Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 11:30

General

  • Target

    2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe

  • Size

    14.9MB

  • MD5

    7777965385f9180b50b561a78fc44ff1

  • SHA1

    2647dd3fc7b5a911301474af679c4db9f33f7842

  • SHA256

    29847ebafcead5a736de54c9a6ece3966787f43fb5a34542d56b77c5145d8acb

  • SHA512

    ab23b1b9536b27da1f8867bfc4c3d2795ffaa7b1b4cc407546b9184ca92c65255ea4919e800ea649236d4ba9e967777bd4b2b44c4ce3770b3990acd53c1939f9

  • SSDEEP

    196608:S7AP/NNECwHrc8u3x3AEcq/fByuKlWH3CToufqrR:Sa/vQHrc8u3xXJ/f4uUWHd

Malware Config

Signatures

  • Detects executables packed with Dotfuscator 2 IoCs
  • Detects executables packed with SmartAssembly 2 IoCs
  • Detects executables packed with Yano Obfuscator 2 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:440
    • \??\c:\users\admin\appdata\local\temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe
      c:\users\admin\appdata\local\temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=107.294.200 --initial-client-data=0x2d8,0x2cc,0x2d4,0x2c0,0x2dc,0x140325960,0x140325970,0x140325980
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2116
    • \??\c:\users\admin\appdata\local\temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe
      "c:\users\admin\appdata\local\temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_440_YAWEZWUDSAWJXUCS" --sandboxed-process-id=2 --init-done-notifier=832 --sandbox-mojo-pipe-token=3512868907126487890 --mojo-platform-channel-handle=808 --engine=2
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4500
    • \??\c:\users\admin\appdata\local\temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe
      "c:\users\admin\appdata\local\temp\2024-02-23_7777965385f9180b50b561a78fc44ff1_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_440_YAWEZWUDSAWJXUCS" --sandboxed-process-id=3 --init-done-notifier=1400 --sandbox-mojo-pipe-token=14112224018033169729 --mojo-platform-channel-handle=1396
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2812
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2624
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:1028
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4412
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
        PID:564
      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:1144
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:688
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:3336
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:2420
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:4892
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:2372
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        PID:4148
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:1512
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4352
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:2536
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2764
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:2876
        • C:\Windows\System32\OpenSSH\ssh-agent.exe
          C:\Windows\System32\OpenSSH\ssh-agent.exe
          1⤵
          • Executes dropped EXE
          PID:4280
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:1092
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:564
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:1748
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1644
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1612
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:1412
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:1804
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
            2⤵
            • Modifies data under HKEY_USERS
            PID:3608

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

                Filesize

                57KB

                MD5

                4cd4672918178f84ee5581312de43a2a

                SHA1

                ca22b5064e61003858b0b4f22c3a1b771806fa39

                SHA256

                90ff6330250e220b298455a74ac75707917ff0e3beca4f1a60ae7daeea88ee5a

                SHA512

                d747a3488f02620212bbf5eb4195098048e7912f5f495e384ce16a72bd60fb81253e95775298f258a78b9e5df2a646be9449eee036ad12e43a151e116de5942f

              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                Filesize

                405KB

                MD5

                6547ceb639dba32bf4c659dba7290376

                SHA1

                8fc6a7ca5ae13baf7a6e3698383297d57be1705d

                SHA256

                8e2ca3354ddd4b1990dab6d3158afc740c84033cb6a548aa5948d8ec92f4e269

                SHA512

                170e1bf6ab29686323d602e4db08445103a2280f9dd26df48b5b378cf8b6c916ae9ddc8235b2328d9c93931ac67dcb1a8f509d5b991e5460257cfa4320604838

              • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

                Filesize

                11KB

                MD5

                807691f92531afb281f08a7f0d8a76cd

                SHA1

                2a38a8bee2adf90ee06e6fdfba92ae4485d1be99

                SHA256

                f27bfa6e20bf5241c35e76269a42318bbcda1be3380c24ba38f2d31c78705438

                SHA512

                738b087e70a2ae10fcb6071f70886601b56235f9202a2a25484488c8f452a4965217879fcb87d69a530ba20e31c7b45bf66d1c7dd5b056c36dfe2879bc2f4067

              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                Filesize

                286KB

                MD5

                751a1aab73d3015ad6136d08c1aecd2f

                SHA1

                6927d2cc238510a8dbadd2100d3f54e44bcf75f0

                SHA256

                8922198953fad23070f7c61fde83d30053b32b70e04bf387946eb3a2d100fe5e

                SHA512

                721b4416df6a95f693fd0bacc54f45d6df91d2994424e366af1e7010ae578613a93bd6b5ea6b8a8b489a8075e5831da546eeea2b89b189b4d8072ee76325148b

              • C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log

                Filesize

                1KB

                MD5

                c0e27e4e7c6ca766e475020e2c8773e7

                SHA1

                2cbb476ec4c819f3a3eafc06413aa500dd3d93cc

                SHA256

                b8ac6ad033e6f4751cf15c723075a2e7b2062273cfb90e9b1de78a88265796c9

                SHA512

                85c300f7b5abce11a2342ff8492682111dd3d1b1b4d2cc930accf42baac434ab954d7acfcca1031d6d87e85f81a4139177eefd5f436abfc831e0dd46872af35c

              • C:\Users\Admin\AppData\Local\Temp\edls_64.dll

                Filesize

                449KB

                MD5

                79d7f318441c21d17739e43990697d1d

                SHA1

                9683265bf401d11313b768dfc4b3aeb10015d18c

                SHA256

                0ce49dc9f71360bf9dd21b8e3af4641834f85eed7d80a7de0940508437e68970

                SHA512

                67c7a7d3bbadeff21951809d2f843311328771ed46bc1ca14edba486263f56f86922668dd89d11b05a16130380b7543f7c9556d79503c505807407763e9d3595

              • C:\Users\Admin\AppData\Local\Temp\em000_64.dll

                Filesize

                37KB

                MD5

                f8b7cac6e9587baabf4045c34890c7ce

                SHA1

                61814262c6ee5ceaab2c0263c913cae52e203af7

                SHA256

                8b0613b91229c98dfa5398568a4fa40dde2a2d40028654f74923bc929d6b5b30

                SHA512

                4f80021fa2a6e6bd3cdd8248d6139d105dca984a914184d5b1e251e97daa77e36c4e059ed3a617ad12dd998eb603accd34ef3951261ad997a081d8ac934b6211

              • C:\Users\Admin\AppData\Local\Temp\em001_64.dll

                Filesize

                334KB

                MD5

                023024d74374f4f324b7528ef680d660

                SHA1

                cef55c531e324e730097077538c9872f0913f7b5

                SHA256

                f03d7e333853fbbcd508f8674c703575f4c8f8396af85f62c6ab9e61def4d0e8

                SHA512

                d50d481d834a1f3a41bf8b27132721d69014f82f01e5cc6bb1d3d1a14a1b767730f103456eac2bd51361a27d124d9f60f24a6dc4a667af780cc6a19cfdc0244a

              • C:\Users\Admin\AppData\Local\Temp\em002_64.dll

                Filesize

                320KB

                MD5

                fd3f64c102f03e5bab59708b9d2ed1da

                SHA1

                dd6eb89b2af74d3932a39ea70e1eaf233a68860a

                SHA256

                2bb890717df267bda88ecb5b503a2a3431291ee807a610e08475154dd12ad8f3

                SHA512

                5c3c61d1c8cd4a7c128bc5019483587ec07afa7418b99f96f6a9e803b6e0dd5e72650edc1f7a2570f1009ff8444ee993a2a1a98e31eaadf64eb560149ed96d73

              • C:\Users\Admin\AppData\Local\Temp\em003_64.dll

                Filesize

                576KB

                MD5

                9f6ce0db3bd04191069b114ca44efc59

                SHA1

                5f7c807762206b720d4a7176c92ea883d1f090af

                SHA256

                77b7677239f4e1299a7c7961b478d5401add74e4e27b57f64f8ae6e868b5c321

                SHA512

                0302a6e330878bc2d35fc6badcc9d7e682cf0574f1d4914c799faee7368e19862036d79a9f9bff5c3050ab1dc3a664792eef09a6cc5cd91af9d6f272963af720

              • C:\Users\Admin\AppData\Local\Temp\em004_64.dll

                Filesize

                508KB

                MD5

                df307e7183f011688d5f0d037742593a

                SHA1

                c534f2a5437f11d980f592199ab1b618dad6a60b

                SHA256

                6d8ce9827768ad0366a2cd3d4ac61b048f3791a20c70c93046fc1d3634b03210

                SHA512

                8913ed466b64a54495b29d9fa22e29d6a30ebd051d8f8f3a1ab9b4182e347dd57a41ec7ccc28960127297bb838ba842ea9aac5d1eea92baa70317f4225acbf60

              • C:\Users\Admin\AppData\Local\Temp\em005_64.dll

                Filesize

                312KB

                MD5

                3c2cf9d3f974156976c9fd7f1cedc643

                SHA1

                170f0a8e1f22bedc93f012ad8ec9d4d02cb4dc7c

                SHA256

                b59238aaf90e9644bee14f22be878623c714ba9526e90a8b738b5572ef20ed6c

                SHA512

                2e6ae7fc795d0b2e9c95e512f496726db6b0dc47805f1cc6338e3d80545b1e75cbfd8e64d3699fe51576d7c5bd90c6860cba9d3f94457a9bcb3d2149aa0c5bd1

              • C:\Windows\SysWOW64\perfhost.exe

                Filesize

                249KB

                MD5

                8855f9ef5e03fd027569a0c859cb636f

                SHA1

                00fbfc4b324bab201bf9271d5f927700c1b68300

                SHA256

                f628959db1611a59e46bc45775d7ad6d78bd744a47911aad9fcf9f53e4b20913

                SHA512

                0b3abb281c037c7de95dcb11da00fc2573294b2cbfd7ade55a1da70f992e60feeb2b42aa228e1c7166bbfda8c1f1899161afa8f36f6d6ea409e3ca4a83492631

              • C:\Windows\System32\AgentService.exe

                Filesize

                154KB

                MD5

                5b81a30b6effce3f9928929ff2f18625

                SHA1

                00f215c07564ec752887c5cd072f82cb9d82bab3

                SHA256

                3ad56fd528379cc3a7df5ca952b3f29435e1e356ea4ff70cdb4b529fc5f60f90

                SHA512

                b101b35040671759582deeff66417713b4981c14afb38df9423b5c341f64e5234e80e6cd5fbfbc9ef6f8a3919af101afc0f7b8de0775eae35d6f44b7eeb97ab5

              • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

                Filesize

                247KB

                MD5

                96721d710d90c5dff5630036652af0db

                SHA1

                beb0ff0f7d5e87701a480ea2841345d9488e355f

                SHA256

                ded5e986c7d7eeda1ca06550469a50d12fb2a232994323bdf8249ec3776fe35d

                SHA512

                a7b30e8b76b5ff2c7ee7a43bddda11a4dbb5df10a1e5ceab75a8f8ab615b600c0a9b783be54ea9e5af5d7066e600c143f74a12ef2d34d82606ca086620b6d3ae

              • C:\Windows\System32\FXSSVC.exe

                Filesize

                296KB

                MD5

                3cf8c5c11eb46e6eb29a5b3ab85182b4

                SHA1

                cb533cbfc83a3a8d55780ce0596b80027ed1c0d6

                SHA256

                4231ab5a64ba4bd7838dc29b2407fdbbaed505a492da499e612dbe0df36c0a73

                SHA512

                5f185d32d608217d208024683ad35f45f93c993bd9b5d1b45992c42f83cabd8218f1edf2ac5586bcf9a5b1b50f63cad8a04c69a3971ad0b1b48b07a3f721f2f3

              • C:\Windows\System32\Locator.exe

                Filesize

                153KB

                MD5

                97e5dcfef1c46942d3325cd8e1afc979

                SHA1

                72c8ae17fa33a9d38d41d3d4989ab263748a6491

                SHA256

                c18d4b9ce0b78300217b423eb9e1ed6698f25160a97a4e34dcc49cb59d8af099

                SHA512

                ab94efe5173b2f3818239a359531f88a18d726ca0c310ade0859834845064829d6cb98d2a292ac753acaa2481b9ab3ef4eacb6955b656af627897defcb9e55a3

              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                Filesize

                49KB

                MD5

                98f259000317ce76eb78efac69479f4f

                SHA1

                75e7ab401bfabe5c55a8cfaa1a072c5fb6468ab2

                SHA256

                c7b47b7e4524e4245a42affa6687429d9318a95e29d736a1a98416709edcff62

                SHA512

                53b8dd0dfdf699e74be54eb0823c638836a8ba81ab5f77d0f8fb4493865eaa1be9601d0a9550d252695f4d96043ce243e3fa7f967652804b75b204c15c373cda

              • C:\Windows\System32\OpenSSH\ssh-agent.exe

                Filesize

                105KB

                MD5

                e313c1f95253e45a3f5aae849a61af98

                SHA1

                f2883542d41313580ff772dbda6489ce98161b05

                SHA256

                5ddcc4ff59517074fd6eda89ea8a01d6e5d5645436d26588de765b2254108bf1

                SHA512

                2b859f6f174f51cf9704dd1fb6bce6f7997c0fcdcb6ced6c78a78ae93a2a27ed967edd7bd0c5b20ca0bf6da8cd99a4cdb91f7e97c4dadb2adfdfb573062ba887

              • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

                Filesize

                176KB

                MD5

                ec37ff3f5b53e70734f5b4159441c045

                SHA1

                cf22f5f4d8515125957417733d9855b309ea39e6

                SHA256

                6df76eefe0052967b30143a07f41a0dd3fe49fa973f95931af9e2179190d7409

                SHA512

                abcfcaff450ecf1dedbc26e0e092fb15cdc7367a85c2def501044117623f3aff9aeb0bf9a328b4f22c8544a571f9d4665e56e6366cbbbaad4675bbfc0c116dda

              • C:\Windows\System32\SearchIndexer.exe

                Filesize

                29KB

                MD5

                c20f248e9562a6e15962ecc6a29d4911

                SHA1

                b7f5217d10e93420a2c0bf14b9071c1ada6977a5

                SHA256

                df860892d6dc9dba848e14ff586b4a30c8a2f0972a9ad6903e85620e61bc0fa2

                SHA512

                6100a4a35f3d681dfb72215370a244cb92800eee207b9e4ce42985415db46a0d0ba4acbc4a4aca5e19f9d31b5f8a4335cdd977e5ecf09fb81470316fa08fa08e

              • C:\Windows\System32\SensorDataService.exe

                Filesize

                88KB

                MD5

                72308cbd3354bf4306ccf4e1cea5fb64

                SHA1

                b3e5b550a1965c5c681c7dca3ea6c6337adff2f1

                SHA256

                77d8ebf5ca6079090673a66ac285e825f2cc527190e2ee64f0f8a9153c9ba66c

                SHA512

                5d510588fd14b0d71a78081b085c04b8024c14625e7442d803195db0657c9cfecc8105d1aff7c8dbdea3a9be77b18e35390c6f78c0832469ec99c7a2a083951f

              • C:\Windows\System32\Spectrum.exe

                Filesize

                51KB

                MD5

                ab36a64677244dee02ed25ea6d24bff1

                SHA1

                028dc6dc3c3ba24b7a1309d70336589c480b1f08

                SHA256

                58d720fecc2bda5c881e224059519792901748136b8d97132d1d9a61b173fd10

                SHA512

                b5c0d06bdd7386f561c2a48ed32ce2a323c29fc81ebab0f83356aa0114e693e0604ce2d0c19c9791e1ec176e14ef02c6780251c721942f9781d36934b2bfcecd

              • C:\Windows\System32\TieringEngineService.exe

                Filesize

                209KB

                MD5

                fc06f9ee33f2a7a652eaa626fe2218c3

                SHA1

                1677f8320d98883b5ad58744a3667bf309602e82

                SHA256

                790b129b861582e25d0cacf9e48e02f4a2a6b2e73b2e04da558346293990eccd

                SHA512

                21d8e28e547ef96132dd80c38f690d7b7332241bb25724785d489b3c822ed970e13e7ff1aca017e7eb738365863eb7b0462b2d53b22e9c6a2cd471b6aa85ca1e

              • C:\Windows\System32\VSSVC.exe

                Filesize

                156KB

                MD5

                153547a20bd7bad3c5e2183a034a6a3d

                SHA1

                c7d2890bea3bc8ca6ee827af8c4f878b630a9849

                SHA256

                f6582ce1d31946dc892b7bc367e87432595fe23754ff1a53842aeb712d79fa32

                SHA512

                78ff38317b1e7697102f0f27a0c2be3b4984f993c73c505d88e7e715ff9d0a9964e652c3f0ac66af58cf4a8f1b4b7d467843fa49c295dbb4fda2c04931a1fe4c

              • C:\Windows\System32\alg.exe

                Filesize

                351KB

                MD5

                dc111e172b64b1c903ba7aff1fc62102

                SHA1

                6408b63198da32a508cb5a5b1fc363e96351f29f

                SHA256

                283685bc61bc6c41485182762f8c913d9142f3f0bb03cecc53c6bff9845f9452

                SHA512

                0efe0c00cb1fb2d16e4b131e5c4a140b8f8ce7f9dcc81ba00de696bf35a6e43060ea9b8fd89eeafe8f117aca37d8dc44c22f7871acb632dfd9e346d05201a9bb

              • C:\Windows\System32\msdtc.exe

                Filesize

                284KB

                MD5

                695710dff97449d17e524448c09d7b5f

                SHA1

                f240c6a144730480345a108b776296ae889ffaa4

                SHA256

                79c280ddfda5d974bf0e70669f71d05f4b8b5830613d2c170f1ce9c18dd99f89

                SHA512

                1ece4ad3864b8a6f8f558f6ec7a2f21e65c06de4989c9e191b12a34cc0a4c050fac105a79ec328f152a303877779383d71f5f973dfcba50679af1e3fa24f9d39

              • C:\Windows\System32\msiexec.exe

                Filesize

                551KB

                MD5

                fa87d1d61d1afdda0074c69b7a973c28

                SHA1

                ef049e6e17f701172e09f83713eb3d138badcfef

                SHA256

                497b5ef22b8efe101ed276925c6ac30db1ba2353e672310dec43cd80aee51778

                SHA512

                564b521b408827d1e53d9981429ec8474e3e325254ca9146ef440dfc47e4b6ec99310fdfe7f8ca41d82f272ce9af55d737bf0c369a88edf2d184cadb5badff0c

              • C:\Windows\System32\snmptrap.exe

                Filesize

                34KB

                MD5

                19603fb9ba3dbd2b369117be950c50a8

                SHA1

                14d07fe7bf64901f85dc262037f219ddefdea04e

                SHA256

                8e715bc2d3bcf15459bec9033506f1933ca20be734018f32c23d9168f8d339f7

                SHA512

                26e93b42c244e3515c6b3cb84dfc082be923edefa4a20cdd55b347b1eb946e587a2f7b3b3f6c0a9cadd13bab250a15b7c012d8241481fa46885642ef1215c8d8

              • C:\Windows\System32\vds.exe

                Filesize

                123KB

                MD5

                e0535fcae725d6e45ade82647504103f

                SHA1

                6b33f459233dec19782485a31f564b13c8afc86d

                SHA256

                929190a5bd03e07d01e39887d8df2971d8035c8263607f701a6dc90e5f53af15

                SHA512

                608ab990c49000b232ec91e2371a771564bd6dd8eedb948ed14fefc54534f621f0e6e8643c4e8df445cd92b1670eaafdc38a785d5474ea01f91257b10b768d8f

              • C:\Windows\System32\wbem\WmiApSrv.exe

                Filesize

                42KB

                MD5

                f57f146d714eb7caef0978352f2416eb

                SHA1

                c774aec70d17e1b0dff2e11d7c3b4e3a5c67c7ca

                SHA256

                7ac813dfb9a37463de8582c2b3a4be9275ac033bb9005cf0412448afc51527eb

                SHA512

                1d7165c013631ef8d93b73932b03b950a9ac0179eb6e210f51cea2c22f84dc57a4816df4e103d30958eaa86b4d07c1ee628ec3977370738dbfb0b399b857921b

              • C:\Windows\System32\wbengine.exe

                Filesize

                174KB

                MD5

                01e150394a3f9387678930ff2cc954da

                SHA1

                3b0f8a89333f9d6718788c4d6971cf777fd16d2d

                SHA256

                22fbf35010975b40850edf17cabae4a0826966fa7b66bd17d6f0d39885f0f1ed

                SHA512

                30c5b9736f17c986b3823e32ff16aea8667e6ab1368866645cdc89f37f1c57af11135ed981bbd77f54a87ce9fd03b3e77af71e6ae2bbaadfc6280329b3359d7a

              • \??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat

                Filesize

                40B

                MD5

                7f23abb8ea2977ca3620928e6d4f016b

                SHA1

                d3a3106566dad39bb64dbfe22580337fb056fee5

                SHA256

                ba2de2296651a49f7362a257ea33c0edf582dc208d84d38a75add2a1eac689da

                SHA512

                845f68bb7c0b2151a9ba3a81799356241c8d96d7e744ce2d9042fd95537af2df949cd21d5f6adf25ef48e06e0c26cf07b5e17b7c856e33f010284491069dff4e

              • \??\c:\users\admin\appdata\local\temp\em001_64.dll

                Filesize

                339KB

                MD5

                9db75f5afe2b6449adf69fc5180b8ca3

                SHA1

                b628bcc7e140a39b3d30d8cf8ddea3f32c0e539d

                SHA256

                542e785b6d9bd520f4f4c14eda44d215f381b03566d9b1440a41e8bd17535329

                SHA512

                0c83acb53c229b39a23ebf409815634d0be51adda1ea2df48d8e05e63c292f443d17f491799a5aa781a2846e41c5d8e493ce0139c16a78ed4d1f02ed879dd658

              • \??\c:\users\admin\appdata\local\temp\em002_64.dll

                Filesize

                160KB

                MD5

                8571cb2f77afb10e3c1685cdff26aa02

                SHA1

                a91e8849a7e79a57cdfbc130ff63806167a58018

                SHA256

                e1bfa717c8da2d8d8c59ae7ce6857e55660c04735beaed2c6323437d38a4491a

                SHA512

                ae160df312da2a04bd78e796d8009011f17e5237f2e9c5e25011e057a50c19c183b3b1d5257e90c806bcd59ef0d7d4513dafa54fc7defdb2c11937a2f0c3841b

              • \??\c:\users\admin\appdata\local\temp\em003_64.dll

                Filesize

                229KB

                MD5

                7b62448d6f41b1c4738217341b28fae7

                SHA1

                049255c1e31f1294e47384dadfc0c4d720e8b91f

                SHA256

                d2a87241ddbae2fcd9a650b84ff0cc0d08897a034e1bd24d7c84cbb7bf4f2d02

                SHA512

                36bd5a6df3c2aab1d9acf30e24634692a0fe8681938c33851c1fd79cc8f594f29815b57d73988a3133802edc217aab5aa0f4db76b5711a5f822fab6715a73cb8

              • \??\c:\users\admin\appdata\local\temp\em004_64.dll

                Filesize

                333KB

                MD5

                6f9589fbb74183b0a97898999be3667e

                SHA1

                2cd9d4a21f67d23eba5c77a01e93acc50f7dea18

                SHA256

                f457acee1f041744bb45269d323749f366fdfc3bfb98c2e218e63722803b75f8

                SHA512

                7283c60141d65e31df63534b1fefdbe37197fc0b365dfced418de9ac8f18f75228b8054781536e65242c7c015d9b6b72e0879fc8c5ba128fb9dde6edfa90a451

              • \??\c:\users\admin\appdata\local\temp\em005_64.dll

                Filesize

                193KB

                MD5

                f6aab20e8b555df1637dbca6b097c129

                SHA1

                a9a2353171a98b56097ea078aba83ac765ff76de

                SHA256

                199bd67cb6f7f9bceb80d59601e768392c70a7f4c5344c5c74636413436b127d

                SHA512

                ba89ca3241129d430ae980306b7a952897bbcce438ba15fa986a781d701783bd8835a13ccbdfd5981a4483993f46923f0d97b886ee948fcf6e16db84177bf359

              • memory/440-89-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/440-0-0x00000000008F0000-0x0000000000950000-memory.dmp

                Filesize

                384KB

              • memory/440-6-0x00000000008F0000-0x0000000000950000-memory.dmp

                Filesize

                384KB

              • memory/440-7-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/564-229-0x0000000140000000-0x00000001401C0000-memory.dmp

                Filesize

                1.8MB

              • memory/564-230-0x0000000140000000-0x00000001401C0000-memory.dmp

                Filesize

                1.8MB

              • memory/564-84-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

              • memory/564-85-0x0000000140000000-0x0000000140135000-memory.dmp

                Filesize

                1.2MB

              • memory/688-119-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

              • memory/688-182-0x0000000140000000-0x000000014022B000-memory.dmp

                Filesize

                2.2MB

              • memory/688-122-0x00000000001A0000-0x0000000000200000-memory.dmp

                Filesize

                384KB

              • memory/688-113-0x00000000001A0000-0x0000000000200000-memory.dmp

                Filesize

                384KB

              • memory/888-250-0x0000000140000000-0x0000000140179000-memory.dmp

                Filesize

                1.5MB

              • memory/888-315-0x0000000140000000-0x0000000140179000-memory.dmp

                Filesize

                1.5MB

              • memory/1028-135-0x0000000140000000-0x000000014029C000-memory.dmp

                Filesize

                2.6MB

              • memory/1028-47-0x00000000006C0000-0x0000000000720000-memory.dmp

                Filesize

                384KB

              • memory/1028-41-0x0000000140000000-0x000000014029C000-memory.dmp

                Filesize

                2.6MB

              • memory/1028-39-0x00000000006C0000-0x0000000000720000-memory.dmp

                Filesize

                384KB

              • memory/1092-287-0x0000000140000000-0x00000001402D5000-memory.dmp

                Filesize

                2.8MB

              • memory/1092-225-0x0000000140000000-0x00000001402D5000-memory.dmp

                Filesize

                2.8MB

              • memory/1144-106-0x0000000140000000-0x0000000140237000-memory.dmp

                Filesize

                2.2MB

              • memory/1144-108-0x0000000000DA0000-0x0000000000E00000-memory.dmp

                Filesize

                384KB

              • memory/1144-100-0x0000000000DA0000-0x0000000000E00000-memory.dmp

                Filesize

                384KB

              • memory/1144-171-0x0000000140000000-0x0000000140237000-memory.dmp

                Filesize

                2.2MB

              • memory/1412-302-0x0000000140000000-0x00000001402B9000-memory.dmp

                Filesize

                2.7MB

              • memory/1412-245-0x0000000140000000-0x00000001402B9000-memory.dmp

                Filesize

                2.7MB

              • memory/1512-188-0x0000000140000000-0x0000000140288000-memory.dmp

                Filesize

                2.5MB

              • memory/1612-241-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/1612-299-0x0000000140000000-0x0000000140216000-memory.dmp

                Filesize

                2.1MB

              • memory/1644-237-0x0000000140000000-0x00000001401FC000-memory.dmp

                Filesize

                2.0MB

              • memory/1644-296-0x0000000140000000-0x00000001401FC000-memory.dmp

                Filesize

                2.0MB

              • memory/1748-234-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/1748-288-0x0000000140000000-0x0000000140147000-memory.dmp

                Filesize

                1.3MB

              • memory/2116-17-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/2116-11-0x0000000000510000-0x0000000000570000-memory.dmp

                Filesize

                384KB

              • memory/2116-18-0x0000000000510000-0x0000000000570000-memory.dmp

                Filesize

                384KB

              • memory/2116-104-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/2372-220-0x0000000140000000-0x000000014029E000-memory.dmp

                Filesize

                2.6MB

              • memory/2372-173-0x0000000000BC0000-0x0000000000C20000-memory.dmp

                Filesize

                384KB

              • memory/2372-163-0x0000000140000000-0x000000014029E000-memory.dmp

                Filesize

                2.6MB

              • memory/2420-143-0x0000000140000000-0x00000001402AC000-memory.dmp

                Filesize

                2.7MB

              • memory/2536-244-0x0000000140000000-0x0000000140289000-memory.dmp

                Filesize

                2.5MB

              • memory/2536-195-0x0000000140000000-0x0000000140289000-memory.dmp

                Filesize

                2.5MB

              • memory/2624-21-0x0000000140000000-0x000000014029D000-memory.dmp

                Filesize

                2.6MB

              • memory/2624-110-0x0000000140000000-0x000000014029D000-memory.dmp

                Filesize

                2.6MB

              • memory/2764-200-0x0000000140000000-0x0000000140169000-memory.dmp

                Filesize

                1.4MB

              • memory/2764-208-0x0000000000680000-0x00000000006E0000-memory.dmp

                Filesize

                384KB

              • memory/2764-247-0x0000000140000000-0x0000000140169000-memory.dmp

                Filesize

                1.4MB

              • memory/2812-95-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/2812-90-0x0000022BEE8E0000-0x0000022BEE940000-memory.dmp

                Filesize

                384KB

              • memory/2812-91-0x0000022BEE8E0000-0x0000022BEE940000-memory.dmp

                Filesize

                384KB

              • memory/2812-156-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/3336-140-0x0000000140000000-0x00000001402BD000-memory.dmp

                Filesize

                2.7MB

              • memory/3336-126-0x0000000002690000-0x00000000026F0000-memory.dmp

                Filesize

                384KB

              • memory/3336-127-0x0000000140000000-0x00000001402BD000-memory.dmp

                Filesize

                2.7MB

              • memory/3336-137-0x0000000002690000-0x00000000026F0000-memory.dmp

                Filesize

                384KB

              • memory/3336-133-0x0000000002690000-0x00000000026F0000-memory.dmp

                Filesize

                384KB

              • memory/4148-228-0x0000000000400000-0x000000000068A000-memory.dmp

                Filesize

                2.5MB

              • memory/4148-233-0x0000000000800000-0x0000000000866000-memory.dmp

                Filesize

                408KB

              • memory/4148-176-0x0000000000400000-0x000000000068A000-memory.dmp

                Filesize

                2.5MB

              • memory/4148-183-0x0000000000800000-0x0000000000866000-memory.dmp

                Filesize

                408KB

              • memory/4280-212-0x0000000140000000-0x00000001402F5000-memory.dmp

                Filesize

                3.0MB

              • memory/4280-251-0x0000000140000000-0x00000001402F5000-memory.dmp

                Filesize

                3.0MB

              • memory/4280-222-0x00000000008F0000-0x0000000000950000-memory.dmp

                Filesize

                384KB

              • memory/4352-240-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4352-191-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4352-268-0x0000000140000000-0x00000001401D7000-memory.dmp

                Filesize

                1.8MB

              • memory/4500-28-0x0000018767800000-0x0000018767860000-memory.dmp

                Filesize

                384KB

              • memory/4500-455-0x000001876A3E0000-0x000001876A420000-memory.dmp

                Filesize

                256KB

              • memory/4500-29-0x0000018767800000-0x0000018767860000-memory.dmp

                Filesize

                384KB

              • memory/4500-27-0x00007FFCC1F00000-0x00007FFCC1F01000-memory.dmp

                Filesize

                4KB

              • memory/4500-459-0x000001876A7B0000-0x000001876A7F0000-memory.dmp

                Filesize

                256KB

              • memory/4500-31-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/4500-26-0x00007FFCC3D10000-0x00007FFCC3D11000-memory.dmp

                Filesize

                4KB

              • memory/4500-456-0x000001876A420000-0x000001876A460000-memory.dmp

                Filesize

                256KB

              • memory/4500-117-0x0000000140000000-0x0000000140F04000-memory.dmp

                Filesize

                15.0MB

              • memory/4500-454-0x000001876A3A0000-0x000001876A3E0000-memory.dmp

                Filesize

                256KB

              • memory/4892-160-0x0000000000740000-0x00000000007A0000-memory.dmp

                Filesize

                384KB

              • memory/4892-207-0x0000000140000000-0x00000001402C2000-memory.dmp

                Filesize

                2.8MB

              • memory/4892-159-0x0000000140000000-0x00000001402C2000-memory.dmp

                Filesize

                2.8MB

              • memory/4892-147-0x0000000000740000-0x00000000007A0000-memory.dmp

                Filesize

                384KB