Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_8868a7410e60dec90b8a4562e0b5be16_bkransomware.exe
  • Size 1.8MB
  • Sample240526-efl89aef84
  • SHA256 05088af15fdf5b986bc4867ade4a8ca6d826e2d355a51ec6eeb222e03c8a903a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_8868a7410e60dec90b8a4562e0b5be16_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_8868a7410e60dec90b8a4562e0b5be16_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:332
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4512
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3668
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3960
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5044
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2144
    • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4904
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1208
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4012
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4900
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2204
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3048
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4496
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4664
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3488
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3684
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:404
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:964
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4092
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1100
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1004
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4184
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5164
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:5192
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3180 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:6116

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
              • Size 2.2MB
              • SHA256 71ca3afb61c42f5d8906f14a62478170cbeac3e85a920df034a0344469602752
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.4MB
              • SHA256 f1dab00af259e20a142ab0f546bedcae321b86ab6f6f46cf6f00f3bc2d230a78
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.8MB
              • SHA256 b6fa52dcb3f3f669e7c293652859ec0780140ddffc7b2c55c774a00701ce9e9c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 366ba2a687d5186ba24cc1235d27c62536a6f8fd7e4a7beceb3ff3a25d64cd95
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 d96113fd4d673380da17e7b4087ea631af604a7293b932a06f0e3404d5da969c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.3MB
              • SHA256 9a2ffcb8a16f6cb0e8f0c283540a26107014304f591ca4706644dbd42ba2733e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.5MB
              • SHA256 f70ad18805dab180091b625446b3db20bf803638a5df7746273d991088cd52d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 364bcf7798fdac1281abce5d3082bdc94ebac4b40b10fe120ecc0a83eb7ddd7e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.6MB
              • SHA256 49402fdfa76526f366a1e1b77805076456283ac4d0f0f39116af242c08f0e879
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 ae953dcb940f6442e9a01bfc968a33506b22a0e8f7f6bdc25c0a1cc887430aae
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 a15235293c71c5a30457fbcf7485261e1921386cf09cb187dc386f4a2d37c86c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 5ecd4b08295b84df30bd2ee3bcb77ee8a6b5c127880a43d25d4027c106cc5669
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.5MB
              • SHA256 febab725d4902e8ec1b74637cd80bd829490cf069d2f2e71f2291d0b3b5f7016
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.3MB
              • SHA256 718777ab94c7476daccbf4c45a1af87ae241fe94d277ad3ce4294fd05386be42
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
              • Size 4.8MB
              • SHA256 ca973ec26c25d7b1045338c222bae188354aaed3e32d28e7dc9d319a50d6a839
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
              • Size 4.8MB
              • SHA256 f9bcdb6eb5b4725f242e84009dd3e94a3cb04e017d02080c2165952c7ca7fc77
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
              • Size 2.2MB
              • SHA256 a8b09bb45fc956f1b217aa95bd97ff885764578ae934d42b52ce93a07fe402a0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
              • Size 2.1MB
              • SHA256 0c8222acd931ef00d7aac1c2baab7a8c56d92d2770f482382a1b3a82af08cb86
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
              • Size 1.8MB
              • SHA256 dddf1332b6499601de945b0109874971544f868850e6e3d7acf6d61185e82d38
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 1.5MB
              • SHA256 321ba82964e9e4c6f82dccc2c86fdb04a1339bcc814adf62ed29dac3784dfecd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.3MB
              • SHA256 3e9f2ff661942a871e6f8c0bf4b52e94b626a40c21b5a9a98d2a2c022400c0eb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.3MB
              • SHA256 085fb71b6abe48d820f25cf9e3ce886114401c373e6967ac60d6c1f23710db77
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.3MB
              • SHA256 651f8bd19533a085cfaea791175328cf81fc612d4e700b85db638bff6072a884
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.3MB
              • SHA256 69afc506a8c3298eeda376811ad0ee06ba0f2065649dea47b28dd008a378dd8d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.3MB
              • SHA256 ab7eaeb9b945022cef721b20d169c108ee9b90be481523ac529de48765c0446f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.3MB
              • SHA256 64d31617327b52a15b80f29cd8176d4a9e3c71531aabb066512dc151d2c0b80b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.3MB
              • SHA256 274206427befabede8403476bae6eb7860334f3b7ea30d9f3aae8aab9a35e1a8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.5MB
              • SHA256 0e2a96f03f908ba9500c354485346e21037bae2fc004133dbc1c41894aa98073
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.3MB
              • SHA256 f823f0dd969eec25f7116ce73b45939ac0f978487efff0226ab6de0845d2e732
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.3MB
              • SHA256 0bb5797d5e267f555809b3b1954c83d93d21ddc511547cfdd89629abe5f52598
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.4MB
              • SHA256 da313c8beaed91066684b7128654a50f94ad914d6f9dce39a82c95be3ccbabc9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.3MB
              • SHA256 4642b486b85f0fc9a79d1a0878c302ac045e6b217e08fa101931e4ad30e231be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 1.3MB
              • SHA256 8234b72ecdb6df66d64c32fe5583106436a4fbe7a373b2bba4c4e5aca06c709a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 1.4MB
              • SHA256 8b4f30c87c0e9f2c5df55612bd9f2f2d68881e7a67df6e9b94669b94a7807729
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 1.5MB
              • SHA256 c6e14a0e5122a860ddba791e0401ca8cc4852c8e52d8e93101eae3f049eadf72
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 d954dfb7ab377ac1062541f79f56d2dc4585fdaa457c7ca75b233e83a710c9e3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.4MB
              • SHA256 c340bce8339869ffb374d8ae5e189938625be07f6c5a17498d198561ccd3e557
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.3MB
              • SHA256 59f90986588bc2d8adab2a75d9336ba7527cb00f2b0aa5329ec9cc3f7dc9b86b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 34ecdba4e3abfcef79e82ca55e46556e078f54714c7dc2064a0f12b4af02ba72
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 1.3MB
              • SHA256 4ba44013d8e8fb0833ab1a387a0c3635047979e3b6db967d8bf220b5cdb4dc6a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 945b71711bb0b22a02feba2ee593450a2e7e2ad6ee05120dea3f61b1c56644c8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 1.2MB
              • SHA256 0fc2e142e92acac844cac980b5df42d53199228c2deecd137813fb99a2093f59
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.6MB
              • SHA256 9ba95ab7d26606f4bf34f6f61d2e4b10b106958a7e5a2afc9d8f6dec91c6a36c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.3MB
              • SHA256 8f35dfa29307693002c11bf9d33678812826531b379804c8db7e745bb5cbb2d9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 c0a173f7c1e493a626172af6740b3da5f4697fd7412a3bdcaddfa2d61bad6b66
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 6a7fa54a5489467364976f007a60cc000868ceef81225e948a930a03d0d57a46
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 b169be664eaa78a20ee661d4395f8e6efb8aae1934d23620e7257c19d96b7006
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 1.5MB
              • SHA256 944f8d5857a20f28b1701e9d32911a54445452f05aa74c856055a451f7dac489
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 9f879fb776589073bfa7d6233f28f132679b482b81e2ae27689ccec510eaaa7c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 1.3MB
              • SHA256 c91dbee99266b25616f63916deb39f2cafb68642410e7252f6a3bdfd9f07afd6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 1.4MB
              • SHA256 01d1266c2e149b8f75a61c7c1dcc25ceb0e04b62c031bc1495f3a895dea49990
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 1.3MB
              • SHA256 428912f76e3843a8ed848c9686287eac16bf3b81b93260679cadf1e0394b95fd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 17637e0764852b1322070886e1003198eb74e666b1f9177cb000b0ccfa81a888
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 1.4MB
              • SHA256 a67eebc34bbcfeef67a1980b990add72ba6a52ef2f10a6fe2bf6168e4498b9b4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 670c31fb9a344f11c3d217e83110f22c3469fc11518e764de800dc36fb1987b3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 5e308175881fe94a0c2157dcb4188cc07ccd6109742c64bd0f5532ae080b1a76
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 1.5MB
              • SHA256 6a9e469676f3ea4a0a90186cc6766715e3f3d333184f6f89218eefb929980275
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 1.3MB
              • SHA256 1908927a3921301155f009bba7cee73ec6a67814131b99a1b5ddc885842a03d7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              office2016setup.exe
              • Path C:\odt\office2016setup.exe
              • Size 5.6MB
              • SHA256 8ce6a2d4cbb3d86790b1f21ad006e3c08d4efcfbe963b4386ed05b0c5fc2d22f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/332-6-0x0000000002460000-0x00000000024C7000-memory.dmp
              Download

              memory/332-2-0x0000000002460000-0x00000000024C7000-memory.dmp
              Download

              memory/332-1-0x0000000002460000-0x00000000024C7000-memory.dmp
              Download

              memory/332-0-0x0000000000400000-0x00000000005D9000-memory.dmp
              Download

              memory/332-64-0x0000000000400000-0x00000000005D9000-memory.dmp
              Download

              memory/332-7-0x0000000002460000-0x00000000024C7000-memory.dmp
              Download

              memory/404-350-0x0000000140000000-0x00000001401B1000-memory.dmp
              Download

              memory/404-188-0x0000000140000000-0x00000001401B1000-memory.dmp
              Download

              memory/964-199-0x0000000140000000-0x0000000140191000-memory.dmp
              Download

              memory/964-374-0x0000000140000000-0x0000000140191000-memory.dmp
              Download

              memory/1004-448-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1004-250-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1100-414-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1100-226-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1208-77-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/1208-76-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/1208-83-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/1208-86-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/1208-88-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/2144-174-0x0000000140000000-0x0000000140237000-memory.dmp
              Download

              memory/2144-61-0x0000000140000000-0x0000000140237000-memory.dmp
              Download

              memory/2144-59-0x0000000000DB0000-0x0000000000E10000-memory.dmp
              Download

              memory/2144-53-0x0000000000DB0000-0x0000000000E10000-memory.dmp
              Download

              memory/2204-237-0x0000000140000000-0x000000014015A000-memory.dmp
              Download

              memory/2204-126-0x0000000140000000-0x000000014015A000-memory.dmp
              Download

              memory/2852-464-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/2852-219-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/2852-223-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/2852-275-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/3048-130-0x0000000000400000-0x0000000000546000-memory.dmp
              Download

              memory/3048-249-0x0000000000400000-0x0000000000546000-memory.dmp
              Download

              memory/3488-327-0x0000000140000000-0x0000000140145000-memory.dmp
              Download

              memory/3488-171-0x0000000140000000-0x0000000140145000-memory.dmp
              Download

              memory/3544-439-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3544-238-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3668-34-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3668-28-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3668-33-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3668-26-0x0000000140000000-0x0000000140158000-memory.dmp
              Download

              memory/3668-129-0x0000000140000000-0x0000000140158000-memory.dmp
              Download

              memory/3684-175-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/3684-337-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4012-91-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/4012-92-0x0000000000D80000-0x0000000000DE0000-memory.dmp
              Download

              memory/4012-210-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/4184-463-0x0000000140000000-0x0000000140175000-memory.dmp
              Download

              memory/4184-262-0x0000000140000000-0x0000000140175000-memory.dmp
              Download

              memory/4496-140-0x0000000140000000-0x0000000140144000-memory.dmp
              Download

              memory/4496-261-0x0000000140000000-0x0000000140144000-memory.dmp
              Download

              memory/4512-103-0x0000000140000000-0x0000000140159000-memory.dmp
              Download

              memory/4512-21-0x0000000000540000-0x00000000005A0000-memory.dmp
              Download

              memory/4512-13-0x0000000000540000-0x00000000005A0000-memory.dmp
              Download

              memory/4512-12-0x0000000140000000-0x0000000140159000-memory.dmp
              Download

              memory/4664-331-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4664-274-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4664-159-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4900-225-0x0000000140000000-0x000000014017E000-memory.dmp
              Download

              memory/4900-112-0x0000000140000000-0x000000014017E000-memory.dmp
              Download

              memory/4904-65-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/4904-71-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/4904-73-0x0000000140000000-0x0000000140245000-memory.dmp
              Download

              memory/4904-187-0x0000000140000000-0x0000000140245000-memory.dmp
              Download

              memory/5044-38-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/5044-39-0x0000000000E60000-0x0000000000EC0000-memory.dmp
              Download

              memory/5044-47-0x0000000000E60000-0x0000000000EC0000-memory.dmp
              Download

              memory/5044-49-0x0000000000E60000-0x0000000000EC0000-memory.dmp
              Download

              memory/5044-52-0x0000000140000000-0x0000000140135000-memory.dmp
              Download