Overview

overview

7

Static

static

3

2024-06-08...uk.exe

windows7-x64

1

2024-06-08...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 19:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_9441aa72c86020cb6190a9114a275b4e_ryuk.exe
  • Size 5.5MB
  • Sample240608-x6dc5sfb31
  • SHA256 33eb6c4ae44079dfa0a1cb508a970c68a23506f57b84d6663ebfcc419ae117f1
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_9441aa72c86020cb6190a9114a275b4e_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_9441aa72c86020cb6190a9114a275b4e_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\2024-06-08_9441aa72c86020cb6190a9114a275b4e_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-08_9441aa72c86020cb6190a9114a275b4e_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2488
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8be60ab58,0x7ff8be60ab68,0x7ff8be60ab78
        3⤵
          PID:1860
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:2
          3⤵
            PID:5464
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
            3⤵
              PID:5576
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2104 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
              3⤵
                PID:5584
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:1
                3⤵
                  PID:5660
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:1
                  3⤵
                    PID:5668
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4228 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:1
                    3⤵
                      PID:1952
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4504 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
                      3⤵
                        PID:4632
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
                        3⤵
                          PID:5392
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4808 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
                          3⤵
                            PID:4492
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
                            3⤵
                              PID:5560
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:4384
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x274,0x26c,0x29c,0x268,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5320
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5324
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:6148
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:8
                              3⤵
                                PID:5396
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 --field-trial-handle=1908,i,3775771577081637809,1510418286823423755,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:7056
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:4936
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:940
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:4568
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4216
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2920
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:396
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:3624
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:3980
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4720
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2768
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2180
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:464
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3064
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:2944
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3316
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:4404
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3000
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4496
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3940
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4816
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1004
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4264
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5020
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5868
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5336
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4456,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
                                1⤵
                                  PID:5260

                                Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      elevation_service.exe
                                      • Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
                                      • Size 2.3MB
                                      • SHA256 06b9af32d22b3b2e47dea6298b05cc013e84e6b6ee28af7204cc18938525fac4
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      maintenanceservice.exe
                                      • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                      • Size 797KB
                                      • SHA256 db2878c979422bad223519ed4440b196888360556812091a6759514073913a5e
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      OSE.EXE
                                      • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                      • Size 805KB
                                      • SHA256 9df20a1e0d53cc8c195b8c9cfec1df20382e8ff0dd749737d259578f0659baaa
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      chrmstp.exe
                                      • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                      • Size 5.4MB
                                      • SHA256 c7f1363ec131f2e5cda6e5383a8841e84bb4eea6de049de7b03fa55e464dd249
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      elevation_service.exe
                                      • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                      • Size 2.2MB
                                      • SHA256 18d44cebe6cc6864f3140d2fd8f7163319af30a1f3cd72ccd41209bc25390d7b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      c46d4e7f-8783-4307-8001-079465b39365.tmp
                                      • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\c46d4e7f-8783-4307-8001-079465b39365.tmp
                                      • Size 488B
                                      • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      settings.dat
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                      • Size 40B
                                      • SHA256 0cc277125b5bd55a7c42e32f351b5bce3ca6003f28bc0646db5bc6b9b5135c07
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Google Profile.ico
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                      • Size 193KB
                                      • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Network Persistent State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                      • Size 1KB
                                      • SHA256 2b5c018db95771eff9077be55fc39b9daa99e8f02324784ac875d31c885d372a
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      SCT Auditing Pending Reports
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                      • Size 2B
                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      TransportSecurity
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                      • Size 356B
                                      • SHA256 36656e206669731ca319783299b9fd3be0e4e38bf680b8954f0d2d957e1d86e1
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                      • Size 5KB
                                      • SHA256 6271915adafa643af21e2efdb412d40db00c162471068cd4c563b690830dc47d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Preferences~RFe581671.TMP
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe581671.TMP
                                      • Size 2KB
                                      • SHA256 6568b506f3cb4367abf414e66e1e93a4d4e40339dd3a2a1d5ded1f1907484337
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      Secure Preferences
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                      • Size 16KB
                                      • SHA256 d32851ff7fa95781bf42cd2e67fd0d9f847ad54d791e661d2040400b9fa8f8e5
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Local State
                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                      • Size 263KB
                                      • SHA256 d6e01c38f04d80850bff9765d5fecc8dba8c9181c74091bb996a269904ed5e07
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      chrome_installer.log
                                      • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                      • Size 7KB
                                      • SHA256 1e0c2dd80f2ea5dd03f88b9a2fd56000dc4857fa52ea06e99c22a8ceabcd5ce2
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      chrome_installer.log
                                      • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                      • Size 8KB
                                      • SHA256 adbd7e116b16b753cc2acfd40c427fcaf183f1d947d7247499409939eb14b7bb
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      f0225e50c3a5208d.bin
                                      • Path C:\Users\Admin\AppData\Roaming\f0225e50c3a5208d.bin
                                      • Size 12KB
                                      • SHA256 9d78aa8f8bbe109585a8d1fbedef7ac53d228eac653687ef250c63bd6f59fcfa
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      perfhost.exe
                                      • Path C:\Windows\SysWOW64\perfhost.exe
                                      • Size 588KB
                                      • SHA256 00effaf22a6123cc26503a502ee95c26fde576c6f1cc318b48b9c333dc795cc2
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      AgentService.exe
                                      • Path C:\Windows\System32\AgentService.exe
                                      • Size 1.7MB
                                      • SHA256 d9d7f5535bc88b596363ad4e447b662a8b63dcb6f310500e5bcf5318bc34461d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      DiagnosticsHub.StandardCollector.Service.exe
                                      • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                      • Size 659KB
                                      • SHA256 d63ecfe92dbb761c37ff318d05dc4b82474b5e1b03bdb14fff87674bf93d8f88
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      FXSSVC.exe
                                      • Path C:\Windows\System32\FXSSVC.exe
                                      • Size 1.2MB
                                      • SHA256 7715938ee2f586d1295dbd7c84a98dc180b27bacc3e0f2b3327d80ae7778f74d
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Locator.exe
                                      • Path C:\Windows\System32\Locator.exe
                                      • Size 578KB
                                      • SHA256 4d21e7f43ce0984410db295490dd6385314951f54d7ca2752c689f66a2b87b5c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      ssh-agent.exe
                                      • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                      • Size 940KB
                                      • SHA256 5967b8962cc8809e7c8f531198724d538f8b7e5fc6ab5ac5e56a7e4024f3083e
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      PerceptionSimulationService.exe
                                      • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                      • Size 671KB
                                      • SHA256 f99c6f5a51fdbd9e2143b84116c3fdfd445ea3ec1c2ab5aa98c1a0e6e1df7393
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      SearchIndexer.exe
                                      • Path C:\Windows\System32\SearchIndexer.exe
                                      • Size 1.4MB
                                      • SHA256 e582eeb3d08b90bf6c854711bcf62d9c1f11c35e0fe34c417a80913530a5aa12
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      SensorDataService.exe
                                      • Path C:\Windows\System32\SensorDataService.exe
                                      • Size 1.8MB
                                      • SHA256 f54c1950d7d5020a48514411f664e27e2d5cdac552fcfa8792316bb3fb6c4259
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      Spectrum.exe
                                      • Path C:\Windows\System32\Spectrum.exe
                                      • Size 1.4MB
                                      • SHA256 e66e81ca31ef5a348c2ae93f3ab5b5e475c0c314776abff94943508fa36c310c
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      TieringEngineService.exe
                                      • Path C:\Windows\System32\TieringEngineService.exe
                                      • Size 885KB
                                      • SHA256 c22938c08ce2d336e8fc0059052a7af3be58b4f8a5553567d7265852a566161a
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      VSSVC.exe
                                      • Path C:\Windows\System32\VSSVC.exe
                                      • Size 2.0MB
                                      • SHA256 fd3f7b5c3b72f4f1c65f2c7bdc92332faba34b945da8985fc12e48627b049a2a
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      alg.exe
                                      • Path C:\Windows\System32\alg.exe
                                      • Size 661KB
                                      • SHA256 65414e06eb6fde3b6b45a743eaf674dbfcff49908c7ca3b6960cfa2f69c6ff7b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      msdtc.exe
                                      • Path C:\Windows\System32\msdtc.exe
                                      • Size 712KB
                                      • SHA256 0dec70265b28a65c3c92b7f8abca9990b40229fcc768a525f289a40a0151e892
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      snmptrap.exe
                                      • Path C:\Windows\System32\snmptrap.exe
                                      • Size 584KB
                                      • SHA256 b2112e75141a7b0c61b510d43bd87db251c39d98b9d99b7048351d0c98776817
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      vds.exe
                                      • Path C:\Windows\System32\vds.exe
                                      • Size 1.3MB
                                      • SHA256 f41d8d02d47b0be4b5648b2e07661b23ff7c2753e0fa110bb1afa4089382c7e6
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      WmiApSrv.exe
                                      • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                      • Size 772KB
                                      • SHA256 d1752cbd098c3c667e5869523d695de7dc6f3892d1cddcdc1a53d9d7de08a6dd
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      wbengine.exe
                                      • Path C:\Windows\System32\wbengine.exe
                                      • Size 2.1MB
                                      • SHA256 76c945d61dd249afb8021970398401f5388759fa46e90f57fd3c5c5c96d7890b
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download

                                      settings.dat
                                      • Path C:\Windows\TEMP\Crashpad\settings.dat
                                      • Size 40B
                                      • SHA256 afd8ccad757251c38eecbb67fc9f41af5aecfec62b521b229c5b17e17ba05eae
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      memory/396-88-0x0000000001A70000-0x0000000001AD0000-memory.dmp
                                      Download

                                      memory/396-100-0x0000000140000000-0x00000001400CF000-memory.dmp
                                      Download

                                      memory/464-309-0x0000000140000000-0x00000001401D7000-memory.dmp
                                      Download

                                      memory/464-600-0x0000000140000000-0x00000001401D7000-memory.dmp
                                      Download

                                      memory/940-42-0x00000000006C0000-0x0000000000720000-memory.dmp
                                      Download

                                      memory/940-53-0x0000000140000000-0x00000001400A9000-memory.dmp
                                      Download

                                      memory/940-48-0x00000000006C0000-0x0000000000720000-memory.dmp
                                      Download

                                      memory/1004-316-0x0000000140000000-0x0000000140216000-memory.dmp
                                      Download

                                      memory/2000-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                                      Download

                                      memory/2000-301-0x0000000140000000-0x000000014024B000-memory.dmp
                                      Download

                                      memory/2000-453-0x0000000140000000-0x000000014024B000-memory.dmp
                                      Download

                                      memory/2000-65-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                                      Download

                                      memory/2180-308-0x0000000140000000-0x0000000140095000-memory.dmp
                                      Download

                                      memory/2316-37-0x0000000140000000-0x0000000140592000-memory.dmp
                                      Download

                                      memory/2316-6-0x00000000020D0000-0x0000000002130000-memory.dmp
                                      Download

                                      memory/2316-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                      Download

                                      memory/2316-0-0x00000000020D0000-0x0000000002130000-memory.dmp
                                      Download

                                      memory/2316-22-0x00000000020D0000-0x0000000002130000-memory.dmp
                                      Download

                                      memory/2488-556-0x0000000140000000-0x0000000140592000-memory.dmp
                                      Download

                                      memory/2488-19-0x0000000140000000-0x0000000140592000-memory.dmp
                                      Download

                                      memory/2488-20-0x00000000020D0000-0x0000000002130000-memory.dmp
                                      Download

                                      memory/2768-305-0x0000000000400000-0x0000000000497000-memory.dmp
                                      Download

                                      memory/2920-78-0x0000000000890000-0x00000000008F0000-memory.dmp
                                      Download

                                      memory/2920-84-0x0000000000890000-0x00000000008F0000-memory.dmp
                                      Download

                                      memory/2920-300-0x0000000140000000-0x0000000140267000-memory.dmp
                                      Download

                                      memory/2944-311-0x0000000140000000-0x0000000140169000-memory.dmp
                                      Download

                                      memory/3000-313-0x0000000140000000-0x00000001400E2000-memory.dmp
                                      Download

                                      memory/3064-310-0x0000000140000000-0x0000000140096000-memory.dmp
                                      Download

                                      memory/3316-312-0x0000000140000000-0x0000000140102000-memory.dmp
                                      Download

                                      memory/3624-302-0x0000000140000000-0x00000001400B9000-memory.dmp
                                      Download

                                      memory/3940-314-0x0000000140000000-0x0000000140147000-memory.dmp
                                      Download

                                      memory/3980-303-0x0000000140000000-0x00000001400CF000-memory.dmp
                                      Download

                                      memory/4216-76-0x0000000140000000-0x0000000140135000-memory.dmp
                                      Download

                                      memory/4216-55-0x0000000000E80000-0x0000000000EE0000-memory.dmp
                                      Download

                                      memory/4216-74-0x0000000000E80000-0x0000000000EE0000-memory.dmp
                                      Download

                                      memory/4216-61-0x0000000000E80000-0x0000000000EE0000-memory.dmp
                                      Download

                                      memory/4264-647-0x0000000140000000-0x00000001400C6000-memory.dmp
                                      Download

                                      memory/4264-317-0x0000000140000000-0x00000001400C6000-memory.dmp
                                      Download

                                      memory/4384-520-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/4384-591-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/4496-211-0x0000000140000000-0x00000001401C0000-memory.dmp
                                      Download

                                      memory/4720-304-0x0000000140000000-0x00000001400AB000-memory.dmp
                                      Download

                                      memory/4816-646-0x0000000140000000-0x00000001401FC000-memory.dmp
                                      Download

                                      memory/4816-315-0x0000000140000000-0x00000001401FC000-memory.dmp
                                      Download

                                      memory/4936-636-0x0000000140000000-0x00000001400AA000-memory.dmp
                                      Download

                                      memory/4936-35-0x0000000000700000-0x0000000000760000-memory.dmp
                                      Download

                                      memory/4936-28-0x0000000140000000-0x00000001400AA000-memory.dmp
                                      Download

                                      memory/4936-29-0x0000000000700000-0x0000000000760000-memory.dmp
                                      Download

                                      memory/5020-318-0x0000000140000000-0x0000000140179000-memory.dmp
                                      Download

                                      memory/5020-648-0x0000000140000000-0x0000000140179000-memory.dmp
                                      Download

                                      memory/5320-714-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/5320-543-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/5324-580-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/5324-558-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/6148-559-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download

                                      memory/6148-715-0x0000000140000000-0x000000014057B000-memory.dmp
                                      Download