Overview

overview

7

Static

static

1

Ziraat_Swift.hta

windows7-x64

7

Ziraat_Swift.hta

windows10-2004-x64

7

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2024, 06:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ziraat_Swift.hta
  • Size 2.2MB
  • Sample241202-hpsdeatrgv
  • SHA256 5f0d6bb3445ed0c410b2dd8874cf7fc7b1c4e06cc2e620790eb782f2c339c796
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 24 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Ziraat_Swift.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\x.exe
      "C:\Users\Admin\AppData\Local\Temp\x.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Users\Admin\AppData\Local\subpredicate\differences.exe
        "C:\Users\Admin\AppData\Local\Temp\x.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\x.exe"
          4⤵
            PID:1656
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 876
            4⤵
            • Program crash
            PID:1836
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3516
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:3532
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4152
      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3500
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:640
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:1440
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:1616
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:764
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:3164
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        PID:1408
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:1968
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2944
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:1544
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1584
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:4344
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:4172
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:1864
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:116
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:3704
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2204
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1344
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:2980
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4148
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:228
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
            2⤵
            • Modifies data under HKEY_USERS
            PID:2796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3636 -ip 3636
          1⤵
            PID:1824

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                • Size 2.1MB
                • SHA256 b4dee48d65ca8c58eb224c5c66a3e3036040cfa3da55b51625b45ba799f7ab5e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.3MB
                • SHA256 dfee94e17601ef98af56c9a36a75b34bf60b2320a7c9806d245c83d0e14d6158
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 1.6MB
                • SHA256 9559e8ed76f50bc69a27337c218762fdff1b7a7fdf56e0b27df1ad4c8c228113
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 1.5MB
                • SHA256 7f4370b5011a78df5ecfec708d888cab5961dea19a9c2f0f1ad1751cc13d09c6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 1.2MB
                • SHA256 ed91cbfb97763b411a5bf7f5adddb1e7b3008c64a18108d7e14219df340938e2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 1.1MB
                • SHA256 a7baaad8a058c21c176a239d5ca98db200b25cd7348a86af809451fb8300e75c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 1.3MB
                • SHA256 be85d12d39f8a583b14bc515112451cfe51641db381e5de8c7a6ae510cea6ead
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 4.6MB
                • SHA256 d8e823fe6a936ab202e9bbd81325c89fa789a9b2d160d7e55bc8ff7b9fa1f609
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 1.4MB
                • SHA256 268fe3af0bcf61cbb00bdc912c7fe109cf519f534c1f981ccf37775f0d8c24a7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 24.0MB
                • SHA256 792ed14dfdfb4339fbb9d979164bc4dbbf242f3b28998ba3ca83e87549ced752
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 2.7MB
                • SHA256 eb1d0a0e33dab6ae3387074e9276f62e57c9b3cfc7be831f8594cdf44acbf11c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                LICLUA.EXE
                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                • Size 1.1MB
                • SHA256 04e7269ffd3769ed98bb1c7c5941f386020509582414ef51dff19ffb635e631b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.3MB
                • SHA256 8ef07f75168f9147f1b0760c0da174ea7ea16df360f47e5a84ac0d26d5837caa
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 1.2MB
                • SHA256 4486d83b86e4db5a9d225f0e517ecd9bc22ac4c94151f691bd1acb9b4786554b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                • Size 4.6MB
                • SHA256 95dd21a0831b3239e6a6c5d0e9f1d1c65166771fc42528aa92ae0621ddfe591f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                • Size 4.6MB
                • SHA256 e176fc834b5cab9a5c9f40dbc0a2b2f0ed5def0723a02ac43a1fb321e6f80331
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
                • Size 1.9MB
                • SHA256 e80d9453bfd983a9f7c9296975d9850f8db83229b61ee56df826dfeef6a1c6fc
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                • Size 2.1MB
                • SHA256 01e81d4c7e13fae609c33df47523b01dc3f4083b0e4b406fa8253cccd700c8ad
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
                • Size 1.8MB
                • SHA256 6a4961702cabaea3197f23ae55c14f0d88c2162234e001f9bb0d0552157f0367
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 1.6MB
                • SHA256 1b700b85f021df358f4189d95a5e26253cc698d0ee3686f9b62d1db8259d6163
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 1.1MB
                • SHA256 b72914e909ed7d27e928474925967c4a84d60d697d2844a9b0c68a4d3774e244
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 1.1MB
                • SHA256 bcf225d757ebe578cd318edc054731b162672eea302a951f81ee7f3b9eec303e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 1.1MB
                • SHA256 a6fa3090e67fab1435c72d5d0bc5c2d3329de9bacfb9ab1e1f308743f2c70d89
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 1.1MB
                • SHA256 81d81bf989cf085f406c8191e19ffbc1317bdcdf8781501b1a25b00c7f563948
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 1.1MB
                • SHA256 feca62502bcd69ae64fc2760fddef54361f4323d18657c6fd31ab75f424ab2cf
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 1.1MB
                • SHA256 a8a90fabeac513cdad5e6e21d31dccbbedcbe1f7e575b07be6b66bc2ebfdf79f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 1.1MB
                • SHA256 895e0087a18c2b5e6dc0793c68ae9bc195e4595b3c49d8fadc4d6e309c6f8460
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 1.3MB
                • SHA256 8c67f258a533f499930a2320379fafabbe359406eca07264f90f4d85a0917105
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 1.1MB
                • SHA256 11bf2c37d10402bedab537607040962e4791de3dfd5f6dfa1a620686483f1a1c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 1.1MB
                • SHA256 8764912318b0b2a584874d269298fb083deddef1ba5f1cbdf20e738e039422ad
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                wmpnetwk.exe
                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                • Size 1.5MB
                • SHA256 018350a8fe844991451f1ae30366c661d1e0c6478c1f6184771882feadca4e56
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 1.2MB
                • SHA256 45122269bc133b635655ec064f455d1c9f3e33db3ee5496c404fdde34f25753d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                avenses
                • Path C:\Users\Admin\AppData\Local\Temp\avenses
                • Size 206KB
                • SHA256 b60d259cb7254914eaaeacad19d89e9cf9c4b31a6783eb36f505d7c64f233ee4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                x.exe
                • Path C:\Users\Admin\AppData\Local\Temp\x.exe
                • Size 1.6MB
                • SHA256 d9487fbfb0064873d0f48625ae5ecbfbeaccf17ac809de32a1b7a0fb872079f0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                c10005bb983eaefb.bin
                • Path C:\Users\Admin\AppData\Roaming\c10005bb983eaefb.bin
                • Size 12KB
                • SHA256 6f117ae03957b68243d616f6235765bbf02ea17e13a01ae05bcdf4373e6ec45f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                perfhost.exe
                • Path C:\Windows\SysWOW64\perfhost.exe
                • Size 1.1MB
                • SHA256 270412e69c555ccedbd44d5140862b0edb79fb7aeff61a0d0ee8735ddb184e79
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                DiagnosticsHub.StandardCollector.Service.exe
                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                • Size 1.2MB
                • SHA256 33e11bf79ec60805f10884405c4ff9f34edeb937007960005658f9784cb6d211
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Locator.exe
                • Path C:\Windows\System32\Locator.exe
                • Size 1.1MB
                • SHA256 f290a55d913de7a2637483c4f07c22b74e7ca17b42a0fadfc17fccd1b283808f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ssh-agent.exe
                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                • Size 1.4MB
                • SHA256 5ca6c4118d223e73747ddc7419f2290ee20f96a6c986d14bfc580392ceefa066
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                PerceptionSimulationService.exe
                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                • Size 1.2MB
                • SHA256 7e8a6ba0c16376e2ac17792b8e9d687a4ae3052e388a3a9e5768e74d4ee08638
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SearchIndexer.exe
                • Path C:\Windows\System32\SearchIndexer.exe
                • Size 1.4MB
                • SHA256 e14590869131c2b7c640c2c0fc3b188d0a4326d1562fc885ee5fde247f56220b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SensorDataService.exe
                • Path C:\Windows\System32\SensorDataService.exe
                • Size 1.8MB
                • SHA256 2875c5562ffe5f459199a5b7c8b0340261f79510a0190f758657b9aa237423f4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Spectrum.exe
                • Path C:\Windows\System32\Spectrum.exe
                • Size 1.4MB
                • SHA256 ebb09814578358373f130b68ed7e813f665de47b92af2f0a01a78af8371785b1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                TieringEngineService.exe
                • Path C:\Windows\System32\TieringEngineService.exe
                • Size 1.4MB
                • SHA256 32cdd95f6ba59ced0c14435899979f56056fcf80d183b3243f9b4e3c4f19cdf3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                VSSVC.exe
                • Path C:\Windows\System32\VSSVC.exe
                • Size 2.0MB
                • SHA256 fcf707183cc3cb62df95e96641c00a58aa0325305deb495bfce7440effc8450a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 1.2MB
                • SHA256 307b6a81a51dcf1534af373b4b55a4f256ac2c1d6d71bc244055b0ce665a2440
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                msdtc.exe
                • Path C:\Windows\System32\msdtc.exe
                • Size 1.2MB
                • SHA256 d93a4c532397f2d4169fefd222403434fb18c7bc048a2e7593007222c24a7359
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                snmptrap.exe
                • Path C:\Windows\System32\snmptrap.exe
                • Size 1.1MB
                • SHA256 4ea7c0bbc4522ba3153de1830fe01a6767daa6021ce63b8c96640cb08cdb345b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                vds.exe
                • Path C:\Windows\System32\vds.exe
                • Size 1.3MB
                • SHA256 7064067c5e482f4630ab7d64bf3cf1b118205c25065743ab9d6a94edea6df34f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                WmiApSrv.exe
                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                • Size 1.3MB
                • SHA256 b6ea1078147e4c4170beed82361f55e82d22144f900cb1f161fdb7d325afb78b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                wbengine.exe
                • Path C:\Windows\System32\wbengine.exe
                • Size 2.1MB
                • SHA256 fa89fce27884e0b611e5c912980c2ec2b015a88ace625c15004e2058ac207ace
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AgentService.exe
                • Path C:\Windows\system32\AgentService.exe
                • Size 1.7MB
                • SHA256 339851ad6c99245e82e10ac275b74771c82d8e0b1bb6343289708e047903dabe
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 909721993de646a1d8272c3760c7f6672a09631cff9f08da8a8cedb8466ee4ea
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SgrmBroker.exe
                • Path C:\Windows\system32\SgrmBroker.exe
                • Size 1.4MB
                • SHA256 d8ba7b750c49816c282f9a101eceb88ecef6fd440451a8855d31d29ca7b9a0b7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                fxssvc.exe
                • Path C:\Windows\system32\fxssvc.exe
                • Size 1.2MB
                • SHA256 468fca42ecabfc4c985aee9039770d1da482ed7a7ff59e8dd98b3af55210a070
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                msiexec.exe
                • Path C:\Windows\system32\msiexec.exe
                • Size 1.1MB
                • SHA256 b7c5df04dba1a832da69627c7648f9141202affcf5d758dbef1d1c07dd9b6662
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/116-218-0x0000000140000000-0x00000001401C0000-memory.dmp
                Download

                memory/640-78-0x00000000001A0000-0x0000000000200000-memory.dmp
                Download

                memory/640-601-0x0000000140000000-0x000000014022B000-memory.dmp
                Download

                memory/640-87-0x0000000140000000-0x000000014022B000-memory.dmp
                Download

                memory/640-84-0x00000000001A0000-0x0000000000200000-memory.dmp
                Download

                memory/764-354-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/1344-345-0x0000000140000000-0x0000000140216000-memory.dmp
                Download

                memory/1408-310-0x0000000000400000-0x000000000051D000-memory.dmp
                Download

                memory/1440-95-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Download

                memory/1440-102-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/1440-99-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Download

                memory/1440-97-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/1440-89-0x0000000000C00000-0x0000000000C60000-memory.dmp
                Download

                memory/1544-313-0x0000000140000000-0x000000014011C000-memory.dmp
                Download

                memory/1584-314-0x0000000140000000-0x0000000140169000-memory.dmp
                Download

                memory/1616-603-0x0000000140000000-0x000000014013F000-memory.dmp
                Download

                memory/1616-108-0x0000000000C50000-0x0000000000CB0000-memory.dmp
                Download

                memory/1616-116-0x0000000140000000-0x000000014013F000-memory.dmp
                Download

                memory/1864-334-0x0000000140000000-0x0000000140168000-memory.dmp
                Download

                memory/1968-311-0x0000000140000000-0x000000014011B000-memory.dmp
                Download

                memory/2204-336-0x0000000140000000-0x00000001401FC000-memory.dmp
                Download

                memory/2660-25-0x0000000000720000-0x0000000000780000-memory.dmp
                Download

                memory/2660-35-0x0000000140000000-0x0000000140130000-memory.dmp
                Download

                memory/2660-481-0x0000000140000000-0x0000000140130000-memory.dmp
                Download

                memory/2660-36-0x0000000000720000-0x0000000000780000-memory.dmp
                Download

                memory/2660-38-0x0000000000720000-0x0000000000780000-memory.dmp
                Download

                memory/2680-107-0x0000000000400000-0x00000000005A5000-memory.dmp
                Download

                memory/2680-12-0x0000000001BA0000-0x0000000001C07000-memory.dmp
                Download

                memory/2680-52-0x0000000000BA0000-0x0000000000FA0000-memory.dmp
                Download

                memory/2680-11-0x0000000000400000-0x00000000005A5000-memory.dmp
                Download

                memory/2680-340-0x0000000000400000-0x00000000005A5000-memory.dmp
                Download

                memory/2680-19-0x0000000001BA0000-0x0000000001C07000-memory.dmp
                Download

                memory/2944-312-0x0000000140000000-0x00000001401D7000-memory.dmp
                Download

                memory/2944-600-0x0000000140000000-0x00000001401D7000-memory.dmp
                Download

                memory/2980-602-0x0000000140000000-0x000000014014C000-memory.dmp
                Download

                memory/2980-346-0x0000000140000000-0x000000014014C000-memory.dmp
                Download

                memory/3164-309-0x0000000140000000-0x0000000140131000-memory.dmp
                Download

                memory/3500-67-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/3500-581-0x0000000140000000-0x0000000140234000-memory.dmp
                Download

                memory/3500-73-0x0000000000800000-0x0000000000860000-memory.dmp
                Download

                memory/3500-75-0x0000000140000000-0x0000000140234000-memory.dmp
                Download

                memory/3516-44-0x0000000000690000-0x00000000006F0000-memory.dmp
                Download

                memory/3516-53-0x0000000140000000-0x000000014012F000-memory.dmp
                Download

                memory/3516-50-0x0000000000690000-0x00000000006F0000-memory.dmp
                Download

                memory/3636-364-0x0000000000400000-0x00000000005A5000-memory.dmp
                Download

                memory/3636-509-0x0000000000400000-0x00000000005A5000-memory.dmp
                Download

                memory/3704-335-0x0000000140000000-0x0000000140147000-memory.dmp
                Download

                memory/4148-347-0x0000000140000000-0x0000000140179000-memory.dmp
                Download

                memory/4148-604-0x0000000140000000-0x0000000140179000-memory.dmp
                Download

                memory/4152-64-0x0000000140000000-0x0000000140135000-memory.dmp
                Download

                memory/4152-103-0x0000000000DB0000-0x0000000000E10000-memory.dmp
                Download

                memory/4152-105-0x0000000140000000-0x0000000140135000-memory.dmp
                Download

                memory/4152-62-0x0000000000DB0000-0x0000000000E10000-memory.dmp
                Download

                memory/4152-56-0x0000000000DB0000-0x0000000000E10000-memory.dmp
                Download

                memory/4344-320-0x0000000140000000-0x0000000140188000-memory.dmp
                Download