Overview

overview

7

Static

static

3

2024-06-03...uk.exe

windows7-x64

7

2024-06-03...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_cf5db16637f6c75be8a20ab5920f4df3_ryuk.exe
  • Size 1.6MB
  • Sample240603-mpqa9sbf3t
  • SHA256 e721a1703321ce0c53817eeea8a7cb9829233403bbab12585ce7a1ea77e662ea
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_cf5db16637f6c75be8a20ab5920f4df3_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_cf5db16637f6c75be8a20ab5920f4df3_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:380
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1824
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1204
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4796
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2536
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1852
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5000
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3028
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:5012
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2752
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1216
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:1300
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4864
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4988
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4088
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4228
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1288
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:952
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1864
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2696
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2208
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2856
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1568
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3156
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2984

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 015a073ef7b440d694a2486d32d2f486998b3774512e499b940625fb245602ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 79d7dbdfdcf22af9f3e800d0bd813702016b08a2e4291a9911a9b346d40dba2a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 c3c4e7f1829b99d25aad707b930b394416c9658c4386d429ece142799d08064e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 439ea3c677ad09bc991ba83d90fa7e1534f225642bc3e5ea6e6a52798088db1a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 7d4045ac80b420ae83388d104072ef365e5ed973950b13d363cdcc26ce42d6c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 1f27262c38d93b128b413740ef7a126932bdca1c2328a19c267a6384141ecd52
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 0e3bfb1b4897bffe6c0b9381f15132d75def65ea5e7f75f68770da049e0fde61
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 3e5053eb1af6439939b4e3a31f61110c18ac96887a60e5bb5579e8b1a3e66323
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 cfe6043a0dab791df9e927c952895c00b7086ae1517e49ca071ca93f8c5a0c14
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 a19970f63ae401853fa81f0959cd65a1529f4aff701970b1583510d105e75934
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 ac97f0ada803a7ab1de10091db7781962a8125509e27937f2098788cc38a9baa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 76a0e9da3b05cf639db82795d94ae0bf572049aa632dbbd51a60965309d53e1f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 e252a2fa1e7ae885180ef643856e0f92a09c8c451dfd847452bbc13fd437e60b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 bbb225f6544463fbb764b1bb9b41e8d9bb517333ab61408fb79c603a12b7c215
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 6f6db2471be7eedcbbc67d3cb6790194f9210a2f1752679a5f1778fbe0b09879
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 5586699e9f75929b60c3a25d94c36f9a2ae7292996c9a89d960bfeef099e425c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 3942ccfbe09a978b71a125c881a5eb33fcd9800080ab29264f97b86da235fa31
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 b29e767dcccb55a58813a248c9811cff1e3584d9e5c640504d7895969a34c0b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 e3bd641595744ded4724ff32f40bf152fb9d60d371650cbfd5782a6c285738a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 3961b5eadbfa0431ae55bf365837f5a75680320ea77394190023427d3afdf5e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 c6634842a3e53501a7275df0f677fa3fc379f6bb30c7bed1e8d58c45adf7d746
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 54d81f075a249b324be34042a1180cc21a9344d3c4d96a46c156bf50dc7fa21e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 d84232cc3b193a74aad9f2a20d5c794acd1f89c8be94802b850bf4fd9b33f5b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 52e0cf01ed8583eab69a08eb3503a52c8b4028fec95d3436f6b48f83976fe0e7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 b861d21f8ca8f9a9b953a2092325ec7cf65903f037b5ed23959180cf5beef2ec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 4be0aafed86c45d801e6e5f3039cc832bdb5a2b194ba11c77de98ca4df12e574
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 8a324e803d5d37a2740a0b8ee90b541c41135e9a609313d8dbd7fdb98b6d84ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 6e2702787fd9189fa2340ab0f6b2ae5aab6617ce09adfed40b13734531438389
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 f16e313c13a20ff428797af7cb48dfa1d3e72372949487e13debecfe1de0d433
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 b91cf9bb42440d09ad4c2e3bbd362fd6f99df47afafc6791528e48615c9bfaec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 77ca4956382e528492d6f55d12aa5717acb4d5227ed3d26d3ad027ccb9031d06
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 3e67cbeb60c4b9ec5f7b56753fd8c2a3f4b473f313c8a497c57d71e010bc69c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 94cab75ea6182e01692e70f6170c278a975e6693e83a13ad68ad0ea7195731e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 65241e9ace335d606f1165fdae18800d054fe84a63daaef7ce79cee8f882726e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 0fc9b31f7adfce47c13815756d76a1b239b9e6ad6da97a63421141ca4815878e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 69a43633d4f81d42a7452656a39460f35330a9b62ce94f933a50b68c9173b300
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 f549b16cdfef56ba3535921e7c1c81f541e68a65a36bbae5e642cef394000c33
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 4dd6c1fb3c038d3895a63787ebc686eab53566df38f88a7f926e1a0e9d850c34
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 1113b29b47a7043e55391ce46f3e07b516f64c7978c5154acd1b104333b9072e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 81cebfb73cf44c2bbd625db33dd75977f6743cd8abd8631b0425b3f130c108c6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 1b61563b317d09d5857d08bc9da1e10327c979fbb2a6e1d20c4380b722307bc8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 4d25137c0961e44c332153c8519db7dd3ea0e7a18ef4ba36ebd3aa7c893e4b20
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 357ca92fa04cafbcd477266857d846975ad40c4e27310ff36bf415ec66c0ec9d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 f0dd1b9a1636e03be85c692040dd7dce54149c6cfe257f2d065be9c174c1e884
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 dc7fe5ae70f0d02981745d3633282996f812b134f78161584f4dd5bb7ebb2018
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 e3642d55c02c0f7d980184317aca6cd38b58a4f70dc350a84b95ea72430cb069
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 ea007c4f55390956bea49fd1f7394185985a16226eea248324e5f6d75b4901f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 9ae547e8668efbe5faf306a1b277bf9f44ae1dd2c17fd911d2573e63e5d16967
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 1063c8bd8bf276867ccdb6f38d8527909f42dcbdc8a780b8f939de2ba2cacbdd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 0842f45a044654dc3d8124534dc35f366e858c2ac2789ffe1a96de145f375d27
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 095bfe889cd01818b3e70b8fa48ad7fd0e526d793bbb3ba0f913442468142713
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 c549e4dd13d72f6c53d7ef621abce6f866346a489458b658147d49973837632e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 8f15f5ed6542e9f4a4fb249610543585940403e8ef3113d146a36306b2dac384
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 e8835df0bc00619dd3fca7bc9976e562d94827d594aef4c578101fda4a1342bc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 4c0b8444c5ac7b2ce625ece8049ef96eb6ec4e7b1fdcaa29cb4b27fdd6f0420b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 a9bf625fb0d4c6f13b81159c61fc8a7433ffe2826003ef1b4d31d9f14d73d964
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 b71948557fdff0bbf72dd9be4b1db55f331a2e6f6bc77eab3545a2af6d487b3e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 abf1a3561048276effe7759c4ab4b7e6818069b9c12dc1cb9131806a6c4f95fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/380-8-0x0000000140000000-0x000000014019F000-memory.dmp
            Download

            memory/380-9-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/380-0-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/380-115-0x0000000140000000-0x000000014019F000-memory.dmp
            Download

            memory/532-281-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/532-541-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1204-35-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/1204-34-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/1204-26-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/1216-124-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/1216-243-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/1288-194-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1288-528-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1300-128-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1300-247-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1568-260-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1568-540-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1824-127-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/1824-14-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/1824-21-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/1824-13-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/1852-59-0x0000000000D80000-0x0000000000DE0000-memory.dmp
            Download

            memory/1852-180-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/1852-53-0x0000000000D80000-0x0000000000DE0000-memory.dmp
            Download

            memory/1852-52-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/1864-532-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/1864-206-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/2208-244-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2208-536-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2536-39-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/2536-50-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2536-47-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/2536-45-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/2536-38-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2696-233-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2696-533-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2752-232-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2752-101-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2856-539-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2856-248-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3028-85-0x00000000026B0000-0x0000000002710000-memory.dmp
            Download

            memory/3028-87-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3028-81-0x00000000026B0000-0x0000000002710000-memory.dmp
            Download

            memory/3028-75-0x00000000026B0000-0x0000000002710000-memory.dmp
            Download

            memory/3028-74-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4088-474-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/4088-161-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/4228-181-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4228-495-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4864-259-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/4864-146-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/4932-221-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4932-218-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4988-272-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4988-157-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4988-531-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/5000-193-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5000-63-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/5000-71-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5000-69-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/5012-90-0x0000000000D50000-0x0000000000DB0000-memory.dmp
            Download

            memory/5012-217-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/5012-89-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download