Overview

overview

7

Static

static

3

2024-06-08...uk.exe

windows7-x64

1

2024-06-08...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 11:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_a547bc1cc42683cbea61cfba35309121_ryuk.exe
  • Size 5.5MB
  • Sample240608-ntldjsbc51
  • SHA256 b6bd805ce495d8709552fdaf4ebbc9d71722bdccf7feef7ff189d72375d35cef
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_a547bc1cc42683cbea61cfba35309121_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_a547bc1cc42683cbea61cfba35309121_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:504
    • C:\Users\Admin\AppData\Local\Temp\2024-06-08_a547bc1cc42683cbea61cfba35309121_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-08_a547bc1cc42683cbea61cfba35309121_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:5084
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2884ab58,0x7fff2884ab68,0x7fff2884ab78
        3⤵
          PID:4628
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:2
          3⤵
            PID:4396
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
            3⤵
              PID:3996
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
              3⤵
                PID:3828
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:1
                3⤵
                  PID:2968
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:1
                  3⤵
                    PID:3324
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:1
                    3⤵
                      PID:5376
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
                      3⤵
                        PID:5500
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
                        3⤵
                          PID:5544
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
                          3⤵
                            PID:5408
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
                            3⤵
                              PID:5568
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:5680
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5784
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5964
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5564
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:8
                              3⤵
                                PID:5836
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4208 --field-trial-handle=1884,i,17832689980690850087,2321512157385473715,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1180
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:2664
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:540
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:3300
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1072
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:396
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1416
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:4240
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:2680
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:2624
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:388
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3384
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4004
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:3952
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3340
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:3184
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4908
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:4696
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4412
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2848
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4280
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3880
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1260
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3564
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2512
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5996
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:6048

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 7f9d2691bd3f6a28c27b27a2b4f3b3e03c732944f32678abfded8acd20245e54
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 1.7MB
                                    • SHA256 0fde918568e10a7a67999f9baf58c478f8e6cad64e953da47246b3cf12c9dbf1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 1.7MB
                                    • SHA256 5ebe7be260e4b3466dcd0613a3b3bbdaf2655c5d2aa276d6754b418eb41cde5b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 2e5a9624bb338a1259c4714cfdfddca44ad8a7e1a3360f6e8bb29b6c31c95d06
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 cee5e6b0a83ff9d03648b79868437cb48ed043dbe82f6df05123d1e0b7b4aa56
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    20240608114136.pma
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\20240608114136.pma
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 bc2822a5efb199dcc655254b162e8e690280697a639ba9b6901133798470dafc
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    f_000005
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
                                    • Size 34KB
                                    • SHA256 d65aa8d67d47a97471bd1abcdf0374fe1b1b80afb4ec66eabad5fe7b6d1afa03
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 09c5163ddd305818d41b2cd2b8947d1124902ffbe76ad060d88a71014906e6d2
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 c50d92486f100bcc5c026d1858d4daa7514650964bc2612097bd54d88dab4ab0
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 9cb40338607f2a647e3a1de46a84978a3bd582b9537b52449079553e038e6447
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe579b94.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe579b94.TMP
                                    • Size 2KB
                                    • SHA256 078b9af3cc02d4ce24f484c105def6fa6ab3b239269d39b503bd592cd8721ca2
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 736571176a84131ace06568d93a76a434eb5d29795bd5d10545e65d5da4654de
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 263KB
                                    • SHA256 3b2cb6dd9b0858c4035123cb6afba9868eb111accc805993d4be7a6c3d6a60f2
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 1355023e1f6bbd3fea87027eba6e6d4560d5117c398146cd6a5673b225b969a8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 9KB
                                    • SHA256 08c4de10c89dd344f47c756d3f82fd09b938a28c93d68f28fa5f95ee448ac22d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    51cb178fd590e271.bin
                                    • Path C:\Users\Admin\AppData\Roaming\51cb178fd590e271.bin
                                    • Size 12KB
                                    • SHA256 dbb0a33e63bb00d86b171dbf68c19aa08c94fbfd3083fad3a22167958d4c67f2
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 1.4MB
                                    • SHA256 47e2f013349e7962eeedf4b8eceaeaa4832767d194e67d609519a325cc29b572
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 d9082bc9ac36e47be127f58c1545fc756f219467c4b238ba1fd4e75d7479c6f5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 1.5MB
                                    • SHA256 28eaf817b9b9d85793a75619b6cf11a3fed00b960ec3324036a174adbc3cbe76
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 c83328b103b8e816e7a8934a9a289b0be92b8571b2560b5f9cf4af18f64a33d5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 1.4MB
                                    • SHA256 38ff041264df0318a15a65d084db8e552697aa4b05841751ce4deb86eba4d86f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 1.8MB
                                    • SHA256 67049b5af660a4563d7ab499a8c794567efbf30e0bac6a57a2d8f5f2c05e9c2d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 1.5MB
                                    • SHA256 b8d810661a1172af7983d092c968597d6811b37e699a79a5bb5be3847bba47c7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 523cb1aebc1413bf3c663929f7af5577befd2f2fe709be23bf0803ab81394b07
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 9f4e4148e700a063fff205bbea9da572a84fecb82a88efcc1b1c21b36b4d90b5
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 884b566b114ea720a5a5f5ad8639749ff683b0e442f76d142880911b9d07ebe6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 1.7MB
                                    • SHA256 7a5e20e2bd8c9dea5938f1c97180261968dc4e656a53d75764d3634a53b14635
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 c3460ff07a44cd8e6b3b7991d6f408879f38bed9b63428b4b1ddc4c502274f1a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 1.5MB
                                    • SHA256 d3e2755fa28826919b07f34de8b29c57f09aab058d9b8d1478b68e798c6e0e34
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 1.6MB
                                    • SHA256 4cc23fae8c39fdc7047a8f73836312543662c4b64d086109f6da95ce88e377fa
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 1.4MB
                                    • SHA256 620f158e6164256536f59de98e73bffa6ce398c3ce2fc68dbff0115c6c6d3c7b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 8b37c8d2a8eb8d4b639824b50eb470da2e64947a3acf437fae3c5384f1e31346
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 1.6MB
                                    • SHA256 28f954837901c13310f0322a004861e0d4b2130bf8af304b99f10fc88fa4af35
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 5ab8a28d27adc6886c3ec4c0326acedd4ec7a7f328b0a8ddee2e565a2aecc3db
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 53b715becb7434a9ec7cebf218a7397d5c30fb50f6d3ac578728024f00ba194e
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/388-276-0x0000000140000000-0x000000014018B000-memory.dmp
                                    Download

                                    memory/396-74-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/396-383-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/396-72-0x00000000007F0000-0x0000000000850000-memory.dmp
                                    Download

                                    memory/396-66-0x00000000007F0000-0x0000000000850000-memory.dmp
                                    Download

                                    memory/504-6-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/504-10-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/504-28-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/504-21-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/504-0-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/540-51-0x0000000140000000-0x0000000140189000-memory.dmp
                                    Download

                                    memory/540-52-0x0000000000690000-0x00000000006F0000-memory.dmp
                                    Download

                                    memory/540-43-0x0000000000690000-0x00000000006F0000-memory.dmp
                                    Download

                                    memory/1072-61-0x0000000000A10000-0x0000000000A70000-memory.dmp
                                    Download

                                    memory/1072-55-0x0000000000A10000-0x0000000000A70000-memory.dmp
                                    Download

                                    memory/1072-63-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/1072-103-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/1260-287-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/1416-681-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/1416-78-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/1416-84-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/1416-274-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/2512-289-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/2512-683-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/2624-275-0x0000000140000000-0x00000001401AF000-memory.dmp
                                    Download

                                    memory/2664-39-0x0000000140000000-0x000000014018A000-memory.dmp
                                    Download

                                    memory/2664-36-0x00000000006F0000-0x0000000000750000-memory.dmp
                                    Download

                                    memory/2664-30-0x00000000006F0000-0x0000000000750000-memory.dmp
                                    Download

                                    memory/2664-632-0x0000000140000000-0x000000014018A000-memory.dmp
                                    Download

                                    memory/2680-273-0x0000000140000000-0x0000000140199000-memory.dmp
                                    Download

                                    memory/2848-214-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/3184-281-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/3340-280-0x0000000140000000-0x0000000140176000-memory.dmp
                                    Download

                                    memory/3384-277-0x0000000000400000-0x0000000000577000-memory.dmp
                                    Download

                                    memory/3564-288-0x0000000140000000-0x00000001401A6000-memory.dmp
                                    Download

                                    memory/3564-682-0x0000000140000000-0x00000001401A6000-memory.dmp
                                    Download

                                    memory/3880-286-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/3952-279-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/3952-617-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4004-278-0x0000000140000000-0x0000000140175000-memory.dmp
                                    Download

                                    memory/4240-88-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                    Download

                                    memory/4240-100-0x0000000140000000-0x00000001401AF000-memory.dmp
                                    Download

                                    memory/4280-285-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/4412-284-0x0000000140000000-0x00000001401C2000-memory.dmp
                                    Download

                                    memory/4908-283-0x0000000140000000-0x00000001401E2000-memory.dmp
                                    Download

                                    memory/5084-17-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/5084-20-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/5084-544-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/5564-571-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5564-686-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5680-612-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5680-531-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5784-545-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5784-685-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5964-601-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5964-559-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download