memory/4872-327-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/4944-77-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/4944-377-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/4944-69-0x00000000007F0000-0x0000000000850000-memory.dmp
                                    Download

                                    memory/4944-75-0x00000000007F0000-0x0000000000850000-memory.dmp
                                    Download

                                    memory/5000-90-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/5000-81-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/5000-640-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/5000-87-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/5252-582-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5252-740-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5668-531-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5668-605-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5948-739-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5948-552-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/6124-592-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/6124-559-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download