Overview

overview

7

Static

static

3

2024-06-08...uk.exe

windows7-x64

1

2024-06-08...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_b9b03abe2907306cc1465c374bcf03b9_ryuk.exe
  • Size 5.5MB
  • Sample240608-yc52qsfc5w
  • SHA256 56c5e8bd408259e6cf7ae7cfc7ca27af9c898393c099f2ee984a99ec0cf55f8a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_b9b03abe2907306cc1465c374bcf03b9_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_b9b03abe2907306cc1465c374bcf03b9_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\2024-06-08_b9b03abe2907306cc1465c374bcf03b9_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-08_b9b03abe2907306cc1465c374bcf03b9_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1956
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4dd8ab58,0x7ffd4dd8ab68,0x7ffd4dd8ab78
        3⤵
          PID:3296
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:2
          3⤵
            PID:3196
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
            3⤵
              PID:1812
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
              3⤵
                PID:2684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:1
                3⤵
                  PID:4944
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:1
                  3⤵
                    PID:2540
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4332 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:1
                    3⤵
                      PID:3604
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
                      3⤵
                        PID:5316
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
                        3⤵
                          PID:5376
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
                          3⤵
                            PID:5956
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
                            3⤵
                              PID:5288
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:2040
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:5584
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:5644
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5736
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:8
                              3⤵
                                PID:6048
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1836,i,6577343747283754128,18101389469775016177,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2108
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3036
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:4972
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:3500
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3104
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2132
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3300
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:4036
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:2088
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:4584
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4976
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1772
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1916
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4772
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:320
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4580
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1368
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:1964
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2896
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2584
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3200
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1384
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4036
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4340
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3668
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5256
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4664

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 14786d124deb4bb3f98381b7ae47c17ac9e8f08ae0e00fe4cc99ffc50544f395
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 1.5MB
                                    • SHA256 d445022e42f5c36fd705cefb6c641e53b2cac3d5a3827bd5e0d801ce4672836b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 1.5MB
                                    • SHA256 1d57b300947c7c880c7ca1819e1774464114eb0b88671a074f1b6977efdd08c3
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 ba451970ceddf69f6925a0811317156ba1a20c837900490fdd85761929f289e8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 61b9464b4f00ad8a00053f0a7603b1322b11342275d8ddd531fc992164d90f4b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    4634e601-a968-448c-8457-70f214ef0ca8.tmp
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4634e601-a968-448c-8457-70f214ef0ca8.tmp
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 d15ec0b42a1305238584533da0ddd5ec2959a76896cabc74599185af8af9e92a
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 ceccd038bb68fd91a6b5b2bfe1f834c783c38685edc849b1bc6ce58851f473e8
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 356B
                                    • SHA256 0267cdf7ef9faf0d4d7cf5efeafeac523f65d5f973eb18311958bc425aac5f58
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 ce087522304f49919803f9e7e009d6cf15f19584a57432085af57ac306ec067a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe577a02.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe577a02.TMP
                                    • Size 2KB
                                    • SHA256 e7fedf1f3f9f65c94434b56a0a6b0be4a9773cb80c1fe09b6391adaec9849dbc
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 7d7940e1acab487671a01c49cd4d025e1533b728ea78d1bedd8fa54e47bc18eb
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 263KB
                                    • SHA256 a7c23738a5aebe57d26309c78eea9d297332603c5b576a33107d005185f68ea1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 b19f0d208856fe6f33b94db199091daa7f870bcea17153650e6751db5f4d982a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 90def98dfeea7b99168b1e701350572fdc6874bbdc93f4ab5193820a87b9619b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    fa64847cb4b1389a.bin
                                    • Path C:\Users\Admin\AppData\Roaming\fa64847cb4b1389a.bin
                                    • Size 12KB
                                    • SHA256 42bb9ea32ff742ca6a5539c16ec2dbb61065d383a84f219883269e229dab2833
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 1.2MB
                                    • SHA256 9b96d524ddbb1de6f913a1efaad384ba9db871832f0f968f94f54bcb35214d69
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 5ff30e348a094f6ede290d7dad62059b754b7c1047e97e2f45359049f03dd22e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 1.3MB
                                    • SHA256 1f3111e32a1fc5b5826fa4333bf224199ea64b330a68a0506c651335027e9173
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 517961e69ad6cb3b13b96c53cfc0115a03fdbfe9a5b3756e14cde0c9f8dc8c6c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 1.2MB
                                    • SHA256 7ab4193c1096bf1a66709d2fea3c6be2e9adf2087abab95bc7270e0cf56cf5bd
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 1.6MB
                                    • SHA256 a35f8858f8708bc0a614b476d8a55799747fef0002a5c5d04676331f2463069f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 1.3MB
                                    • SHA256 c9ad96aa8e980386f1c79a686d1f97fa155e71decb70a0e1f0a1640c8a1dfe56
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 e6b9925a971d21f4c9fb10c1c785ee475c213c71cb65ba29e5bd7188312c285d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 a09fec7f9dbb0ec8b41019351e49ded597ec892233d8fb9472d5cf8f68b23a7e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 289f639caaa8b566881ac9b22b298cb54080e818c24f53227460a6b3bae6960d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 1.5MB
                                    • SHA256 9a1b75fed4a127dec3c67dd6d3e65e167414c46b18cae6bbe9cb9e27746ca8c6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 2263fbb09a3e77a7daf38670fbd1395d6fe37767fbf99feb38ce4cf02f39ac61
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 1.3MB
                                    • SHA256 cc9a2718193b734f926a47e8695fcadad1059d646f54268fc73ecfc97e587b5e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 1.4MB
                                    • SHA256 3bce55d6a39b61e310b9f0328ae6ad71b95eff18610befb7f030436be50e4492
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 1.2MB
                                    • SHA256 a313a2dcc96505e914a14268dffdc39a16dafd5c32b8a4705f5e94b46e2dc4dc
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 9f511dd1881087b629c7cbdc9c9f58469ff2b4e1059c7cec6575ffdb210c7295
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 1.4MB
                                    • SHA256 48949ef6a298df41c839998ed91a4d17bc968396d9946f03e92a13522ca3c980
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 76895dc17aba65ab5ec9576961def577632096d0012f7709ef41caed9c63e9df
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 ee8fad0e09119ff89b6f13fc18df351e81b41199adfc10acbfeccbbb88e02a9d
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    memory/320-200-0x0000000140000000-0x00000001401ED000-memory.dmp
                                    Download

                                    memory/848-22-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/848-25-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/848-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/848-9-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/848-0-0x0000000000820000-0x0000000000880000-memory.dmp
                                    Download

                                    memory/1368-202-0x0000000140000000-0x0000000140259000-memory.dmp
                                    Download

                                    memory/1384-205-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/1772-195-0x0000000000400000-0x00000000005EE000-memory.dmp
                                    Download

                                    memory/1916-196-0x0000000140000000-0x00000001401EC000-memory.dmp
                                    Download

                                    memory/1956-453-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1956-17-0x0000000001FE0000-0x0000000002040000-memory.dmp
                                    Download

                                    memory/1956-21-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1956-11-0x0000000001FE0000-0x0000000002040000-memory.dmp
                                    Download

                                    memory/2040-487-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/2040-426-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/2088-191-0x0000000140000000-0x0000000140210000-memory.dmp
                                    Download

                                    memory/2132-58-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                    Download

                                    memory/2132-106-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                    Download

                                    memory/2132-108-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/2132-75-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/2132-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                    Download

                                    memory/2584-175-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/2896-203-0x0000000140000000-0x0000000140239000-memory.dmp
                                    Download

                                    memory/3036-33-0x0000000140000000-0x0000000140201000-memory.dmp
                                    Download

                                    memory/3104-60-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/3104-94-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/3200-204-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/3300-545-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3300-63-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3300-80-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/3300-69-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/3668-579-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/3668-208-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4036-101-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                    Download

                                    memory/4036-104-0x0000000140000000-0x0000000140226000-memory.dmp
                                    Download

                                    memory/4036-85-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                    Download

                                    memory/4036-206-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/4036-91-0x0000000001A80000-0x0000000001AE0000-memory.dmp
                                    Download

                                    memory/4036-83-0x0000000140000000-0x0000000140226000-memory.dmp
                                    Download

                                    memory/4340-578-0x0000000140000000-0x000000014021D000-memory.dmp
                                    Download

                                    memory/4340-207-0x0000000140000000-0x000000014021D000-memory.dmp
                                    Download

                                    memory/4580-201-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/4584-192-0x0000000140000000-0x0000000140226000-memory.dmp
                                    Download

                                    memory/4584-112-0x00000000004F0000-0x0000000000550000-memory.dmp
                                    Download

                                    memory/4584-118-0x00000000004F0000-0x0000000000550000-memory.dmp
                                    Download

                                    memory/4772-199-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4772-512-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4972-43-0x0000000140000000-0x0000000140200000-memory.dmp
                                    Download

                                    memory/4972-44-0x00000000006A0000-0x0000000000700000-memory.dmp
                                    Download

                                    memory/4972-35-0x00000000006A0000-0x0000000000700000-memory.dmp
                                    Download

                                    memory/4976-124-0x0000000000B70000-0x0000000000BD0000-memory.dmp
                                    Download

                                    memory/4976-194-0x0000000140000000-0x0000000140202000-memory.dmp
                                    Download

                                    memory/5584-431-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5584-628-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5644-476-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5644-448-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5736-463-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5736-629-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download