Overview

overview

7

Static

static

3

2024-04-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 23:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-04-07_f279e7c3ffe12fa05f9d2272af342f15_ryuk.exe
  • Size 6.0MB
  • Sample240407-3mv2qsab64
  • SHA256 b7e245fc19d71a5970363fde2bd8c7cc68444e8315b60b8816ddcc8559ec7fd2
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 28 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-07_f279e7c3ffe12fa05f9d2272af342f15_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-07_f279e7c3ffe12fa05f9d2272af342f15_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\2024-04-07_f279e7c3ffe12fa05f9d2272af342f15_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-04-07_f279e7c3ffe12fa05f9d2272af342f15_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x280,0x284,0x288,0x278,0x28c,0x14052e7f4,0x14052e800,0x14052e810
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3556
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4028
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2064
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1196
  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:2812
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2328
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1640
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4524
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3152
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1920
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:540
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4944
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3380
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:840
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4804
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4368
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4376
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3796
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1524
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4460
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2840
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2220
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2548
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3200
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:764

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 9421a4bc5ce79af19cd0599977e75c4b4f292522f47359aa7ad9e5814d23e12c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 1f8166fde9c5847676a15315abe905a9f0846e58dc2d12212c9ab9111a03a7cc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 603b069a4d4ed0e2df4df405b36da98141c1943b3ad1b02ce2bd7dbc895e58d3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 5c76e96eba4d351a5687b43a9d119a0fff8f20c83e803be88e2d189bd2d33b48
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 5bcf8429c1967ff4a6368681dcd39cf5b758e3e4cc4f50c176eef953a942a308
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 e122ad786c4edc3061150897d80e0911c32f808ce72101075efdf02d76e783d0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 00cb2bc8d3081a0c81e59e935d59e9ac5eaf0e88031de29c1f21c3cba6583193
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 c6074edc004632ab226099e9d6a0a7ccd8c0b16e98512efa6920a7e4b1223a41
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 95995ea5991d6bcb838b3fc57469f6d76d96270176d041310783e9f2a88845e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 fb311f65643bac4ac61aea741751404ab2b1972d25561684eb0bd9a6b923a3c4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 6194f4309396253fee30c7e22e306fe03a0118fb2867ae717544344b72b8fbdd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 adf8096e186c9ff81cefe292d70e129cbff278d40900782e3686526cbe0e2059
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 7e3fe5b49598e10bbfc74fe153864ee13130c31b6eff6d99a5b3ba75b887ec8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 06ce2c628bd7102dd56ea3c7ac17f1c49f169ea45fba28d0f9b528b73ab78fdb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
            • Size 4.8MB
            • SHA256 551e1a74095908e2dc02eac7c0158e45483ad3a15717e6b33f3bf30a534977af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
            • Size 4.8MB
            • SHA256 1d11216d39a5c7781ff58d07d515ee20511eb7e0906087bf7eed67314256ee4f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
            • Size 2.2MB
            • SHA256 e587a99897904b40c95e43079de7ae6a4e45470b295ad1564694eb4d53d19beb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
            • Size 2.1MB
            • SHA256 28931c2c4ca4a06e92a370917fb4cbe6943ddd347ba9eb4da9460b3cd71121bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
            • Size 1.8MB
            • SHA256 1b21ff542e2f9462088c6a1cc4cd56b748593a5b200b73ff3691b5d5c922226f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.5MB
            • SHA256 1a6bbdd367aa15569c9eed7b9744ba2dcbdce023459b602d8eaf697322d96672
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 8b8a80373da63a4185b4e80ef70ad02249cee149d8e30f50dc3074811900b892
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 2316c21b34694f9a71a599d45be229a4a6eba3c7ed68ad60cdf327378df256d1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 c626673be1ba70b1c2ed1a2a8b58e6c34436719927c4415f911aefc81e8b07cd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 81f04cb1069a3d888cec02382845557d048f53a8b4a1641c8ccff7b424821fd1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 4c62375ba061e398bf598912deaab6b4893d011f98b2234af2793fa559c74070
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 cf34b710417b924466754fb3443ce301706fd50dcae8e4a177d4c2887f2e4d31
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 b5b5fec7be9552d31f8d9a18a356f9a39561ae0158dd643b1d797800d84b6ce3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 7a0cbb70aa19503fae5c12b0455f5fdec597b7f5d38468c33070b24767d3a689
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 575f4593067766f821bf2a247e86789c75390a9cc1c20aed53b5861539d287ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 bbd65f73f48837db17cf4d92cd3312dcd9d9fcfb69eb04b7d9645645953d1458
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 e0ea8ef558b2b013cdd93f3ac712986a0bac8718cf5d081cf4812c18a21f9e8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 ff36ed60f5bc8accba97db6178bf517d3955a3ba9bb20d95e7206b984ee92529
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 97a13d05ceb3603ec81e5dbd214384fd5f7ce549811d4796f26cebacf6734487
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 537585760612cd384b931b76c42f7337b3eafe4293aeab9e864895cf26d31721
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 2567cddfc7c2cbad1f60ab470e9ce1e08706246f0c35d6b5a0fed21167284e2c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.6MB
            • SHA256 c8ebd41cad2c4eed673ac0576e4d135b553f47baecdd1b64afebbc07df00c6ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 1.2MB
            • SHA256 ea475e86a19f6ff95f20ce8204fb7133169384deaa6cbe44ecb3c38a6c79948f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jconsole.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
            • Size 1.2MB
            • SHA256 3f297c7dfc6279658521ab1a49a97f80de75242f7154d096ae4c952b7c5fd614
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jdb.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
            • Size 1.2MB
            • SHA256 72ef77eca870ad63cb6324df05571bc5e9dc31ce6e90c13d0e1812bc301b66e3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jdeps.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
            • Size 1.2MB
            • SHA256 be0420319696a799159b15099c2c5b6d2609e5b0f5548594e743b0ea349c7543
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 c9108a836304550092a72965f525daeacecc00f979750abe5ad71ebfc8c1acb6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            c7baade9822cf6b9.bin
            • Path C:\Users\Admin\AppData\Roaming\c7baade9822cf6b9.bin
            • Size 12KB
            • SHA256 46bf10d29d5c42d24e4847d78328ee334f86e333a37eccc57daa328118924f52
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 fa1822e881f29a71e41067ae29e357cdc34c4de9bfffd2bd8332070b93eea5c4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 251b0292dba1db5a5932103a97fbf047d8d45aa2a99074c991e33fee1cf7eb74
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 dcc500d0812601f47a95c353ddd2b4563a0cba07eb027257d1ff0e70308dc046
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 0050d848c88d31a880e44899179f93d6e3042db2d72d037d2a8c7a1933f092c6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 2b1379d7dcc3e80bf26ee3e6573b47f8482a172eb78c82fca0e653e71c10c25c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 82c97f0bfd8648711472e5fd23364c4506712a6d665a3509b51cd7bf5167d5da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 17e0efa81e7fd46fb93918013c036cb67b2e9efabcde9ce4ee621ce3e9229238
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 3e69e4baf95e3d64f26b1697feb4e89df4b240ca3682851fa3bf82dd7c24f3b2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 c47b7708f5e0545042667df23e1a7939975cab4be5f7b64e49b4aedf41ff1087
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 2ad8bce7f3df9a466a67c92b6899be94064bb0560e1436d9bc7a57e3eb83d903
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 29bc4398fdf360ef5595e938de8625d9df03aeddd9afcc043cb0a9742c044fed
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 8b01497f4f6c871276356ff8271e22e7ca0d18431ae3c725b708beed67d67adc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 8ca3cdc437a4793c9c61a133ca8ddaf41bd22f9435e406eb92214f08ec380df4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 4c96294f60aa1a6d14b9550f6cb179c7edeca0e5c210ff7fc75021806399d666
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 db21262ea46d19a1c7f1bc6549dd7cebd624be2c71085c3294ec73e0f6c835d4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 c7356910d2ef44e584d959e94dd93d502be938d200fa1866779d5ccc2310f369
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 b26ee645d8b4b9d7ad5a2f93c7c5bae78edcc23e2b7e4b89bd21b3e27f96dc87
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 728d4d4269375bac9973586ba39f90b23093c338be9c936221be110727b9f810
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 090883031bf1813919be66aaddb9f14df6e3f936f6e18efb49bfb8a9678de633
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            office2016setup.exe
            • Path C:\odt\office2016setup.exe
            • Size 5.6MB
            • SHA256 a5246d26167f00c257cd101f6a94b2d9ca374949e632026ae40a8c4fa02f273b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/540-371-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/540-318-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/540-310-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/840-352-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/840-344-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/840-411-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1196-50-0x0000000140000000-0x0000000140237000-memory.dmp
            Download

            memory/1196-49-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/1196-268-0x0000000140000000-0x0000000140237000-memory.dmp
            Download

            memory/1196-66-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/1524-400-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/1524-408-0x0000000000880000-0x00000000008E0000-memory.dmp
            Download

            memory/1640-100-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/1640-98-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/1640-272-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/1640-108-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/1764-443-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1764-452-0x0000000000760000-0x00000000007C0000-memory.dmp
            Download

            memory/1920-301-0x0000000000D40000-0x0000000000DA0000-memory.dmp
            Download

            memory/1920-293-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/1920-359-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/2064-43-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/2064-106-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/2064-58-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/2064-46-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/2220-456-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2220-465-0x0000000000860000-0x00000000008C0000-memory.dmp
            Download

            memory/2328-82-0x0000000140000000-0x0000000140209000-memory.dmp
            Download

            memory/2328-88-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2328-96-0x0000000140000000-0x0000000140209000-memory.dmp
            Download

            memory/2328-93-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2328-81-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2812-71-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2812-269-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2812-77-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2812-70-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2840-439-0x0000000000C30000-0x0000000000C90000-memory.dmp
            Download

            memory/2840-429-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3152-291-0x0000000000540000-0x00000000005A0000-memory.dmp
            Download

            memory/3152-290-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3152-284-0x0000000000540000-0x00000000005A0000-memory.dmp
            Download

            memory/3152-276-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3380-397-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/3380-406-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/3380-333-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/3380-340-0x0000000000580000-0x00000000005E0000-memory.dmp
            Download

            memory/3556-30-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3556-90-0x0000000140000000-0x0000000140610000-memory.dmp
            Download

            memory/3556-15-0x0000000140000000-0x0000000140610000-memory.dmp
            Download

            memory/3556-14-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3624-0-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/3624-38-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/3624-62-0x0000000140000000-0x0000000140610000-memory.dmp
            Download

            memory/3624-8-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/3624-2-0x0000000140000000-0x0000000140610000-memory.dmp
            Download

            memory/4028-28-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4028-91-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/4028-18-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/4028-13-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4028-27-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4368-379-0x00000000007F0000-0x0000000000850000-memory.dmp
            Download

            memory/4368-374-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4368-442-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4376-394-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/4376-386-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/4376-455-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/4460-425-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4460-413-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4460-421-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/4460-426-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/4804-361-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/4804-365-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4804-428-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/4804-438-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4944-384-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/4944-329-0x0000000000880000-0x00000000008E7000-memory.dmp
            Download

            memory/4944-321-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download