Overview

overview

7

Static

static

3

d69c05be44...13.exe

windows7-x64

7

d69c05be44...13.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d69c05be440c178fc8a25bdd17772a0e310e90fb26dd5528ef591774c2f46513.exe
  • Size 1.8MB
  • Sample240531-e6cshagb76
  • SHA256 d69c05be440c178fc8a25bdd17772a0e310e90fb26dd5528ef591774c2f46513
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d69c05be440c178fc8a25bdd17772a0e310e90fb26dd5528ef591774c2f46513.exe
    "C:\Users\Admin\AppData\Local\Temp\d69c05be440c178fc8a25bdd17772a0e310e90fb26dd5528ef591774c2f46513.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3860
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1920
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2716
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4484
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4412
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5092
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2720
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3584
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4520
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2500
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4596
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3772
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4340
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1544
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:1988
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4360
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1916
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4624
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2084
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4632
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4268
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1236
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2688

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 8a9e21af4ac897d94925bd24091c2859f395aa5f6277bb0dbeca661d86aed8e4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 32968173190b6e12610f8e02e7f845a6095336bcfa236abcfa555afb3972dccd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 e8d51b67185932da523d19f43e62347a18d6bb96b6d336131ec36829fe5bd68b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 8969c262e011b84ac6a4eb82b4ea8a68c79ed87ab61f9c85a9e2c0741cd2ddf6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 ad227e3c97a542f2f35bac265f3689e5d824c34bd1338184079f209a4e16b120
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 7fd10facd72e37218b68f19f7dfabb0cc32dd43de6fea4387adda7b8e5be0481
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 952d3857864e97cc2ab486d09f83879a6682f27223847e4948ad677514dff3ba
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 66a2f4255434a583509ac4809fcdc74dd7a1d654e7bd8ad23a1b4c0b95e67c60
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 e36c1ff8f6d154953217221483bf9c44610a5a40369331de5384835b12438fd1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 64b56ec6db0de1a0fd2a1164c25886e6ac895341ec28c97ab2a56228fc6ab7c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 1b1b03a310a95a3ad4b7bfff2f28f6836466fdbaf1a83f568179980fc88e326a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 745ccdd2f5b1df7f0dda54071ba1ef9d169970937c515e694f63746dd5e85bc9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 88e4832dbd1e9b20d985b25d6edc493b586d87b421b98232209da863213fa2d9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 e2a5c08da8f13fa4ebdebc7ca14b7af3c7bacb4903d232ef1e7da2170b396525
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 8e4ffa0d01e18cef6bf7e64799d721113c92fa0fb2d02cace1d7084c761eff51
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 abde117cef64df234c72be908545f2ded9c044d482fc4904b0771f60f8c8a0b1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 45b3fec4b53539c3e5324e56ae4a54a96e6ba67e36d8c11c28d7898c410f741f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 0a426c261ad9a4224fc9f186f278d63574626c175777d15bdaf710b84c95de12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 2079f50001ec13d019d724baca894e8a1a97f1f5a5007fffd80e00f40e01a336
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 659c1e9eb68723efc1f2cb477891843f2bd9c8f51ba5ceebb15299dc8b7752e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 6f01b3a8db161209dea8051c5ec45316d4307fc6856621958f0ea434eb51c358
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 f5dbbf02fc86f324cbe8c21167b23643d4aa48df1fdfb6ff913141a2dca37291
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 4817d2118b68d9ade40204d4bac38d449cf874f9f4e7fda47ac07bc8397cfff3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 f6f6a02195940a9cb3ed49ae0cfa83d98347d704198adba890a6600e629f23a9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 4822acaed25dedc018e5649d8ae64377843b32cc0b6e3967c1ae010108dd278e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 d2a6f2a5fa289f6ff23257e9580a8fe67ce6df06d17d8f7bd26e9cc0a6fc486d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 f0447a49e304e846268f1a40d4459f8d346eaf13230fd52acdb024a2183a715c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 e7aabc373f4ca29be15bc40a6a50e25adfd94b44473e5bb44c5ab65c6a543eee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 d92653ed9e1e49a9f0b60c6eb8b253a8bbd7a2d7b209b0e7b221ce85aae6cce6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 b0c47266190eb7d4362444633cdde9be135c5801254522aa376fb96604c3d123
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 cac39b46aa20bb67c4e51dbd07f08c1abed10d9bf4748a1d26b283192ae89006
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 2998830b1f6b19b2fa881257421145534f4c883d7ebd6110c33d6372886b0dbc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 4e66f645c753cac339fa232913d2a55d0500bb2d2ea89ccafc363b407c0084b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 458c65eeba6b9d507923a81babfd7c4bbbacdbf9e59a50780db91ec44f551375
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 10a54902e74a076afb2a21a4d246353c3390b7c9361d8d79f30edb8f39c0dac3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 839294b334f437772b98a241d4e1bd16ba1b07daf15a66e2b85a4478adc27f6f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 581KB
            • SHA256 2145ebeb4213608958d03c6c1dfb0b8d6d10e4aecc218a7499ff9e2ab1bfed2e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 710a09dec94f98640fddb1b4e1b5c1cc64657a33416318e0fb058ebe1b63d011
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 b88e01a86a817064f224b698395a0475c5790cb9173c4bf2aa45f2eda367d102
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 47910b96b9b5b6b8550885c75fe07a8787d8115f8d07da1cfcbdf799238a6599
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 039407d1738b0ef36bc942b0172838beaaa7b12eb09ad0e996b9daf610a23923
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 0a325e501cec2454d01b856bca9fa1181d4865976b7fc95c9b8e39fdabe32c83
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 5adf2445a36e2700e4b5cf8d3ff9f379fcc3101e7140762c3c602c70b4b4d5e6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 656fce95829fde72366eb051bb0e3ffa9a26d5ad68bf55dfa424a52f238eb6de
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 a4bb097953b09a44f239ad5881ab093b22d895d012beb306367e39da3162f1fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 fc1709f3d9f4dd9248acbb73bcd2b583686285c23ac72f5951876e698ff46905
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 bbf37efa76f7f7cd95c7833e3f0b7035cc7858a3f91b6958523de4e4192a6739
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 8724f51d2ac246f0569cb5f6dc67bfac9756de405b054d767f370902befbcc40
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 3d4f92f4ad77b0b2121c1a437447c82b37e95fdcb2e5ae59c7c9eaad9eee365d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 6d9730af66cd1eecbce620f3c9785564adf329e9df000b5b4fe329a6bc89e435
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 f3b2c1dd05a20c78625c3a95a51cdbfea4a837acb96b4155b40a35d74098898b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 0fdb4efd12661cb4442f24cb5d35746c29affaf14bb9d96d266f8bcd5302854c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 02c51e3123e708df2155f07bcff8cb414faf77aee26dd5d41f65f0aa15e866ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 04cfaff77bf37356fcebde4c38a4e693f0d3c808715799f2f2775fb471c24359
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 aee83a9a74561ab1e20af9895a753fab22437b665f04f7c341e99b3e6d265525
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 decf03f8ec6a1644192db306823122ade0e518dc6a6565b6f7a90b1e8cd69f99
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 43883da35f641128de4bbcd789fdb97b47595a29d74234a2c438e28d9fd4f85b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 77f2e00cc539afb186fbd5c3310beff8eed8bae34e875621a613a4349c4f436f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 812a2c57df98ba8eff7c9ae280ad4092bc2a3575a8a06f4a6483ef61c1dfb524
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 e22433c183b17481638deff24c9e5ad6164cebff6db796f1027c4171d0fb88da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1544-290-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1544-647-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1744-341-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1744-739-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1916-293-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1920-340-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/1920-12-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/1920-13-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/1920-19-0x00000000006D0000-0x0000000000730000-memory.dmp
            Download

            memory/1988-291-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/2084-274-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2500-286-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2580-344-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2580-741-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2716-82-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/2716-651-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/2716-92-0x0000000000680000-0x00000000006E0000-memory.dmp
            Download

            memory/2716-79-0x0000000000680000-0x00000000006E0000-memory.dmp
            Download

            memory/2720-137-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2720-671-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2720-131-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2720-141-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/3032-342-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3584-143-0x0000000000D10000-0x0000000000D70000-memory.dmp
            Download

            memory/3584-150-0x0000000000D10000-0x0000000000D70000-memory.dmp
            Download

            memory/3584-151-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3584-154-0x0000000000D10000-0x0000000000D70000-memory.dmp
            Download

            memory/3584-156-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3772-288-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/3860-0-0x0000000000980000-0x00000000009E6000-memory.dmp
            Download

            memory/3860-139-0x0000000000400000-0x00000000005DB000-memory.dmp
            Download

            memory/3860-5-0x0000000000400000-0x00000000005DB000-memory.dmp
            Download

            memory/3860-525-0x0000000000400000-0x00000000005DB000-memory.dmp
            Download

            memory/3860-8-0x0000000000980000-0x00000000009E6000-memory.dmp
            Download

            memory/4268-740-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4268-343-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4340-289-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/4360-292-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4412-127-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4412-105-0x0000000000830000-0x0000000000890000-memory.dmp
            Download

            memory/4412-128-0x0000000000830000-0x0000000000890000-memory.dmp
            Download

            memory/4412-104-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4412-113-0x0000000000830000-0x0000000000890000-memory.dmp
            Download

            memory/4520-285-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/4520-158-0x0000000000D70000-0x0000000000DD0000-memory.dmp
            Download

            memory/4596-287-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/4632-738-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4632-295-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4964-294-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/5092-117-0x0000000000440000-0x00000000004A0000-memory.dmp
            Download

            memory/5092-668-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/5092-123-0x0000000000440000-0x00000000004A0000-memory.dmp
            Download

            memory/5092-116-0x0000000140000000-0x000000014024B000-memory.dmp
            Download