Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_9cfa7d060233aad4200b96d2c62e0f21_bkransomware.exe
  • Size 1.3MB
  • Sample240526-egaa3sef97
  • SHA256 40ac98e4ce7096eccad62cc14e4e9964e8851ced2fd85cd2456127f5ed52d180
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_9cfa7d060233aad4200b96d2c62e0f21_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_9cfa7d060233aad4200b96d2c62e0f21_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4296
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4032
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2920
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4992
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4308
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4452
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1644
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2484
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4520
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1128
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4796
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2632
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4124
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2792
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4540
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2324
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4092
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3176
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3956
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2924
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4572
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:3316
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2996
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3752

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 226a004467973e4c5cec3875653c40c5e91236c9c457022034d03102790d958b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 614acb13c94af7a1be6c2893b87bb89713213158d8961e771c5df00c1ace614b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 e452d51ef2976b75632416120dc5516485d3e13f61981aca2ff4e43b21072f57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 1d0c0b232bfb83fb8d161dd5e51c4b9cf3498d0b66c8983f6d5a1cede06ccf12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 18daec7ec510aa31b1723ae18001fd02f37bddc579fd9fcc8e0a0c615af9c333
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 b029f3cf2e9a27e667ef986133d34ae0d70fff70a946fbb43e4666fbb6bc6e44
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 567941581cfc6f462d5a0f73d9ee320c6820cb46db310e0fc018788f731fafbd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 a976847769ca2b68f2a4d41ff4c8db7372aac16592c0366567739be77a5d4f03
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 af524e11ea657ec3b42b5409cb0eadf67ec8b18ceaf65f996bb396c9b57dbba9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 769e5b3b5e2bf04ba2762ca89d47222d0b7685c3bbe00c3ce50d82fd93639000
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 24a69f4d1947528314dad789b09b03eb5bc081787b470a9718688566bc184691
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 b192c8672980ab817d73f35529a29f5f77af69c9099ac8fb1aca10fa58057cf5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 803f64921a7723dda4f183456ed97cae3bc39d7256236ac83515fb91e9084310
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.3MB
            • SHA256 1cd4a4a14233f2e376ccdd548908940d2ebdec6a9ab0dfb4772c3261bcf9a600
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 38e6c65df9edef6ab71a1a8c961f5f58e5012b1de821a73203301ec1880d28cc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 04f2b7f5138901d0d4ab407276a01ef992593b23f7f33cf5cd1278742812d879
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 a43f22e32cc6910d940b9dab9a4c47a25d2c56a7c5cbca10b104141a90d06fc7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 8d051c491217cbf2cdaa0183d2ba51795a6e8ecabc9d3158892ff224a4177b69
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 d13b8f4083fc6d3024fde107ea4c1450024f845c2f65b4b786a4dd5ccc8fdf9f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 9b05045d40648496a1ce535da8e75b95d9f1eacb4f48169ee44c8cc37f5e8839
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 0274ca9e71dea560f36c277a521b022b8a7d786333cb967a3be0166944c2b669
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 24a324bff5a1feb278b8c99f8be6aa71544c2c2437785e64c9ab2c9b39edc1b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 73e2f0764c65a47502bb8e18eb389e409e5135da33acf580f63f2524ab6cc259
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 a8e01288c96168de4251c761396d3993bfc79120b74bf7164d9c4a22dc8a1625
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 e01f97322ab19028e9339598ab36ec7d53e0f786e715b4b046f8f4f437bb5ac0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 8a58cffcf5e721be8fc7cf6c751967596a425a72094b1e76c37a00c4b0094085
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 0c844c27cabb187bd35bd65c764fe046f0bd14ba8e23fc349ad7b9d61a32a9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 492730ce3ae9595f9abb35e1059791491b08a199350f081ace2e5de8dd86c08d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 0cc6f58815ca71c6a00b9aca2d05a6ecab3443d5d7aeefaca082310baf15b908
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 e3e9bc2483b7aecee7b27025a46d9a9a41c7c051c55c96392d5c91448f782251
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 0511f23b510f1c99e77b54c03bb12d0401a9a422440791aca36d12397f434379
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 fcc2debfcf4e53aaf395324486b441dc49df4a26df72ee2976846009ceb0eeef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 b39deafad71e111ba8d0bb8b018cecc23e2ff8c972afc60eeb563b63b8a1bc91
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 14faf3e6f2be7a24d86f9c9b5f95e80ceab7f039a721aa32cd9c9182c6d1f7f9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 a1f1f90612ba145f9ed645811efc4d5dfcaeaf238ebb695e3459c14891806313
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.6MB
            • SHA256 174faf50c5046ddad3626346b86f4e71bb4e3eea5c8b7ddb6cc19ebb13686603
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 c73698575dda71aa443e6179ba6eb4431582ee174abf868bb04d7af3446ed9fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 75124fc46aaf323ad94dc284236e7e5bcc89402372f92a59f05ee093effc4bfe
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 e6e6385973cbf877e8aeb7d7a987975b6280f82b72ced5ac4510fa4c1960fb1a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 fbd9417b87a6dcf002cb13a22251c09f7d3e2fd6ca6b3bad6aac03cf471d677d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 6e1a24a52503423c8b1adec10391ab9ae450e29d3f0296cd50143d975317119e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 8633c45a204f79dfa496d09cbe07890e6c94d9dc749b57b2197547b67027ec99
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 6da543388d4b5fc3b923000dc4b0225cc3897a52365a290c64c90ec623272f7f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 084eff986d8ef38b39a765f94a25f49d89137adec2647206c26c2b9f97ceb403
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 0ae808ce08337b4eff53a14fc63d32103a856e73ad20566441f14efc09fc9d59
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 c7a80c1c40f2304501978025badad1a1b8a744f69c3dfe2de7d3d93361f7efc1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 db5663991d53a60b53fd2055831a03462433e8f50f1adada3bb1b8802f5b3fcc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 48e3eb21c8c19630bf639f909a3c293e9637d5d35c515660b2e523ad169237af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 a272488a5214870083520b6d8e5b5bbac51d89a3cb853f18cc72836a81ddfa2c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 82890ebdcda65cdd8d07750bb8e8d0a1b08d21ff475195080779cb3b2e8ee4f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 6db200da919ebe50a42a77d598bebaf814da937ffbcdaa9d1805d6f9cd35f9ef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 71e4dc1c74970933dc2236ffa2ec73c2fb9c0b93f8b3258470c6b8a8ea86c27c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 4b2a619f01221a108d16abfc20fa9c53b6f1e3047bc5b406b763a67e5f4e5713
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 3e0b6a11bddd2840dcf3d7d721053407ea73a851c798f3e480a2a9a14c672087
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 1339bcdc2b2d92a3a7a85c2a18f4b7e2d781a9ea0f1ad2cfcf0eeba36300b037
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 daa11dd33e77e9ab5acba27b83bc639dd5885084a43482b042cf1a7c291121da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 6b3fa371e4bb7e420c063e65f081ac257ddf128de142f3bf2a8e493cb30d2219
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 f6f0d9458bafb174e246ff185fe632477329ca495e7258fd551bd8be63190e29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 4301eaf1ddaff0877b3c8ded95cc4457d5d404a69db463a48eae9589dc2fdc23
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1128-124-0x0000000140000000-0x00000001401EA000-memory.dmp
            Download

            memory/1644-83-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/1644-73-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/1644-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/1644-87-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/1644-85-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/2180-59-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/2180-38-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/2180-44-0x0000000000530000-0x0000000000590000-memory.dmp
            Download

            memory/2180-37-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2180-60-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2324-305-0x0000000140000000-0x0000000140241000-memory.dmp
            Download

            memory/2484-89-0x0000000000D20000-0x0000000000D80000-memory.dmp
            Download

            memory/2484-98-0x0000000140000000-0x00000001401F8000-memory.dmp
            Download

            memory/2632-269-0x0000000140000000-0x00000001401D4000-memory.dmp
            Download

            memory/2792-271-0x0000000140000000-0x00000001401D5000-memory.dmp
            Download

            memory/2920-34-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/2920-33-0x0000000140000000-0x00000001401E8000-memory.dmp
            Download

            memory/2920-25-0x0000000000690000-0x00000000006F0000-memory.dmp
            Download

            memory/2924-307-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3176-306-0x0000000140000000-0x0000000140221000-memory.dmp
            Download

            memory/3316-312-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/3316-509-0x0000000140000000-0x0000000140205000-memory.dmp
            Download

            memory/3956-208-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4032-12-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4032-19-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4032-17-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/4032-267-0x0000000140000000-0x00000001401E9000-memory.dmp
            Download

            memory/4100-308-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4124-270-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4124-462-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4296-82-0x0000000000400000-0x00000000006C3000-memory.dmp
            Download

            memory/4296-0-0x0000000000790000-0x00000000007F7000-memory.dmp
            Download

            memory/4296-7-0x0000000000400000-0x00000000006C3000-memory.dmp
            Download

            memory/4296-8-0x0000000000790000-0x00000000007F7000-memory.dmp
            Download

            memory/4308-49-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/4308-48-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4308-55-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/4308-486-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4452-70-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4452-68-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4452-487-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4452-62-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4520-123-0x0000000140000000-0x000000014020E000-memory.dmp
            Download

            memory/4540-304-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4572-309-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4796-268-0x0000000000400000-0x00000000005D6000-memory.dmp
            Download

            memory/4916-510-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4916-313-0x0000000140000000-0x0000000140179000-memory.dmp
            Download