Overview

overview

7

Static

static

3

2024-06-09...uk.exe

windows7-x64

1

2024-06-09...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    12s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 19:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-09_9e508fe0050cef968a255a32571ce6b5_ryuk.exe
  • Size 5.5MB
  • Sample240609-yl8h8afa26
  • SHA256 564aed83836d965f3d731c60f75c2deacb7a4ac071f2738f331200f13361e917
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_9e508fe0050cef968a255a32571ce6b5_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_9e508fe0050cef968a255a32571ce6b5_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Users\Admin\AppData\Local\Temp\2024-06-09_9e508fe0050cef968a255a32571ce6b5_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-06-09_9e508fe0050cef968a255a32571ce6b5_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=113.0.5672.93 --initial-client-data=0x2c8,0x2cc,0x2d0,0x29c,0x2d4,0x140462458,0x140462468,0x140462478
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbbd9ab58,0x7fffbbd9ab68,0x7fffbbd9ab78
        3⤵
          PID:936
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:2
          3⤵
            PID:5268
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
            3⤵
              PID:5412
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2044 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
              3⤵
                PID:5436
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:1
                3⤵
                  PID:5496
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:1
                  3⤵
                    PID:5504
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4324 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:1
                    3⤵
                      PID:6104
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4496 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
                      3⤵
                        PID:4280
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4584 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
                        3⤵
                          PID:5136
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4580 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
                          3⤵
                            PID:5736
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
                            3⤵
                              PID:5464
                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                              3⤵
                              • Executes dropped EXE
                              PID:5456
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x29c,0x294,0x298,0x290,0x2a0,0x14044ae48,0x14044ae58,0x14044ae68
                                4⤵
                                • Executes dropped EXE
                                PID:4976
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
                                4⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                PID:3416
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x14044ae48,0x14044ae58,0x14044ae68
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5736
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:8
                              3⤵
                                PID:6372
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 --field-trial-handle=1912,i,1540994945501945063,7534125519918233487,131072 /prefetch:2
                                3⤵
                                  PID:4940
                            • C:\Windows\System32\alg.exe
                              C:\Windows\System32\alg.exe
                              1⤵
                              • Executes dropped EXE
                              PID:4268
                            • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                              C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                              1⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              PID:3248
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                              1⤵
                                PID:4484
                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4996
                              • C:\Windows\system32\fxssvc.exe
                                C:\Windows\system32\fxssvc.exe
                                1⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2000
                              • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:3240
                              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4836
                              • C:\Windows\System32\msdtc.exe
                                C:\Windows\System32\msdtc.exe
                                1⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Drops file in Windows directory
                                PID:2608
                              • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                1⤵
                                • Executes dropped EXE
                                PID:1084
                              • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3560
                              • C:\Windows\SysWow64\perfhost.exe
                                C:\Windows\SysWow64\perfhost.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4960
                              • C:\Windows\system32\locator.exe
                                C:\Windows\system32\locator.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3192
                              • C:\Windows\System32\SensorDataService.exe
                                C:\Windows\System32\SensorDataService.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks SCSI registry key(s)
                                PID:4028
                              • C:\Windows\System32\snmptrap.exe
                                C:\Windows\System32\snmptrap.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1992
                              • C:\Windows\system32\spectrum.exe
                                C:\Windows\system32\spectrum.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks SCSI registry key(s)
                                PID:864
                              • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                C:\Windows\System32\OpenSSH\ssh-agent.exe
                                1⤵
                                • Executes dropped EXE
                                PID:3040
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                1⤵
                                  PID:3612
                                • C:\Windows\system32\TieringEngineService.exe
                                  C:\Windows\system32\TieringEngineService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks processor information in registry
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2512
                                • C:\Windows\system32\AgentService.exe
                                  C:\Windows\system32\AgentService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4900
                                • C:\Windows\System32\vds.exe
                                  C:\Windows\System32\vds.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:3752
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4684
                                • C:\Windows\system32\wbengine.exe
                                  "C:\Windows\system32\wbengine.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1332
                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4252
                                • C:\Windows\system32\SearchIndexer.exe
                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                  1⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1164
                                  • C:\Windows\system32\SearchProtocolHost.exe
                                    "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                    2⤵
                                    • Modifies data under HKEY_USERS
                                    PID:5112
                                  • C:\Windows\system32\SearchFilterHost.exe
                                    "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                    2⤵
                                    • Modifies data under HKEY_USERS
                                    PID:2240
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3900,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
                                  1⤵
                                    PID:2548
                                  • C:\Windows\system32\wbem\wmiprvse.exe
                                    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                    1⤵
                                      PID:4280

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          elevation_service.exe
                                          • Path C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
                                          • Size 2.3MB
                                          • SHA256 2515a9d282fcd4ea88dfdc53ddb69366fc2cbce01bd016f7860e7537859d8666
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          maintenanceservice.exe
                                          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                          • Size 797KB
                                          • SHA256 cd59dfe422dd7a5a76d3d6665592b49cf9976be18c002dcad1770bb4fe4e9b3b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          OSE.EXE
                                          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                          • Size 805KB
                                          • SHA256 50760d23cf89e9b78f31a651881d6035c0bdb6045b3b8f494ff88c36cd70015d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          chrmstp.exe
                                          • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
                                          • Size 5.4MB
                                          • SHA256 1a6ca864253b9aef494f81a53fb3cbcb5b0853507ff3b39e3c3a0e9ea4d8e968
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          elevation_service.exe
                                          • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                          • Size 2.2MB
                                          • SHA256 c8f09c4d574c30cc12445dc36d15b7a6af9b171b391abb0cae5cc07895c401c3
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          4b2c8d88-29f7-425a-ab91-2f0e03a55790.tmp
                                          • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4b2c8d88-29f7-425a-ab91-2f0e03a55790.tmp
                                          • Size 488B
                                          • SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                          • Size 40B
                                          • SHA256 0cc277125b5bd55a7c42e32f351b5bce3ca6003f28bc0646db5bc6b9b5135c07
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Google Profile.ico
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
                                          • Size 193KB
                                          • SHA256 e9eecf02f444877e789d64c2290d6922bd42e2f2fe9c91a1381959acd3292831
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                          • Size 1KB
                                          • SHA256 73af5eb53173d512ce3993724de81066c696ffe59b449f4b762a4871e0bd030a
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TransportSecurity
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                          • Size 356B
                                          • SHA256 2afe0e23ca06ca23439a8976b91e0ee5b73023c5febfe6ee560c0e1326992acd
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          • Size 5KB
                                          • SHA256 8b56a229ac0fc8b732e5a487f62f2f96fbffde4ea0ae0609e10467d9f5c30c0a
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Preferences~RFe581364.TMP
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe581364.TMP
                                          • Size 2KB
                                          • SHA256 6568b506f3cb4367abf414e66e1e93a4d4e40339dd3a2a1d5ded1f1907484337
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Secure Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                          • Size 16KB
                                          • SHA256 16b87553a8645a1ca25fe976b84229726722cc3e3d6fd607ae5c750f784a44ca
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 263KB
                                          • SHA256 696d962db89e0e54e7960a582c8771c267b3c842f38c9b0067b3a4822c46f786
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          chrome_installer.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                          • Size 7KB
                                          • SHA256 0500af2afa913dbe50853e2ae27e55def96d4a9692d7cd71f8b5a0763e42f7bf
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          chrome_installer.log
                                          • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                          • Size 9KB
                                          • SHA256 b9a07f4b0a5e9abfafa120820d481388e747e2c81bfb343983ec17ee40522f04
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          4564683ec3a5208d.bin
                                          • Path C:\Users\Admin\AppData\Roaming\4564683ec3a5208d.bin
                                          • Size 12KB
                                          • SHA256 532d00e3eab32c363373d0babb735391ebd181938034b1306c6d0ba1144070f9
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          perfhost.exe
                                          • Path C:\Windows\SysWOW64\perfhost.exe
                                          • Size 588KB
                                          • SHA256 710f94c7c9ad06319a1dbe37d0b2c0cd0a6f6f480c85feb8a102771c066f4a34
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          AgentService.exe
                                          • Path C:\Windows\System32\AgentService.exe
                                          • Size 1.7MB
                                          • SHA256 5dd90a634c562f89c352c719b95d7f075af703acf3d85f1d6bfe8baec3748651
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          DiagnosticsHub.StandardCollector.Service.exe
                                          • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                          • Size 659KB
                                          • SHA256 5a94dd672eaa1ab21daf0d32ccd5cc62d63f2336b0558083651f240461245408
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Locator.exe
                                          • Path C:\Windows\System32\Locator.exe
                                          • Size 578KB
                                          • SHA256 7de317318f709429145af39f4d612ae5bd76e391a3b14e31b51630e186b9afdf
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          ssh-agent.exe
                                          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                          • Size 940KB
                                          • SHA256 d6d893d94c9ee66eca7c9fcf43ed25e3afa9e45e34515cd44a5ea42e872ba4e8
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          PerceptionSimulationService.exe
                                          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                          • Size 671KB
                                          • SHA256 689634011e6d253cc787720291797e47ad0ff2f06b70506e866836a7459e2a9d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          SearchIndexer.exe
                                          • Path C:\Windows\System32\SearchIndexer.exe
                                          • Size 1.4MB
                                          • SHA256 9a3b0008db5c21b5c7abd3f7894cbe75894551f4b37c0f78515502186df81df3
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          SensorDataService.exe
                                          • Path C:\Windows\System32\SensorDataService.exe
                                          • Size 1.8MB
                                          • SHA256 7bfa959a62c1ce21829b11d5af389d6636613e263e9f9007b62a7f933c6e606c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Spectrum.exe
                                          • Path C:\Windows\System32\Spectrum.exe
                                          • Size 1.4MB
                                          • SHA256 104840c40d4710cfb4644b9c1038eddebbf92235fecef336f58fe07b64d740cb
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          TieringEngineService.exe
                                          • Path C:\Windows\System32\TieringEngineService.exe
                                          • Size 885KB
                                          • SHA256 10cc6dccfebd2186122df4490b039b944cd46813103fc287282f7e1e9f2994ac
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          VSSVC.exe
                                          • Path C:\Windows\System32\VSSVC.exe
                                          • Size 2.0MB
                                          • SHA256 dbed0bfd7c75af3c8c63e06288441be56cebfcdc22f6b0ca1ca0ec936b7507b9
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          alg.exe
                                          • Path C:\Windows\System32\alg.exe
                                          • Size 661KB
                                          • SHA256 9eb12388c0a92af32275f8ca5d57d06e534e121176f143bd134b1929c465e6a4
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          msdtc.exe
                                          • Path C:\Windows\System32\msdtc.exe
                                          • Size 712KB
                                          • SHA256 36a0bf6b8571db9d34a99a8a16c1219701e0436c24945de5d0856f24c3518de0
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          snmptrap.exe
                                          • Path C:\Windows\System32\snmptrap.exe
                                          • Size 584KB
                                          • SHA256 632d7981fc36fe15d1a0db9048aa0de1cf39e58e64c80b9df4e10e0ac2248d81
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          vds.exe
                                          • Path C:\Windows\System32\vds.exe
                                          • Size 1.3MB
                                          • SHA256 4756ddfac079b4ed91430800d88fb3d4310f231eaf878e55451eac9b74cdaf37
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          WmiApSrv.exe
                                          • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                          • Size 772KB
                                          • SHA256 4c2b10b07fa038ff93298dc1c1ddc8fd5a308ac35e31f29e0f3a1b8e31a578e7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          wbengine.exe
                                          • Path C:\Windows\System32\wbengine.exe
                                          • Size 2.1MB
                                          • SHA256 321d3348dbc7725f77ba2edfad67bd1fab701d33040549953840ea51b6a956ff
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          settings.dat
                                          • Path C:\Windows\TEMP\Crashpad\settings.dat
                                          • Size 40B
                                          • SHA256 afd8ccad757251c38eecbb67fc9f41af5aecfec62b521b229c5b17e17ba05eae
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          AppVClient.exe
                                          • Path C:\Windows\system32\AppVClient.exe
                                          • Size 1.3MB
                                          • SHA256 16ef8f15140b829784c5988b5e53ee4a6b41104efe7964ef76bd2364b46a5866
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          fxssvc.exe
                                          • Path C:\Windows\system32\fxssvc.exe
                                          • Size 1.2MB
                                          • SHA256 d5e457c411e16551267ca4d62a7ce3f3da71e3b402eaa5131947824329fcab1f
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          memory/864-172-0x0000000140000000-0x0000000140169000-memory.dmp
                                          Download

                                          memory/1084-91-0x0000000000440000-0x00000000004A0000-memory.dmp
                                          Download

                                          memory/1084-97-0x0000000000440000-0x00000000004A0000-memory.dmp
                                          Download

                                          memory/1084-163-0x0000000140000000-0x00000001400CF000-memory.dmp
                                          Download

                                          memory/1164-252-0x0000000140000000-0x0000000140179000-memory.dmp
                                          Download

                                          memory/1164-645-0x0000000140000000-0x0000000140179000-memory.dmp
                                          Download

                                          memory/1332-177-0x0000000140000000-0x0000000140216000-memory.dmp
                                          Download

                                          memory/1992-171-0x0000000140000000-0x0000000140096000-memory.dmp
                                          Download

                                          memory/2000-87-0x0000000140000000-0x0000000140135000-memory.dmp
                                          Download

                                          memory/2512-174-0x0000000140000000-0x00000001400E2000-memory.dmp
                                          Download

                                          memory/2608-165-0x0000000140000000-0x00000001400B9000-memory.dmp
                                          Download

                                          memory/3004-21-0x0000000000510000-0x0000000000570000-memory.dmp
                                          Download

                                          memory/3004-466-0x0000000140000000-0x0000000140592000-memory.dmp
                                          Download

                                          memory/3004-20-0x0000000140000000-0x0000000140592000-memory.dmp
                                          Download

                                          memory/3040-173-0x0000000140000000-0x0000000140102000-memory.dmp
                                          Download

                                          memory/3192-168-0x0000000140000000-0x0000000140095000-memory.dmp
                                          Download

                                          memory/3240-164-0x0000000140000000-0x0000000140267000-memory.dmp
                                          Download

                                          memory/3240-642-0x0000000140000000-0x0000000140267000-memory.dmp
                                          Download

                                          memory/3240-69-0x0000000000890000-0x00000000008F0000-memory.dmp
                                          Download

                                          memory/3240-63-0x0000000000890000-0x00000000008F0000-memory.dmp
                                          Download

                                          memory/3248-33-0x00000000006B0000-0x0000000000710000-memory.dmp
                                          Download

                                          memory/3248-38-0x0000000140000000-0x00000001400A9000-memory.dmp
                                          Download

                                          memory/3248-27-0x00000000006B0000-0x0000000000710000-memory.dmp
                                          Download

                                          memory/3416-446-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/3416-479-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/3560-104-0x0000000000600000-0x0000000000660000-memory.dmp
                                          Download

                                          memory/3560-166-0x0000000140000000-0x00000001400AB000-memory.dmp
                                          Download

                                          memory/3592-9-0x0000000000510000-0x0000000000570000-memory.dmp
                                          Download

                                          memory/3592-39-0x0000000000510000-0x0000000000570000-memory.dmp
                                          Download

                                          memory/3592-44-0x0000000140000000-0x0000000140592000-memory.dmp
                                          Download

                                          memory/3592-8-0x0000000140000000-0x0000000140592000-memory.dmp
                                          Download

                                          memory/3592-0-0x0000000000510000-0x0000000000570000-memory.dmp
                                          Download

                                          memory/3752-175-0x0000000140000000-0x0000000140147000-memory.dmp
                                          Download

                                          memory/4028-170-0x0000000140000000-0x00000001401D7000-memory.dmp
                                          Download

                                          memory/4028-538-0x0000000140000000-0x00000001401D7000-memory.dmp
                                          Download

                                          memory/4252-178-0x0000000140000000-0x00000001400C6000-memory.dmp
                                          Download

                                          memory/4252-644-0x0000000140000000-0x00000001400C6000-memory.dmp
                                          Download

                                          memory/4268-37-0x0000000140000000-0x00000001400AA000-memory.dmp
                                          Download

                                          memory/4684-176-0x0000000140000000-0x00000001401FC000-memory.dmp
                                          Download

                                          memory/4684-643-0x0000000140000000-0x00000001401FC000-memory.dmp
                                          Download

                                          memory/4836-85-0x0000000140000000-0x00000001400CF000-memory.dmp
                                          Download

                                          memory/4836-79-0x0000000001A70000-0x0000000001AD0000-memory.dmp
                                          Download

                                          memory/4836-83-0x0000000001A70000-0x0000000001AD0000-memory.dmp
                                          Download

                                          memory/4836-73-0x0000000001A70000-0x0000000001AD0000-memory.dmp
                                          Download

                                          memory/4900-154-0x0000000140000000-0x00000001401C0000-memory.dmp
                                          Download

                                          memory/4960-167-0x0000000000400000-0x0000000000497000-memory.dmp
                                          Download

                                          memory/4976-440-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/4976-647-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/4996-49-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                                          Download

                                          memory/4996-55-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                                          Download

                                          memory/4996-59-0x0000000140000000-0x000000014024B000-memory.dmp
                                          Download

                                          memory/4996-353-0x0000000140000000-0x000000014024B000-memory.dmp
                                          Download

                                          memory/5456-428-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/5456-490-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/5736-469-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download

                                          memory/5736-648-0x0000000140000000-0x000000014057B000-memory.dmp
                                          Download