Overview

overview

7

Static

static

3

a333d8a1cb...cs.exe

windows7-x64

7

a333d8a1cb...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a333d8a1cb9b1e345a893e44e8faabd0_NeikiAnalytics.exe
  • Size 592KB
  • Sample240603-pgjvmaeb5v
  • SHA256 1e124f7588e36fade2a708dda691f7405f28063a9975db50410053d0a756eb10
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a333d8a1cb9b1e345a893e44e8faabd0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a333d8a1cb9b1e345a893e44e8faabd0_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1624
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4520
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:864
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4248
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:992
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4364
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4944
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3784
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2376
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2796
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1888
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:668
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:464
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1584
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2420
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1244
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:404
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3416
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2372
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4484
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:220
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3016
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1568
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4276
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:3640

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 de4dd1fe0a3b77875a958007ee00e3f974e17c29006250cb61967e4759b119fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 b9c413e85a0b0834bb0cc52e4d81411d41f0a69cb2d4db5f8134baf582b00125
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 374db1d7dd8e2aa648345f6f54cab333fc7e9fdb9d405ecc2beb02715be23e24
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 feb8fce1cadb4ad231161302d6c1662c5a8c648c09c2f38fe5889abed1fa6ea9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 d89eb0b3a08032c805ea97f9e9492099fc9316a0f4ec6b510a9f8756fd809be9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 a7ae1b9218f973d7a4c4c18c1c5d1ab26ccce52afce1af1b529dbadc542a6ddd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 56227b761a69e6cf80ac65389aa99d2a1856745a547958999d4e1bd36410280b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 23069fa8d97be810a3e7580d274987036ad030136e8a3b7bb4d28418849c92a6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 46a9b988751cd77d627c8752e1d3fc04ce9ce4a21a993f53705e0e191317d463
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 a090ac07654d55175373324797d1862d0fcbd5479813707825ee1cf1b9e5d932
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 cef2d0ef0ab6868d118b8b9777db1f51d8d64abffcb33c4c3a497ef28708e198
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 45c05b1843d2dc8f68d083bc495f7407a9393581027eabf7f32f8b4ad3099691
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 50f3989c938a9e6758aef0b88ef98ff550b0df82e7a27063781f0f38865ffc91
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 da38f6a49586f523cbe46f6f70916e3fec5a0e42f6ba60b47e7c5374dc1ce077
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 c41cdb0c79309ee6b1f2f686341935006e627c71da932569b1bdd0da9bba1cfd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 597b7a759beb45cbfa761b4d00e0d858737f8c332fd391e760fefeb82825c9d9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 3060bb8605836a0d8c110158db1c0c5200d78386876b47c604010e9accf5881e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 ae0fdae3a5502d17d1206d5c7aceecee98c9066d0559c0c1e715a0644b256cec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 7e399518277ec6c06c67a7368802dbd9f1c0e908532dc5740ba684d566bc6c4d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 1468221898341907fa1475cfef1c11c49c10d5c3bd6f45740cda44657fb72234
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 273ff26a343551ecf4756c52936e3ad2df626be02c54f9ab94d7a9246a16dd0c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 aeafe69ec9aa82600cb61cf4ea97c5d05126140cd7dae79db1675a724cb4ffa2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 bd719a682a87dfa065cd0c3d23ac1a17ee38f82c50cca073b67a147a94eb728c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 a2c292cc00485a747d03f55636ed6b22834eab166de9d99651be141594ea53c0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 8ff8466c32a1d317c6d10a0afdb5996948fa6a2b1328c306e37869a9d5e1b0ef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 31683770ccc4ade9a9f44a1efbab5e2a308a14dc05d9bd1b63c1b0b559cae176
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 d02b02c4e246f71b4393fd5a06163b2682aad7cb75fc49e9ad69c75977d1fb84
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 188441ef16f5fa90a2ac09825d42310d37b982f3a3b318d4c2c8dc1f71ad4b78
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 4b6f1b8171ac5a33768b499288e0d15e051b67e41bfc9320c901e2b60bbdd8c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 2e621dd63b3e3e5326d20f33aa36205a0758c1f78e2e6cf9005e2b2df1692450
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 3aac2b6ad3e4febe0593613efc672c286d3c4b3f2f8528661b43adeec84225bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 ea922398c2cf7e25a9f67588867e7d3c9914bcd51838b35aec7ef1da92f4ae83
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 a70f622b3d5c96ed9e9a2ea65fe17b37b7f3501cc257a0a65801d70af853a12c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 a7eb60de25bd9529c10fca36f5eaff87c311f325e51e207c4728a1cfaf291cdb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 aec8aafdfcfb84fad33b557f1195bd7a0b6c8591a9e06d285807fba2e1f5b5ec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 225fa0a18de6098a894f4a6fbe0dfa2849c216d15f6c2dea0f6a13e7dd5bd294
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 581KB
            • SHA256 9aba85df30fbb7336d830db4c07ac9c99556c0b706c321b00c98d518075e3b07
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 c6a1d1e370a865427e944dea8b0a5f5e8483b22d24bd4e473f72a1026437b0d3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 6da96061eb3581ffac1af1db49a0c09a4a3671fe460ce3d0ddd493916f54dd9a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 fd7425b62618a98636975256163abb8a1bc320ed8c3917f86c99cc7b13cd478e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 11c711c092361bb888cc709ffc2783943e52638521815e76b2c7372c9f1cc16b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 0b0d393e359172c9cf111ada6f77df811ba6be443a899bd64ab26903f102c547
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 31de4e163dcc153538fdd221e3d4d39cf16984360e733108a23d0b439cec95ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 0ed4a5e0562a166cabb7aa39f3e45a45f375151928e76a16dcc564d7be4be7f9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 459f13d14a9ca00b0701228af80b8b0fe4bfd602c60015a7d7382b46158f3fbf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 1c1963aa8f903d3ca01454df621de318f32bea579cf5cacface6490a980d2909
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 2ef2ba217f95b2e284c96e6aa697d7c169010f49b2f748192ff58dce06f335e1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 2d9fba3c9c126baa959b29ea275b508192cfa858f4e8f71f98c02bd33af707c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 09223bcd049615568e04bb22be4dc6a3c1a3a66599b6a9a7e61bf3733378f4c5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 d89c84c98d932845f46b08f6a5deb7a59244da288d1341ee26e6458a7dcfc8d9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 c60366ecb4c7e4078a5011ecc3a3eb948741d3a59978f26e5cb884758cfe5246
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 6d25fde2b14d7c6f3cce286d6e202e6163fa7ea30f8745f74f205ae83f32c59e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 dc953159b850eb98848860c564647b663322e52beceb38bacc14f276912bf5f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 8f862539cb954fe8545c34f273750706340d50d1b9420a1200f1d3bcb5a94321
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 e1484d4270a83ad6d0d3a5f00f181bf19832f85cbe80518a4f9a182db24eff35
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 aed1ae79918c3c13c38e5b5dda124389be276f9dd32a5016393af039f85db66b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 5895e92d8cea3bda13d121caf8a6e82a02c7f99569d644ed3f14ecc17deec494
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 c27269b5fed15c68aa7ff638ff7e4a88445d6ae1c2772d5e6a284c7e33bf5551
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 67f17cbd3b4fbf510c6ea8b0596356e83a3664293622f9df424c95c8d026dd02
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 f884f3627a9efb5c290d888828d4c520f45e3aaa806aebce9dcd6d04f623561c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/220-162-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/220-457-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/404-159-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/464-154-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/668-97-0x0000000000760000-0x00000000007C7000-memory.dmp
            Download

            memory/668-153-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/668-92-0x0000000000760000-0x00000000007C7000-memory.dmp
            Download

            memory/864-23-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/864-24-0x0000000000670000-0x00000000006D0000-memory.dmp
            Download

            memory/864-16-0x0000000000670000-0x00000000006D0000-memory.dmp
            Download

            memory/992-41-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/992-28-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1244-158-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1396-135-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1568-458-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1568-165-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1584-155-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1584-447-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1624-357-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1624-1-0x0000000002360000-0x00000000023C7000-memory.dmp
            Download

            memory/1624-0-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1624-6-0x0000000002360000-0x00000000023C7000-memory.dmp
            Download

            memory/1888-152-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/1888-88-0x0000000000B30000-0x0000000000B90000-memory.dmp
            Download

            memory/1888-82-0x0000000000B30000-0x0000000000B90000-memory.dmp
            Download

            memory/1924-166-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1924-459-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2372-160-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/2376-150-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/2420-157-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/2796-72-0x00000000007E0000-0x0000000000840000-memory.dmp
            Download

            memory/2796-151-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2796-78-0x00000000007E0000-0x0000000000840000-memory.dmp
            Download

            memory/3016-163-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3784-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/3784-67-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3784-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/3784-64-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3784-54-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/4364-37-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/4364-31-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/4364-452-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4364-39-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4484-161-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4520-11-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4520-451-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4944-456-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4944-43-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4944-49-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4944-51-0x0000000140000000-0x000000014022B000-memory.dmp
            Download