Overview

overview

7

Static

static

3

2024-06-08...uk.exe

windows7-x64

1

2024-06-08...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_c3ef02c51ac0a07399bbd59a7275aa1e_ryuk.exe
  • Size 5.5MB
  • Sample240608-yflghaga74
  • SHA256 20443527044d527809a5c8f199a92557bf5e313183c44879efe4e1ffa67d85d1
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_c3ef02c51ac0a07399bbd59a7275aa1e_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_c3ef02c51ac0a07399bbd59a7275aa1e_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Users\Admin\AppData\Local\Temp\2024-06-08_c3ef02c51ac0a07399bbd59a7275aa1e_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-08_c3ef02c51ac0a07399bbd59a7275aa1e_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2d4,0x2d8,0x2e4,0x2e0,0x2e8,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1436
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4a5dab58,0x7ffa4a5dab68,0x7ffa4a5dab78
        3⤵
          PID:2948
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:2
          3⤵
            PID:3140
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
            3⤵
              PID:1728
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
              3⤵
                PID:4464
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:1
                3⤵
                  PID:3508
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:1
                  3⤵
                    PID:800
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4356 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:1
                    3⤵
                      PID:5688
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
                      3⤵
                        PID:5956
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
                        3⤵
                          PID:5976
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
                          3⤵
                            PID:6012
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                            3⤵
                            • Executes dropped EXE
                            PID:4488
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x26c,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                              4⤵
                              • Executes dropped EXE
                              PID:860
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                              4⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of FindShellTrayWindow
                              PID:4324
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x14044ae48,0x14044ae58,0x14044ae68
                                5⤵
                                • Executes dropped EXE
                                PID:5484
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
                            3⤵
                              PID:4364
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5032 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:8
                              3⤵
                                PID:636
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1916,i,5231646197595555661,17754576176919875151,131072 /prefetch:2
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5740
                          • C:\Windows\System32\alg.exe
                            C:\Windows\System32\alg.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            • Drops file in Windows directory
                            PID:1604
                          • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                            1⤵
                            • Executes dropped EXE
                            PID:4808
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                            1⤵
                              PID:4044
                            • C:\Windows\system32\fxssvc.exe
                              C:\Windows\system32\fxssvc.exe
                              1⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4344
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1072
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:384
                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:3188
                            • C:\Windows\System32\msdtc.exe
                              C:\Windows\System32\msdtc.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:4576
                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                              1⤵
                              • Executes dropped EXE
                              PID:4704
                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                              1⤵
                              • Executes dropped EXE
                              PID:916
                            • C:\Windows\SysWow64\perfhost.exe
                              C:\Windows\SysWow64\perfhost.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4900
                            • C:\Windows\system32\locator.exe
                              C:\Windows\system32\locator.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2644
                            • C:\Windows\System32\SensorDataService.exe
                              C:\Windows\System32\SensorDataService.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:4720
                            • C:\Windows\System32\snmptrap.exe
                              C:\Windows\System32\snmptrap.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4684
                            • C:\Windows\system32\spectrum.exe
                              C:\Windows\system32\spectrum.exe
                              1⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              PID:1004
                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                              1⤵
                              • Executes dropped EXE
                              PID:684
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                              1⤵
                                PID:1732
                              • C:\Windows\system32\TieringEngineService.exe
                                C:\Windows\system32\TieringEngineService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious use of AdjustPrivilegeToken
                                PID:756
                              • C:\Windows\system32\AgentService.exe
                                C:\Windows\system32\AgentService.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1248
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1440
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:940
                              • C:\Windows\system32\wbengine.exe
                                "C:\Windows\system32\wbengine.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3304
                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                C:\Windows\system32\wbem\WmiApSrv.exe
                                1⤵
                                • Executes dropped EXE
                                PID:212
                              • C:\Windows\system32\SearchIndexer.exe
                                C:\Windows\system32\SearchIndexer.exe /Embedding
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4128
                                • C:\Windows\system32\SearchProtocolHost.exe
                                  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:5680
                                • C:\Windows\system32\SearchFilterHost.exe
                                  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:232

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    elevation_service.exe
                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                                    • Size 2.1MB
                                    • SHA256 26bce1a8dd1bd26c1a3d2fb3934ba1f5f4431439135e04693cd7d28bb57ce793
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    maintenanceservice.exe
                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                    • Size 1.5MB
                                    • SHA256 be7649e8b08c0f7910c8b18b4f6539f441ca65572fd878132b0fd9d344cdf27f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    7z.exe
                                    • Path C:\Program Files\7-Zip\7z.exe
                                    • Size 1.8MB
                                    • SHA256 e9215154e114c7b4072c3e4ef0653af9452b7c7eb4e0e010840edecba700d387
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    7zFM.exe
                                    • Path C:\Program Files\7-Zip\7zFM.exe
                                    • Size 1.5MB
                                    • SHA256 dc09c52a89aa2eedf598b96d184e02cb9025fd780f4954ba3ad3d74e313917d4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    7zG.exe
                                    • Path C:\Program Files\7-Zip\7zG.exe
                                    • Size 1.2MB
                                    • SHA256 309d72dc6cafa1b46c3b83bfe3fac2fe0d9be720492bb20b3281028c6e448d22
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Uninstall.exe
                                    • Path C:\Program Files\7-Zip\Uninstall.exe
                                    • Size 1.3MB
                                    • SHA256 8080f3d22325cc49621e6e24d2e7e6d2c46ffdb99fe5074d56d6790034bd3ccf
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AppVShNotify.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                    • Size 1.5MB
                                    • SHA256 545d2f9fddeccef0c1af672e7f578ccfecef28f1dedeed8cb52327e1f26fdb20
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    IntegratedOffice.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                    • Size 4.6MB
                                    • SHA256 ed5a87aa9b619251800e1c641cb746b80a61286f4cabd1604037482d897e224a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    MavInject32.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                    • Size 1.6MB
                                    • SHA256 68024ba1a52b3733f0542f1aba25db19def73ffcfe8b7045d8a8a58080c6dc6a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OfficeC2RClient.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                    • Size 24.0MB
                                    • SHA256 51ec8f995893d8bd434c20589a725915a90571afd0d185717b1ca9ec863737e0
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    appvcleaner.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                    • Size 2.7MB
                                    • SHA256 178f3287a61c28cac98bba18acf71356ca3305024d3e854e9dad9d6ea7b0452d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    LICLUA.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                    • Size 1.1MB
                                    • SHA256 8a6ea761f7594ca8a0fc2c4aa5f98950a71ab77b851a6f1cbc4ce1a9fd93f49f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    OSE.EXE
                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                    • Size 1.5MB
                                    • SHA256 8ac0b3635e64ad4b849ac5a89037deb120a668b22dabb4172a1b796097edaf4e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSTOInstaller.exe
                                    • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                    • Size 1.3MB
                                    • SHA256 951d7959ae05fe991679484acbd2a1a8cab2d7fe1b896ebfd1ffcc2658692d4f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrmstp.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                    • Size 5.4MB
                                    • SHA256 eb051e96e7bb418aaec5f32266ae902368351ed97b50df32aacdbd514b634e0c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    elevation_service.exe
                                    • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    • Size 2.2MB
                                    • SHA256 992313dc2d1f5d6589a53a4e4881628b3e4532c247a603cb27b34a31a4413a05
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    06ea6343-fddb-4feb-92e2-4eed20ad2582.tmp
                                    • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\06ea6343-fddb-4feb-92e2-4eed20ad2582.tmp
                                    • Size 488B
                                    • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    wmpnetwk.exe
                                    • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                    • Size 1.5MB
                                    • SHA256 0b401d6ffc5dcebed05eea8ad27b017dd028a78cc94e8d897419f403bbbc56a6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    dotnet.exe
                                    • Path C:\Program Files\dotnet\dotnet.exe
                                    • Size 1.4MB
                                    • SHA256 a67e26ee59046bc92c4f95a81c8529ef7ce3ab2776090f0de466c31a1c13da7c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 001c51870a28710313d50d9037f261881517a384d3e502d9112b04ea2e8538a1
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Google Profile.ico
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                    • Size 193KB
                                    • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Network Persistent State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                    • Size 1KB
                                    • SHA256 58724673db1606b9f5a5b3d89370ec3e2a5920249a4e5f2b484379733e81c89b
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    SCT Auditing Pending Reports
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                    • Size 2B
                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    TransportSecurity
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                    • Size 354B
                                    • SHA256 0a846bcae1da1d2b1b3dbbbf720da22d55e1208a525df6708e4b52b72a8c33a7
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                    • Size 5KB
                                    • SHA256 4978b3b90c1c6731727d6c1ce35a73f59daad76d7c071a323cbd6f1414823ed3
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Preferences~RFe57a1fd.TMP
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe57a1fd.TMP
                                    • Size 2KB
                                    • SHA256 13f018fd7e8d456a16ab52c9430b449ed2f126386dc10abb8d01ff752f92db72
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Secure Preferences
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                    • Size 16KB
                                    • SHA256 79192a181ebe864957468580b4f4e64e33c5c98e2b8afebff4a0977368720064
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Local State
                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                    • Size 263KB
                                    • SHA256 39b7c0c9aa59b2287fe231cadfd652c483dad6c7b57ed740a5aceefe8fc4547a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 7KB
                                    • SHA256 05388f232361a00fcde2d2cd6e1edee5c07e630b08f8f5511e00cfa5e3580201
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    chrome_installer.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                    • Size 8KB
                                    • SHA256 62d79a8115e69ba894b7528f85c6c87e2413e98d670d08f727d61e49238bb762
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    a7b53f008beeeac9.bin
                                    • Path C:\Users\Admin\AppData\Roaming\a7b53f008beeeac9.bin
                                    • Size 12KB
                                    • SHA256 6bbac401d336a0bfb7bfd9259aeeaf41f87c9511c17f8a33035bf35a1dfee0f7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    perfhost.exe
                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                    • Size 1.3MB
                                    • SHA256 7255a311009a53f9b67e72596730e2472545ef76f17338470472a280e12ece55
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    AgentService.exe
                                    • Path C:\Windows\System32\AgentService.exe
                                    • Size 1.7MB
                                    • SHA256 d7b74d85b3a5fe4a0d1a7ba4c95775e2c9d64cc4715e6058453d8e03051e9b0a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    DiagnosticsHub.StandardCollector.Service.exe
                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                    • Size 1.3MB
                                    • SHA256 50114aec9f401ce38f54ad43d7bc0fd38e3e5fbca0540bfc265c5bbe5bcb13e2
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    FXSSVC.exe
                                    • Path C:\Windows\System32\FXSSVC.exe
                                    • Size 1.2MB
                                    • SHA256 7fce60292401fc97d0331ee377ef230ae925792eb3dbeab729a0ba79ef88df6b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Locator.exe
                                    • Path C:\Windows\System32\Locator.exe
                                    • Size 1.2MB
                                    • SHA256 f92265157e3d2612c49ae16cec2c171fd6f239c73c1007fd8a5f295d265b5dcd
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ssh-agent.exe
                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                    • Size 1.6MB
                                    • SHA256 35909951a2b6bfccace9a26fa7dbaa3d9d5908de4470794f27b4056c7082a0e4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    PerceptionSimulationService.exe
                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                    • Size 1.3MB
                                    • SHA256 8f6dff8c9581344cc226bc0a021a44c721fda3c13b5f001ee9187895b2ab6913
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SearchIndexer.exe
                                    • Path C:\Windows\System32\SearchIndexer.exe
                                    • Size 1.4MB
                                    • SHA256 630ffaa9594a238e504aa9bb66284fd8ef9e8ac736d661cfbe036ca3876feaaf
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SensorDataService.exe
                                    • Path C:\Windows\System32\SensorDataService.exe
                                    • Size 1.8MB
                                    • SHA256 fb935bda0c7207ce9457016e1089b1beb8713d4d215e612d9856190cefd43e04
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Spectrum.exe
                                    • Path C:\Windows\System32\Spectrum.exe
                                    • Size 1.4MB
                                    • SHA256 45a87999c02afeaf7414320ab33b4c8746b3c7effacdedd15898e317bdcb301f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    TieringEngineService.exe
                                    • Path C:\Windows\System32\TieringEngineService.exe
                                    • Size 1.5MB
                                    • SHA256 31ec67cd1dcf71678a598e211010295a9763ac0c885d34d27d5d5106021c88be
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VSSVC.exe
                                    • Path C:\Windows\System32\VSSVC.exe
                                    • Size 2.0MB
                                    • SHA256 409ec1a647bc24fdc9accd59a9764c0f501c9b5dbc067a70b954d8c68d3233b1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    alg.exe
                                    • Path C:\Windows\System32\alg.exe
                                    • Size 1.3MB
                                    • SHA256 f48e5099fe7c55539badd6ab22e5c93f2d5e3bb0f49f3d1e18090cc99ade9d46
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msdtc.exe
                                    • Path C:\Windows\System32\msdtc.exe
                                    • Size 1.4MB
                                    • SHA256 04a5b883dd7b6a2fb85ff0765805988002de591dd8c3e75287571786cf77115a
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    snmptrap.exe
                                    • Path C:\Windows\System32\snmptrap.exe
                                    • Size 1.3MB
                                    • SHA256 b77025bafb259708967431cef37c6c087a5ea0c46ee38d31345dd5686c398620
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    vds.exe
                                    • Path C:\Windows\System32\vds.exe
                                    • Size 1.3MB
                                    • SHA256 0b4580473b142cb1ae54cbfbd565c3dd05375a1eb87c5be4080fa3418504c3a6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    WmiApSrv.exe
                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                    • Size 1.4MB
                                    • SHA256 c295d603b9504c4dcb5273a61030086ff617308936aff3224cb075b8b789ad00
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    wbengine.exe
                                    • Path C:\Windows\System32\wbengine.exe
                                    • Size 2.1MB
                                    • SHA256 278d87c56ec27164c89619f69816ec5f5c4f4e5a1ba87983e8d4c502499478b1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    settings.dat
                                    • Path C:\Windows\TEMP\Crashpad\settings.dat
                                    • Size 40B
                                    • SHA256 81519c37e7b764606c063607c2fdc287f28845aed7cce899222c4f714f16f860
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    AppVClient.exe
                                    • Path C:\Windows\system32\AppVClient.exe
                                    • Size 1.3MB
                                    • SHA256 74dd0ec8d4908163118baba964ef04e80a14aeeae2e529b3b503d2097ae89d39
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    SgrmBroker.exe
                                    • Path C:\Windows\system32\SgrmBroker.exe
                                    • Size 1.5MB
                                    • SHA256 920c73ab64afb48b0a0b848bba61f25395546aedaa253d9b151f75530c742bd9
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    msiexec.exe
                                    • Path C:\Windows\system32\msiexec.exe
                                    • Size 1.3MB
                                    • SHA256 3a9156ff84faee54d25371f301f022cfe8241402c48f16ea90be6138e042b6a4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    memory/212-311-0x0000000140000000-0x0000000140175000-memory.dmp
                                    Download

                                    memory/212-756-0x0000000140000000-0x0000000140175000-memory.dmp
                                    Download

                                    memory/384-89-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/384-91-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/384-83-0x00000000001A0000-0x0000000000200000-memory.dmp
                                    Download

                                    memory/384-722-0x0000000140000000-0x000000014022B000-memory.dmp
                                    Download

                                    memory/684-218-0x0000000140000000-0x00000001401B1000-memory.dmp
                                    Download

                                    memory/756-227-0x0000000140000000-0x0000000140191000-memory.dmp
                                    Download

                                    memory/756-755-0x0000000140000000-0x0000000140191000-memory.dmp
                                    Download

                                    memory/860-761-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/860-546-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/916-203-0x0000000140000000-0x000000014015A000-memory.dmp
                                    Download

                                    memory/940-309-0x0000000140000000-0x00000001401FC000-memory.dmp
                                    Download

                                    memory/1004-745-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/1004-209-0x0000000140000000-0x0000000140169000-memory.dmp
                                    Download

                                    memory/1072-355-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/1072-77-0x0000000140000000-0x000000014024B000-memory.dmp
                                    Download

                                    memory/1072-69-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                    Download

                                    memory/1072-75-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                    Download

                                    memory/1248-249-0x0000000140000000-0x00000001401C0000-memory.dmp
                                    Download

                                    memory/1436-521-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1436-12-0x0000000002080000-0x00000000020E0000-memory.dmp
                                    Download

                                    memory/1436-21-0x0000000002080000-0x00000000020E0000-memory.dmp
                                    Download

                                    memory/1436-20-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/1440-308-0x0000000140000000-0x0000000140147000-memory.dmp
                                    Download

                                    memory/1604-28-0x0000000000540000-0x00000000005A0000-memory.dmp
                                    Download

                                    memory/1604-38-0x0000000000540000-0x00000000005A0000-memory.dmp
                                    Download

                                    memory/1604-523-0x0000000140000000-0x0000000140159000-memory.dmp
                                    Download

                                    memory/1604-27-0x0000000140000000-0x0000000140159000-memory.dmp
                                    Download

                                    memory/2644-205-0x0000000140000000-0x0000000140144000-memory.dmp
                                    Download

                                    memory/3188-106-0x0000000140000000-0x000000014017E000-memory.dmp
                                    Download

                                    memory/3188-94-0x0000000001A50000-0x0000000001AB0000-memory.dmp
                                    Download

                                    memory/3304-310-0x0000000140000000-0x0000000140216000-memory.dmp
                                    Download

                                    memory/4128-313-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4128-757-0x0000000140000000-0x0000000140179000-memory.dmp
                                    Download

                                    memory/4324-569-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/4324-585-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/4344-81-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4344-57-0x0000000140000000-0x0000000140135000-memory.dmp
                                    Download

                                    memory/4344-79-0x0000000000A00000-0x0000000000A60000-memory.dmp
                                    Download

                                    memory/4344-64-0x0000000000A00000-0x0000000000A60000-memory.dmp
                                    Download

                                    memory/4344-58-0x0000000000A00000-0x0000000000A60000-memory.dmp
                                    Download

                                    memory/4488-600-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/4488-535-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/4576-201-0x0000000140000000-0x0000000140168000-memory.dmp
                                    Download

                                    memory/4588-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4588-0-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/4588-9-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/4588-23-0x0000000000510000-0x0000000000570000-memory.dmp
                                    Download

                                    memory/4588-39-0x0000000140000000-0x0000000140592000-memory.dmp
                                    Download

                                    memory/4684-208-0x0000000140000000-0x0000000140145000-memory.dmp
                                    Download

                                    memory/4704-202-0x0000000140000000-0x000000014017E000-memory.dmp
                                    Download

                                    memory/4720-611-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4720-207-0x0000000140000000-0x00000001401D7000-memory.dmp
                                    Download

                                    memory/4808-54-0x0000000140000000-0x0000000140158000-memory.dmp
                                    Download

                                    memory/4808-52-0x00000000004C0000-0x0000000000520000-memory.dmp
                                    Download

                                    memory/4808-46-0x00000000004C0000-0x0000000000520000-memory.dmp
                                    Download

                                    memory/4900-204-0x0000000000400000-0x0000000000546000-memory.dmp
                                    Download

                                    memory/5484-572-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download

                                    memory/5484-762-0x0000000140000000-0x000000014057B000-memory.dmp
                                    Download