Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    87s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 09:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_d2b0f12842f8237d491b6367c0252790_bkransomware.exe
  • Size 1.3MB
  • Sample240526-lrmsgsea7w
  • SHA256 8f705070f23aec08dd11f99a26c9d9bf8a533750317450c4be2ad0dae49266e5
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_d2b0f12842f8237d491b6367c0252790_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_d2b0f12842f8237d491b6367c0252790_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:940
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:4428
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3928
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4744
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3108
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4368
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:5024
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:5076
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4288
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2612
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2660
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4856
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2516
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:1424
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2916
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:920
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4696
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2900
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2408
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4108
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1400
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2488
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3324

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 1130b674f4d031bf2f1c0dea9ae13a21f4f72a86300e97c45d9c57f6cede1d7a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 b4b2dd8f41646217007f3da7f0700580fcacbf6cba70036ce880757dd6a033ab
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 2d660fa081bbba2eae2e61529e666fa5d75ba682a40123375bbf8a7e9552e1f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 1c6fe5b11ca96c5fc799e66e74fb3497ae5acf1fbe5bb8940b55154f731df3a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 5a9bbf50b362b72835fbea053e3c78f69216c2121bc98b6d63cd9a173b802b46
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 2c547b7a841cc7e6a98bd91f976fab4da6bff881ddaed5b43ef275f226cc2a53
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 ca85c6e5ab66ea10e3b5a168512360cd1392492d976b1ea8126d028905b01f13
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 fe206a955a07dc7692a3f09028a9c12eadd4b37f8437ba5d3fd66bf924f0a32f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 ed80edf0e8da8bca9568bd05a5a705711578b8f0c6fddea3f07f6101cf403007
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 da51849c36735dc652c0fb490b6e70fe8483a547d452dc2fddedfa8ece3fa9fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 dfbd51d0a73edcc60afd74bab68497d924291e5a37644006322a1bb7a1c5c5c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 063db2f3864d1789ea6f35211e8dde8c6daef64e2e6d26aabbe5aaedf4dee356
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 97d5c55055f1da7af8615d31cf5a5ffacf15da7281492065b38e34f4aef94d37
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 fa1a008609885e9efd069f16a523e6aed98d815b6be1560052438eebc8184ccc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 24d2268616dbcc617b4dd3bdb1395ebbb2c1e89c1132d855364524c31cb52715
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 f4aba186add40dd29fb60f63a43f1b8c97ceb27ea0c953921306d0503f111052
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 9c78abe8984b32e539f46abfa32fee10246e8cd736e8e79001ac9f93a03fc284
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 3cd427cf55e96f36350ccc65b3d8c2c400c61a96bf9bdcb2ee05fe40361b026c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 4821dc4e744ba36ec5d80bddff8c4e4aeab8687bd3711342f206166559ec9b10
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 af7fc29f5c075d58ae07e0d217c61710f8b11bcdf523bbdbd250e26106d36049
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 345654102029108c7b019371e658803b6c4b2732faa364206f110321eace1dad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 6eb37a52c648de101a1b7d9d85dce8b5f2e4f3850417a1bd75019704e0dc88c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 8d6f3860b0dd6581f1899437f2abb633e3d2f2cd9e95f2be66eb3e7dd0c90c8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 ec0877037d6ac5bd95cd2b4f448d310bcdbee56fc83be8b3fa429b52722a3590
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 f905ebb95cb5fd843aeea84f1ee6f5132bc5ca016902671f5b4c8f8e0a7bc0d8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 f7a4474a8bcaeec931fcac3425a6323412649a13de49a074ff5281b371632d19
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 91ec2ae2a6e13efca5b9ca36f5d496d460e945a12c3b83be1f4e3d228d4edce6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 7bc9041e58e2244d75cfb879b1242682856507b26d5f0a9673299a3f664e8bc4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 b5f405459faa9aa111867169d1322637b453f32cb390206592ed9e0b5f823c4d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 a1c952d409f19087f6f5f5c24b53b39a102691954cf5576fda8182f7884ec94b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 56e75ec62c65d569ff1eb7c0b8819c7a8244f46a0230d9f0b2320e6d5694ba58
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 77aa8f75ad0a09eb09b6c8a47df6964ecb3082ca96b3f503c38140cb9999a5d8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 7506611a25618bf05156d8d7c08d2cefbae7dc7cfe885e7beeceb152bff6f75f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 7e0c6e7dee85628002bee47e6609703c6c3a8167c49f8cb158b1cc4b855475a4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 984386a2625509579179a3a6ca31676820cd490316266b5548fe8990a297ad40
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.6MB
            • SHA256 004fba680d288a054e2521cc588ee2b0483e53681759e8782ceb83f5aae2284e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 438426bb33e48ae7ad5f02a9d487cb01590c57204c07565d47e212a780b264df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 12fd7cb226f716705119d71eb57fa12768e2522d87674297a9a6d6e85b7773bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 d65d2836465379141b9deb9739f6a04e8f8296850b57ae661425302325d132f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 438ec0f6265de3fa548777dbaa317b486c88e25eafb572ba7f2f5a5c5cb26603
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 76b3c4b4076dfaf2e744fbb3740f3990313f2c4d97105e0a925303d27663394c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 da85d2fa0e4bd792461a55f5f470a434d4126277e6165e2580bd12b67e1e6628
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 078052e0d08e0bfe3bd1698f84b26b7513ae707b020900dbecc14be1ac3a5200
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 92628e431ce507e397295ac83fee1901141370975077c6104ff9796ae78982e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.2MB
            • SHA256 899a34ef31a00dde33d1eed6fb538215abca1095c5eba1b5ecd6ae637c0df7e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 464293bcef5153a9be23809e2d2f852e064179dd7a997a56bda9e849aaefc0f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 ef0c69aa49929b17ae9fa7cdb9c7004259d5f03b80fe95d69323fb017fb106c9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 d53288177a42103bc7dfbeab6cf9a67a5ec09ee9ff392c003a05d33b296cb039
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 d5fd461414d51f0fc30770dbb957eca37fee3396ce0af12713468e67f92ea4e1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 1999a2c8908b37c909da8e7c4061fc9e9452e8342769547a1c2672bca4f33bce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 39f8bd677400d84b1385a38f5ab58f5c7e54b78bc3248748bd093bdf73d8f47b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 1a889dd7a6aef20be678b973bd252f45c8a89dab8a5057cd914f4193a9d72f57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 1e936b79e22b6c71786164ca4c5b8006dc1415f6aa7f37eeed7c8d944c96b3dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 2b0732115fe2884e8ea926d40f224f82b2dfa1459491fc83b25d9cd50b13f743
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 bee8f4d5bacb490df6d9c917ddf97c33bd0dbd56f27c9baf71db6ff8cdd44558
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 c10e37dea72c29af062e8c7f9689c0aadcf92584d0ca748a8a996cfa5828a2d7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 176578747797f4fc9b952c56d33e53956a5f1ed0f48a626699cc378df3172f07
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.4MB
            • SHA256 ed105ea99c6b7a15bbceecd5e631a956d6b5120edcebbdb10f4a32e632993015
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 d6ae6813271036d88aa50b1ab8c2838644ce03b62e9e0c8612d5f4b66788e297
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/920-306-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/940-1-0x0000000000C00000-0x0000000000C66000-memory.dmp
            Download

            memory/940-8-0x0000000000C00000-0x0000000000C66000-memory.dmp
            Download

            memory/940-71-0x0000000000400000-0x000000000061B000-memory.dmp
            Download

            memory/940-0-0x0000000000400000-0x000000000061B000-memory.dmp
            Download

            memory/980-61-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/980-45-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/980-38-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/980-39-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/980-59-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/1400-311-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/1400-560-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/1424-304-0x0000000140000000-0x000000014012D000-memory.dmp
            Download

            memory/2408-308-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2516-303-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2516-502-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2612-266-0x0000000140000000-0x0000000140142000-memory.dmp
            Download

            memory/2660-267-0x0000000000400000-0x000000000052E000-memory.dmp
            Download

            memory/2900-307-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2916-305-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3108-49-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/3108-55-0x0000000000C80000-0x0000000000CE0000-memory.dmp
            Download

            memory/3108-57-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3108-520-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3928-439-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/3928-33-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/3928-34-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/3928-26-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/4004-561-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4004-314-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4044-208-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4108-310-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4288-265-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/4368-73-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4368-521-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4368-69-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4368-63-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4428-12-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4428-90-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/4428-18-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/4428-20-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4428-19-0x0000000000730000-0x0000000000790000-memory.dmp
            Download

            memory/4856-268-0x0000000140000000-0x000000014012C000-memory.dmp
            Download

            memory/5024-82-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/5024-88-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/5024-76-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/5024-75-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/5024-86-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/5048-309-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/5076-91-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/5076-92-0x0000000000CE0000-0x0000000000D40000-memory.dmp
            Download

            memory/5076-559-0x0000000140000000-0x0000000140150000-memory.dmp
            Download