Overview

overview

7

Static

static

3

a51426e1d7...cs.exe

windows7-x64

7

a51426e1d7...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 13:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a51426e1d72346bd43f0f8dbc5cea8f0_NeikiAnalytics.exe
  • Size 703KB
  • Sample240603-qtte9she52
  • SHA256 ea7b9bb9cdd1b1f3bce74d8f5240174451f1007ebd22b9427c76925d0dfc6256
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a51426e1d72346bd43f0f8dbc5cea8f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a51426e1d72346bd43f0f8dbc5cea8f0_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:928
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2404
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3484
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4332
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4588
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2260
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3568
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:5060
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1188
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3604
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3752
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:884
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4680
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4072
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2556
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3828
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2624
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2336
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1636
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2076
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4416
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3756
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4004
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1728
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:4792

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 4ff03eef6593982537eafdd30540d7c59e71ab4419c85a9fe42f0c7014713282
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 0908f3d89462240ccaa23ddf2a7cb1361fd870e4dc485efbf0e6695d7c87f43e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 6055abdcdab1f4f1857368cd17ff328eddeb1bfd2c132955c8c51f64584e8bd3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 535dc89944e194d273447be520a7a182afc0e8a5018fab0d2021c4327e973ad9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 3ad467d68a751b9d41874d417c19d7a4ce86567e5687f163907e4881ef07e49d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 56b863dc9c04acc613a191690c741e464225c6d794e8c935408f286b3896f7bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 60fb3aad19f88a9e180e48645c01c1b49ebe35fcb259ace9b75b4dec1337ca2e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 f94f4d1c2dff50d61a870c2844c0afdcf753190d082f774164f3b80d2820fdd1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 1447ea79eb347f35ec99a871b35a101f79ef78b9c67fed256715bf8ff015e83c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 94ce2be1bfd825756a38e0329c69d413a98372ad203205965eb18c3272bc628c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 e3c41e78a2058200dab2cdf8b8b97f6a30c0b29517e0cfcc35a340ca2683fc43
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 5a8c01355318b0b2b40a5a8e3db1697d4612d597fff933eba9207c7163e5fff5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 78c93e97ea9afaa86d4725fa796cc7a91eeed069198390d029a5086c04323ea2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 282b778f4e6975875a22b8c2acf0874dbe640b184a040ca7dfb7b17044a0a2ef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 bb599ba6e8d2ae135a1673e4b249bef4087fc48aedd827ebfc44c20980a1d768
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 86666bd87c4d88652d90e7637b65adb2f02c025aadb6aea19635441c56460201
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 4ed73e9fd2ecefc94be60fa4e0e48cfb65b1e31e91d412646a6afdbb2894350f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 f65da9b2b8f24f1e7fa4f21ea9fa4be172fe168ccdd51a7f203f823b9b9d5221
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 4612b111348661ad3d72e5f92a5ea6443434a55a69d95417c0dcbc30e08fa0f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 7984fa5c31a31ddb7a0ee51ca4c553f8aadb8f25ac696abfdf4b8375882ff846
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 f24582c2609e1ab6aa7b3e086bf82d848a8f5449b976d25d82dd9efa6bcde7dd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 db6a6b0fde1d33f44ed78093acaf836c098dbba885f8da93699425e496750f2e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 160e2b217159a88fe2b4b2bc686cb90092ecb5463cf44b6eed1474bfb3223d3d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 169295eb6eadcd38b29b8a8092cb27886587ba1d3468e9f8f033bc6ee842164f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 429fca455e20af47aa6cd4c38a25ccf01f686b8e41d91df5efb5793888ca071d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 b0ea8d2fca1deed63b265c68483516db01c109219c00a712efaaf19516b5f4ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 4fbb5e2709e16b8409b8603cd2dcf5db5eaaaeae815de2ef8c3a051681c92377
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 e74333bf5ad6c85d88c95b082abd40e129e6e2d8044c928d21cd3ae0ac3d50af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 f25c90e542dfe39838042c6bbf9b6d097e9cddb70151c6be44758d8601f83ab2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 120888efd292c0ee9c40776ef67cb0cfda098d207d09af15d41babe231830acf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 6a914eb7b8fbf2cea2c9df8f096cf852407a909ab6cf5b4fbb6e6fa76ba4c89c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 075371e87cc232e7b131c4eace8be9004b2245580dbc91dd7e53b7f87a08d62b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 ba954d6550a4ff32527731942f65dd64f60dd78af2fcfa5fbb3d592d2c18c113
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 08c5a994836166f056cb99e3b3f5b45d8ef48f6f1b777fac78cebbfd09f22a3c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 f44aa593c735a3b65bc0a5e529d846a65da046d89eec26535ba60c1a571800ad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 deea081a1cbbcf27b6992f2cff4ee3dc453d7534d8815450404e8baeaf80bf00
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 581KB
            • SHA256 60d822b27699913f126183d5549d69470b3a09e2c61ae2a1123cff01b27dcc40
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 1cd234ef29bc2f19de2a4325115679c8d24f06bbd71b1f1280e12aed81180f2e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 1c97c446960d4d1712fa62990989d42f4bc56150872c851a08b11b80965d2448
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 c1c52a03eac4700dd32d31f81bfc567e21cfc3610f370237a39aba6cff2a30fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 0648ef74822cfe17d414de5eda9e5f2d7f1b62d37d1db41b27b024872273cbcc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 e511593a4f4234c728f574b1d3e110bde9b5e210abc896324fd6dbe0347ba85c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 548ae28e46a97a982282e6f66a524908a3a14cfa3bba95f1a1e1557211358762
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 08a9ac8cff371187f9499d1217110946787fa07a22d8babd8461e2ab62f74790
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 a6a9c3a4911ecf3315801fd4d9c0288f8ab343147ff615b9e3780c407e549ed2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 25bc1a95083eecf5f17f1a35427ab2fa15bdc0cdd58173bcc6ce009db9987387
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 acec7ee258693f91b1352bea781ec31d69adddc95fea22319038e50f92c585ad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 ad4d1e1cf674a0e5d139f61a5a515a91d03413445b501460e59a33e4799e0134
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 923ce3c8cffccb1e97c2edd4234d592b98819db33965a34c06d5e9a234c4cd18
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 6894c94794db6459663f673e867924c627fb6c9d8ebfb5638a62e81d7e6179eb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 2d8f73d9577d8627431e824c1688b1ea605df59dc8c3b4ba872f1db00197e5c8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 7b0fb7f1e51a4fa6ccbc53c0b42a31fb3c3d816e4d178f0bac520e645d9b3c57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 f41695675aa011a4410b88162a43086fe763470cfe12263d4a0c60ed612a623f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 fe84063cac6231ef1d03cdd258a310254781f8900f231ee00195f937eca70405
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 73b5dff1e5d15be3d43cf876ffa109a8fea36513bd1f4b789160cd7fa77d9105
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 f0c42ecdc2e87aa86daf49d1f4ccccad8765c550001d8323ab4adf90b02f3bd1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 3151e6824c01cf710d4f464239dcdbedd3e2523b85139cc147a2b61c92bcc1da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 7e6579a91fcaba2001c30a65cce33a28b43d21e5f4989ac1ffd0b429f910c678
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 c94643481398ebb3fb8f74be08fcc48912d4c869d51582cb9848bdda41eaff31
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 9aa1f46af110f8ba354a45c1c60dcbee0406c4e050da8afd97edfd9a94c2784d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/884-202-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/928-460-0x0000000030000000-0x00000000300B3000-memory.dmp
            Download

            memory/928-75-0x0000000030000000-0x00000000300B3000-memory.dmp
            Download

            memory/928-1-0x0000000000870000-0x00000000008D7000-memory.dmp
            Download

            memory/928-6-0x0000000000870000-0x00000000008D7000-memory.dmp
            Download

            memory/928-0-0x0000000030000000-0x00000000300B3000-memory.dmp
            Download

            memory/1188-93-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/1188-99-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/1188-87-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/1200-644-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1200-273-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1636-267-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/2076-275-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2260-57-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2260-55-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/2260-49-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/2260-507-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2404-19-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/2404-98-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/2404-20-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/2404-11-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/2556-205-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/2624-266-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/3484-31-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/3484-34-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/3484-274-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/3484-25-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/3568-540-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/3568-72-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/3568-64-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/3568-70-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/3604-201-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3752-200-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/3756-271-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3828-264-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3828-642-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4004-272-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4004-643-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4072-204-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4072-503-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4100-208-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4416-268-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4588-61-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4588-45-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/4588-37-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/4588-43-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4588-44-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/4588-60-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/4680-203-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/5060-76-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/5060-112-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/5060-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/5060-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download