Overview

overview

7

Static

static

3

15b383f3f6...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 00:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe
  • Size 1.5MB
  • Sample240604-ag3keaec5x
  • SHA256 9d87815401169d64cb8e075b09ef332257172e60324da20513bbd36db74e5264
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\15b383f3f67822a4c941ccb3691d3360_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:936
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1944
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:380
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2184
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2368
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1872
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2468
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1252
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3560
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2680
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2872
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4736
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:5004
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:536
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3980
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4668
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4404
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3756
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:644
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2732
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1620
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2624
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4036
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4720
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
          2⤵
          • Modifies data under HKEY_USERS
          PID:4564

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 0fe054bdcba82c8e72f88b9d6e55c66c684d7af380b096d3ce160f34fe0bd988
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.7MB
            • SHA256 58399e5f8e3b19eb09811b227091aef310eeca6af316f87a1aa9e7bf4fde4e9e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 2.0MB
            • SHA256 de79b0f3685c9a521d49c4238d37a8113bb8abc3e2c4695bcc8d44216ed093f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 1980eb470422524d52300ca32a04cd99bab164362b50d0c649178c00e5b25b56
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 faec869b7bab8fd8000a787f4d97f088ff43769732dd8214e9c5e5a5824547c7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.4MB
            • SHA256 42f8d8c44f389f19c5231854b113379d7e8b1bd49cff6eb77f8f361c0b56894f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.7MB
            • SHA256 d86641e6359d02c911342e85e2f56dfae51b7fe6d18a68d95f0eb982d068a3ba
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 225d963b03582987ae54decb80f37f7a0603d92cd329a9dce3938779ce8743b9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.8MB
            • SHA256 e5a64b25dd693fe8ad2e8e8a5ecd4d90a0a3363e5da75302de983b44e2dddc36
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 c9b0bde4683bcf23a8c638cfaaf95a15b8bbd7233e81ec5da994a4fec8a663ff
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 06b74c2a7794f425b2a7e792abed79a595db3bbc71baf3b58fa9be23ee2fe98c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 acdfffc1933e8e403e9996f249aa1d7bbc0d93d2a1e9c1d84a402339a0d817ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.7MB
            • SHA256 2bbbe354d91fb5207ebc46d778f243793ac4b50524ccb055669c4905fd49552d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.5MB
            • SHA256 8587c2a79eb1cad6f388c2a8e6c4f85cd0ab5d4cc27eb03fe2519b03802cb08b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 823c877bf5e6fe3be4c7e963fed163c14f7c8edf4a62ef5443ec9823466cb7fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 9696bdeb8dbc58e8e278bdaf6179f6a164d8281716a3461b41734fa2b155a57e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 4b9c581d2ccfec8ae2914ef373cd169641ee9c9f057f536ba12046969587a4af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 436822352f57765249a86a29c48867408190b3e053d1f640366c8ddd9c69f734
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 69e21ea975d0454865cf60d7334d7dd87e0d0a2ce6267090e79d724fe0936339
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 b26187fb2c13e883f208ab51a5a22af800f3a7c7d2dddcadad02f56bf895fb56
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.4MB
            • SHA256 47c5aa2e56e0c3ea5687f0a505e92598abf406abcd606bb50e7893b942b13ec2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.4MB
            • SHA256 e2cc348aed6c7aa0eb30fd0b13b30f20b6b7d21b54ac8efce20d6b3d662b6d59
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.4MB
            • SHA256 6c79d4648b33479b7ba904ad301b35d9761867fcdce481b357bbc160bfd878a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.5MB
            • SHA256 6180c09d243404b71825cc8c0583fa7156a6824d893875ed8d092ba80e76d86a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.4MB
            • SHA256 f6505c6667a9638396a350402c35ba15b92996f91cabe56ef8c3e2c9d6f519f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.4MB
            • SHA256 0a1ccc0c050c21e10d156d5bf3ce3eaa5692aae7651f2992863cbcb7b07b503b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.4MB
            • SHA256 0aeff19ba9d19612a09b9320a598697c3a891daeccf157cd17948a068f1df7dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.7MB
            • SHA256 84a5d01c4c43816cb1896ea6a8daf6aa183b48b30f51c968afa44f9681453454
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.4MB
            • SHA256 b6f968b4b6ab356d229d76a903bd91a201cf59d88fcedd2002fede0e510df45d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.4MB
            • SHA256 9531b7daf42c4c61220882101bb1f96471bd3ddec9cc353378ce432c0aed02eb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.6MB
            • SHA256 c0bb349887badef64c57ae8dcda6899623643ce641e5de6a3aa481039b8331f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.4MB
            • SHA256 02577e1c3bb7db48f13f7a5206265d3880ffc7f05f62ca31d692706ab92c3cc1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.4MB
            • SHA256 816653a2c3983387b169d5260af6145485357417e321ffa753f38d2a16b0cd62
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.6MB
            • SHA256 07608ebc86efd59261c64d386e2f0b85dd9957579289d9463e8917dbeebec30b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.7MB
            • SHA256 ac5dc39748fea1f49c40da83f5ed0ec889d7d0f2eab9be00491131ba774240bc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.9MB
            • SHA256 fd2f54ecf64550fa10c1a334fe9cecdc68eb186cadc84fca7c0c7ab5770c492e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jcmd.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
            • Size 1.4MB
            • SHA256 64afb7050ba3e6913d9aa8a2f3a3d4c61a6a1b15048a5264586e13a6198707e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 9583e08a1a5b817cdc2406dbcb0f806dca6952f2d54ae5ddcd78d1daf1a9b6b3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.6MB
            • SHA256 d01e80f31d8414cc3b12411be0524ef9662bafd3b5747b9866c96040f43ef9a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.4MB
            • SHA256 0c741d5413a8ee16346cf7092747ee321cbf87f7b60360fe023889e647a889c4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 0d040bfa11cb47d7593ba0bb45007a78420a0d2f94bc833fcb04e73ed2b84667
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.5MB
            • SHA256 5cea2f2fe1905ac864e3077f6dc7d857307eb551f3e8ae95c785b6967cb0f603
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 c512d2279f868eb3060dd966e3006c6ee700b5f544cdeed23cf0535399ad8f92
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.4MB
            • SHA256 a7ca391f5bc58a70eee7c4c3922da73083ea12807c315d08007cdef52283f4a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.8MB
            • SHA256 ac689ca6a8a9179fbe43f02e065aacf77082a31b6f2570f6eb82153d766750ae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.5MB
            • SHA256 c7e7bfc02ff972aef94c32a72bcb3ae811e074c4758c3124979a40e524169d5d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 4b63bd178786d8fc9e5180161d7251a4628e0185aa9e6a266e9d9e69b2bcfb57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 6a6a23223af6e9542852c1506071669e7737a5ea19eb8e6e299798b9409e6565
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 147ab2d770857125c53d9b57dfd8cf7d78e9d73036408c261a995fdb1ca7a727
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.7MB
            • SHA256 b43067dbbcd4983b44ca89da73a0134acdd2da0e7a1b99e7bc378d201854a00f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 dba315b3fbc1ac03e649507d592b9bb2c23abf4ff3c710451ea08b88a25d9688
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.5MB
            • SHA256 7a14028997e94404235346a33f42f8b7f154f026d404d05807401075f3dc5404
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.6MB
            • SHA256 f154c6fa729843c28bb152e7aa994eb77c4c7cc6242cde1c3b1db008f5833143
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.4MB
            • SHA256 72a52ce3a955aeed78e5c7bf1254b2478e15c49cdeb1cdde24950aa907e112f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 a03bb6730f41960972bb10e0d8a7e0e30d4d9ea76046dd250fbfb0e752475aa4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.6MB
            • SHA256 0176bd809776a9c5ce806e16e2e629e62a983285900f335e0dcdaba72ce531a7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 0a0cfe3c61a9a5095308919a5b40f257231988e6c0c8b43e825dab68e936a907
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 0e80c936bebae1a462ff617f683486aa77c80559d544c5531dddc711d6994ae1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.7MB
            • SHA256 532616a23a360a711fbbd8addcf56b213106f81e22604da3c498fa5eee01851e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.5MB
            • SHA256 3fb79c3159d638a5c5c5b86c834390f4a7c4bc26919747f4135084ca1ab3f4bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/380-36-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/380-28-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/380-35-0x0000000140000000-0x0000000140189000-memory.dmp
            Download

            memory/380-579-0x0000000140000000-0x0000000140189000-memory.dmp
            Download

            memory/536-497-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/536-259-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/644-263-0x0000000140000000-0x00000001401C2000-memory.dmp
            Download

            memory/936-439-0x0000000001EE0000-0x0000000001F40000-memory.dmp
            Download

            memory/936-0-0x0000000001EE0000-0x0000000001F40000-memory.dmp
            Download

            memory/936-8-0x0000000140000000-0x0000000140184000-memory.dmp
            Download

            memory/936-9-0x0000000001EE0000-0x0000000001F40000-memory.dmp
            Download

            memory/936-440-0x0000000140000000-0x0000000140184000-memory.dmp
            Download

            memory/1020-585-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1020-268-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1252-83-0x0000000140000000-0x00000001401AF000-memory.dmp
            Download

            memory/1252-71-0x0000000001A40000-0x0000000001AA0000-memory.dmp
            Download

            memory/1252-77-0x0000000001A40000-0x0000000001AA0000-memory.dmp
            Download

            memory/1252-81-0x0000000001A40000-0x0000000001AA0000-memory.dmp
            Download

            memory/1620-265-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/1872-582-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/1872-50-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/1872-58-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/1872-56-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/1944-578-0x0000000140000000-0x000000014018A000-memory.dmp
            Download

            memory/1944-21-0x0000000140000000-0x000000014018A000-memory.dmp
            Download

            memory/1944-13-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/1944-22-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/2368-39-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/2368-342-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2368-48-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2368-45-0x0000000000810000-0x0000000000870000-memory.dmp
            Download

            memory/2388-194-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2468-251-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2468-583-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2468-61-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2468-67-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2624-266-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2680-253-0x0000000140000000-0x00000001401AF000-memory.dmp
            Download

            memory/2732-264-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2872-254-0x0000000140000000-0x000000014018B000-memory.dmp
            Download

            memory/3560-252-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/3560-85-0x0000000000D50000-0x0000000000DB0000-memory.dmp
            Download

            memory/3980-260-0x0000000140000000-0x0000000140176000-memory.dmp
            Download

            memory/4036-267-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/4036-584-0x0000000140000000-0x00000001401A6000-memory.dmp
            Download

            memory/4404-262-0x0000000140000000-0x00000001401E2000-memory.dmp
            Download

            memory/4668-261-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4736-255-0x0000000000400000-0x0000000000577000-memory.dmp
            Download

            memory/5004-256-0x0000000140000000-0x0000000140175000-memory.dmp
            Download