Overview

overview

7

Static

static

3

2024-06-08...uk.exe

windows7-x64

1

2024-06-08...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 17:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_6215269d6ff15b1dde9986ede2b3a09c_ryuk.exe
  • Size 5.5MB
  • Sample240608-vl5wjsdf2t
  • SHA256 03faa530a16476f12c836c1996906220d1556d119cadb695aecc796806c5b6fc
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_6215269d6ff15b1dde9986ede2b3a09c_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_6215269d6ff15b1dde9986ede2b3a09c_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\2024-06-08_6215269d6ff15b1dde9986ede2b3a09c_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-08_6215269d6ff15b1dde9986ede2b3a09c_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1336
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3240
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffb5336ab58,0x7ffb5336ab68,0x7ffb5336ab78
        3⤵
          PID:3992
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:2
          3⤵
            PID:4608
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
            3⤵
              PID:2720
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2064 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
              3⤵
                PID:2236
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:1
                3⤵
                  PID:3524
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:1
                  3⤵
                    PID:824
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4188 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:1
                    3⤵
                      PID:5232
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4400 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
                      3⤵
                        PID:5312
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
                        3⤵
                          PID:5320
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
                          3⤵
                            PID:5932
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
                            3⤵
                              PID:6000
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:6128
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:3516
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5520
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5620
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:8
                              3⤵
                                PID:1680
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 --field-trial-handle=1880,i,15860870945937428704,9687341595763707785,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5384
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4880
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:696
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:5016
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4544
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3444
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3616
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:4028
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:3560
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:4164
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3684
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1316
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1912
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4980
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3468
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:988
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1776
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:440
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2156
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1504
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:2664
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2272
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3500
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4340
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1588
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5580
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5712

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 2c5cf490975234fdd4979a741fb2ada9fe9ead9280fc326374a26084083c97cc
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 1.4MB
                                    • SHA256 1fdff3ffe7cfe296dfd3e2c61aa663113cc3fd4b0f54dce23becca9ad4054472
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 1.4MB
                                    • SHA256 b9dc7777bca9cb1939599f8da7e0abf7d2da0cc12acf160525e6c7bbdfecc0ef
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 ff03f13a3ffa6421c2c7cd9eca7ce4f6cbd9cc0ef4920c641538839d7103d4e8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 d49dfc461158c3af260e9581abe08732a4d5186ed02b7914875d6bc7ef47f870
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 d987cb1f82d1cfa20deebd5947b3ce1b9ae9ca25cb7df736727c507a3a17700a
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 3c87b10c763c081e4044c9e7919a5c0cb19dd6577f61eac5c6141cc52172a663
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 f2299c41c7450aea140fcd7236207199ed2c03f38834dec715b529d0bfc7fca1
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 e6017a39fcb85e3ca22c6c90ae954eaa8d275c5af0e375e8365e71e2d8149b1e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe5779f3.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5779f3.TMP
                                    • Size 2KB
                                    • SHA256 0217b1195d87db614149675e331d00b581206641c58f6c7cd8cadb92e718f8cb
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 3c9be0afeb2d10d7549a433f76b20f1f7b63092db2002b1f73b25924c4afbff6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 263KB
                                    • SHA256 63a6b8c6347d46085a3b7fa76f6753e3e5fdefa0843dd0e52b79718ac9c2094b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 dd466235798891a13d06c7a8ca81b11a10a782e8ceb597b1817d99173d65c079
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 bee94851dc152af8e42e72ecd2e16f0460d2a0e0fced5fb425d4ceff88bd8535
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    4cae138a1ed82f9f.bin
                                    • Path C:\Users\Admin\AppData\Roaming\4cae138a1ed82f9f.bin
                                    • Size 12KB
                                    • SHA256 6c3d817f239dfdf8f7ea700193edb7a5d4c2fa664ef2ccc3939033a7bff2a609
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 1.2MB
                                    • SHA256 44fd844727e7936512bf0f186f665688ad29ae42a5eda9c31fd035bd28f40dd3
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 56e0c7b13bcdcb5c1801b1969a23bcf7aa54b6a884448f473cc58510a6ecc55b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 1.2MB
                                    • SHA256 67e10d93fca1d4d236155bb4e41740788e82320ae2f93e9a0e3336502bd3f5c1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 07f44d54de1f4f31cdf23241bbca88e2a2c23832341f053670b33afb0e3b1d99
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 1.1MB
                                    • SHA256 ed486f419a52e37e4de6e9e7d8c518c4983b7f1bb90e07455df148e10d513f1c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 1.5MB
                                    • SHA256 dd99c10201cad2c67ac17c3f64ef710d650e4b06a5fb3ed2a41e1f8d6a232e85
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 1.2MB
                                    • SHA256 3aa8a7c96fcb39908f9b27be3d1e0617cd35ca1aee276555391efa290417c606
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 72bd101449c8fe8886b0ac513477fa131d715cc75e10c47fd18c4640e61ebc73
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 ec07099abe500f289fa7da65877366db6ececaa5bf789cc0334f5635cd524a70
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 2568b037ab9ceb635cbfe6f486b63d1fd74f940becab13a54df869a5939a26dd
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 1.4MB
                                    • SHA256 7c54ec3b85224482f2992d8a45a0f7d02d495b16b39b80e76d91702dc3d0a5fc
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 cb94f9ca00f9f242b1e397928a319c85fcf5b6c94e2e25c0624d87ff792f84af
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 1.2MB
                                    • SHA256 f3ad3250a00b77005d3e56731b3927294f63941cefca22c3de22d51999225f2d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 1.3MB
                                    • SHA256 5809659c37e68574b17e5372540ee2de220db54eaa656769529ab0cb0103fd0f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 1.2MB
                                    • SHA256 426e5c56eca6f8ea5c4141af5a299d1f5c2e529fd11ba7e62a296059eab94c88
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 e5d1052f372a25b1b57042f5689ae2739ec428458b7b5b6b7c93b412cadd4e29
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 1.3MB
                                    • SHA256 69363bff9e79716487ee21c70cec40342d11b8e8fc4649a69874efda05eaf4dd
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 cbbce193d9ebd166df43aab2948aaeb3772d9f8712a55f6b086ed3c5d0cae22f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 d228412aca7296096c2db6c01dfe1e83ca0db6a7fc2512468473c94bbc3e50f9
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/696-46-0x00000000004C0000-0x0000000000520000-memory.dmp
                                    Download

                                    memory/696-45-0x0000000140000000-0x000000014013E000-memory.dmp
                                    Download

                                    memory/696-36-0x00000000004C0000-0x0000000000520000-memory.dmp
                                    Download

                                    memory/988-219-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/1316-213-0x0000000000400000-0x000000000052C000-memory.dmp
                                    Download

                                    memory/1336-19-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1336-508-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1336-20-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                                    Download

                                    memory/1336-10-0x0000000001F90000-0x0000000001FF0000-memory.dmp
                                    Download

                                    memory/1504-152-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/1588-242-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/1588-526-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/1776-220-0x0000000140000000-0x0000000140197000-memory.dmp
                                    Download

                                    memory/1912-216-0x0000000140000000-0x000000014012A000-memory.dmp
                                    Download

                                    memory/2060-27-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/2060-0-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/2060-6-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/2060-18-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/2060-32-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/2156-230-0x0000000140000000-0x0000000140177000-memory.dmp
                                    Download

                                    memory/2272-234-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/2664-233-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/3444-344-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/3444-57-0x0000000000730000-0x0000000000790000-memory.dmp
                                    Download

                                    memory/3444-209-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/3444-51-0x0000000000730000-0x0000000000790000-memory.dmp
                                    Download

                                    memory/3468-218-0x0000000140000000-0x000000014012B000-memory.dmp
                                    Download

                                    memory/3500-236-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/3516-626-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/3516-446-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/3560-210-0x0000000140000000-0x000000014014E000-memory.dmp
                                    Download

                                    memory/3616-62-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3616-68-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3616-208-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3616-524-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3684-212-0x0000000140000000-0x0000000140140000-memory.dmp
                                    Download

                                    memory/3684-102-0x0000000000B30000-0x0000000000B90000-memory.dmp
                                    Download

                                    memory/4028-78-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                    Download

                                    memory/4028-81-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                    Download

                                    memory/4028-83-0x0000000140000000-0x0000000140164000-memory.dmp
                                    Download

                                    memory/4028-72-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                    Download

                                    memory/4164-95-0x0000000000800000-0x0000000000860000-memory.dmp
                                    Download

                                    memory/4164-211-0x0000000140000000-0x0000000140164000-memory.dmp
                                    Download

                                    memory/4164-89-0x0000000000800000-0x0000000000860000-memory.dmp
                                    Download

                                    memory/4340-241-0x0000000140000000-0x000000014015B000-memory.dmp
                                    Download

                                    memory/4340-525-0x0000000140000000-0x000000014015B000-memory.dmp
                                    Download

                                    memory/4544-60-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4880-521-0x0000000140000000-0x000000014013F000-memory.dmp
                                    Download

                                    memory/4880-29-0x0000000140000000-0x000000014013F000-memory.dmp
                                    Download

                                    memory/4980-493-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4980-217-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/5520-461-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5520-483-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5620-473-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5620-627-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/6128-433-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/6128-490-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download