Overview

overview

7

Static

static

3

2024-06-03...uk.exe

windows7-x64

1

2024-06-03...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 16:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_ed9d668e3be96e054344cb0e4581f0ef_ryuk.exe
  • Size 2.2MB
  • Sample240603-tpye7sca41
  • SHA256 042d12ad222afcebe9ff05e5ba8696ff937b6ab409a90b3f77f9b47d4cb6149b
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 21 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_ed9d668e3be96e054344cb0e4581f0ef_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_ed9d668e3be96e054344cb0e4581f0ef_ryuk.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4368
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3872
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3132
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2472
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1008
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3744
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4932
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4536
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3320
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1728
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3448
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1840
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2400
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3156
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2656
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3504
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4844
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3836
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3184
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4600
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4932
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:3784
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1724
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:2744

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 526a1525ae447ba8506b495199be74fe97f9e7433a06a709e140c02cf4bdabd0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 c6d0bf4eab56ae050087b5c12af6287b2a20e1d504acc94beed81982bfe62475
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 ea318709a22fd49110002c9af946cba816d45deac9d2c24d6ac6fadb185ee551
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 c801f7f10ead2f8bd37b33b5a80a60e08120d8054bf20b5a1fba6008a8fcb3e4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 6dd3378ff729ff807bbe93a92dbe91b8b0bdf34ff254f41024e895b060c74d24
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 5072efd00668f1a2179cb8ef95fa9bb10c395792e011d00ded172807cc6d2d0c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 eb1dc49c6a9cc0d96d52ad7f1adca6e3901b740bc20768929fd7cc6cbbaf9c53
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 a40dd4c71514544322d9c869538a2da4dacd27402014de43e20d4a4d6b1bfb99
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 95d5f45c0049b9e72468c74f486a1a37ef66778c0d1dd8bb3d6540d474ee2a14
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 2a3c0dddac6a158bebe5c8fb26420a961613923ef40ab9dd37d0d71d8e70f60d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 acb80e444bf6fe47bfad0d8cc8ddcbf26abe341ecce60f48ac865ac9b49d83a0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 6d19275fb9bd2264c90e030b042073138b34ebe02292292f120b218de6359c77
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 9a7db3d34d78820faa652a4c80d4d713c656dc54265456b0cbc40193f54b2f07
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 f8057808ad203b28962cea6494445c0e899a806bf8cb3bb65f286a93a410c1d0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 b1af07734604b18a7a2d91817fcf77d135011db98e4f18650afecaafc3dda28f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 e1e2f11349729a1d1e52c88866a91cc4a85e4f36eeaf0ac8a9a3195b80de604e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 631f60dfa944215c8d3258ef8db7c9efa515396a6fdec769e681f3e42d999d1c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 a197fc773b10eea7195d72106ec1a12d71270c80598aa9cf0ee581204a95ebd2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 5a6f38faadc1413456acc540a03edea702c88f88c56103d83d893c2765bcec06
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 5e91388be797e48b1a1c7678f0ddfde231b7e0b0bdc8fc6297e5a69b93db3c2b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 da1b061ab6187d923a0b7a0d873e872e273461e770d159fa884eea1a7c08a473
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 5474f099308172a0d8f549f96ca42cba1aea041e6375a4937df5283483c76fc5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 a6fbd27b1951c34742a0cd8fbe01a1cb54158441da5cafa230b5c45cf7ab21b3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 68e4ad56c02d90ffae1f440f521979656c33cb9c1245a64781ccf26337247970
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 67442cf5ce53ca069f0768b09e4f65579a2002f956f84ad551c12ca3a8f1ada2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 43f80e8fdfc9a60e95ab4cff48b81cb9c70c561523689a088a96eab0445866b4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 8b0c9e1019c8c151f670532376ee134f7171ebd7149dad4eb827358b5f9117e1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 674f9020a76b8dc9e5f2c99283a8a9001874249c4ccf79ad6fd2cb06223ceb06
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 bf839dc03f5a4916f184555fe2a48b0f127c4f9b1f6d6c6cf52c2a1f7dd286df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 314ec54ab2c4cac0e4073c3c1d81fa0388779b8fe9726cc30e27bf13c49db2e0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 7fbcfbeb5d45f30be29439fa26b7ae4b4cd1e6401ae3e0c62fb6e053e10de06f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 71e4d8b6650239b24dbe1e99d70a3ed3b76ba15075c9b7f326b4ecd18a9f6f25
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 89a556b8a60482027f8790db0f53f2ce8ad761e8972b4ecd9ff208fc76d00351
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 2c432d046cdd3ea042fc3ba3b7a16bb41e8c13876ee80cc22d44a0d4e92a50e1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 1cadb8f5e8da0e8c2c9a634b312c1b3cf3c314f5551b5b4c993fe9f454c74d21
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 581KB
            • SHA256 cdb69d9ecf1768c9b4f7a3ab094e25e93838289bc6ebdf29d97384437e858420
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jconsole.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
            • Size 581KB
            • SHA256 16e86ba56b972625862addf965608eddb8d01003d7056ddbb7e25633947d2e04
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jdb.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
            • Size 581KB
            • SHA256 9b32662b41dc7658a97d9b0f778c8734067d33fed2ce55593540b5eeee9777a9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jdeps.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
            • Size 581KB
            • SHA256 76f7a825b8adbb609fbb672baa3877d646866fc71b5a1662df5d7b68ad3a9a4c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 53a8e8126c674dc0512245c4d1216bf657518eb92e41722d92f62358d4d7adb6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 367a67ca9a359644b4222ffacfa76558762e87a2ba1c18125a4c1ea97ef5e2ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 f205e4b379d1082efaa1276b6bedb56cbfdbd7593b9d9631e1b1175f705766c8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 6c570468a460cbd18458b810339f92d7d6b105324f50c42e3fef1ac0871e517f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 778db43eb50abf98567a3446f6bb356366dac43a3a1c5fca1b4ea5982ab45e9e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 59f9ac1fc62932b913e73bc92eeebdfd17156efb686de842b78a985023763810
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 ffce8c096267fa1638f595fd3030900310c42984b26b27d550957aebc1e1495c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 47ab97e1a228f2b515569e77d688fd777db87e58b3e45059ffa8e4f32fbaf50c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 49a103a873e69cd09302903605052fd13389959be11d8e4f770237e1c72e81c8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 0b0dd074b01765d96588d8862b224896e1ad6718c1002cfa90e7eb5f2c757801
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 2129ebd946b94efa119c9daf29f96e532cef22606ebeef048aa8380d97627b52
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 053497df308af32aa8fa0ff6bd53e2590869cdaf1e90ef604b9b87a4bd8f805d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 b1d812423a1dbfabd2d0e1d0bff484db356093853a3f9418405d88e94a5f552d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 a8818c8d6460b8f4ae1275b674b0a25eb43ea9134b05bc219db903342261aa50
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 4b1e49120098bc9541d7a02c18988787647d010e09dd864e33d88bb687baf0e5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 c1e1127aed5e74734637af5353338027f0241bfd1fdd1f2a82613c981dd5daf2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 92499b2117b4053f64a823c5b66fc2ae037192875823881d713d8393d67e0e22
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 81475b04356163bf29f7d5abc349ab8e5316cf462885f497f1aec9d7e28158cd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 9d46b6884be4b129573c263a44a0fd661a7e7ee40a4d3f38a6783ba8ddaa5759
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 88f223c5893c23b10fe656598b86546e953d6eccee18190f60a4e3ea9c89391e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1008-30-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1008-29-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1728-246-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/1728-314-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/1728-250-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/1728-256-0x0000000000BB0000-0x0000000000C10000-memory.dmp
            Download

            memory/1840-322-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/1840-270-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/2400-273-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2400-327-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2400-518-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2656-281-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/2656-517-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/2656-280-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3132-25-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/3132-26-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/3132-16-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/3156-442-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/3156-277-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/3184-308-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3184-306-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3320-310-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/3320-242-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/3448-261-0x0000000000520000-0x0000000000587000-memory.dmp
            Download

            memory/3448-266-0x0000000000520000-0x0000000000587000-memory.dmp
            Download

            memory/3448-260-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/3448-318-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/3504-292-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/3504-519-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/3744-39-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3744-41-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3744-33-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/3744-235-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3784-526-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/3784-323-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/3836-303-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/3836-520-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/3872-12-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/3872-232-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4060-527-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4060-328-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4368-0-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/4368-49-0x0000000140000000-0x0000000140248000-memory.dmp
            Download

            memory/4368-10-0x0000000140000000-0x0000000140248000-memory.dmp
            Download

            memory/4368-6-0x0000000000820000-0x0000000000880000-memory.dmp
            Download

            memory/4412-320-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4412-525-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4536-73-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4536-65-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/4536-236-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4536-71-0x00000000007B0000-0x0000000000810000-memory.dmp
            Download

            memory/4600-311-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4600-523-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4932-50-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4932-61-0x0000000002280000-0x00000000022E0000-memory.dmp
            Download

            memory/4932-315-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4932-524-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4932-63-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4932-57-0x0000000002280000-0x00000000022E0000-memory.dmp
            Download

            memory/4932-51-0x0000000002280000-0x00000000022E0000-memory.dmp
            Download