Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 09:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_ef7c6acf4b367a04a8031afadea521ea_bkransomware.exe
  • Size 1.3MB
  • Sample240526-ltrt8aeb7t
  • SHA256 4ff3b441cabe03d3e271560ef32e16140fde6f0d79d1f02cde00e7ac24ae2f23
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_ef7c6acf4b367a04a8031afadea521ea_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_ef7c6acf4b367a04a8031afadea521ea_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4948
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5064
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4588
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3500
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3628
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2828
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5088
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2312
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3012
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3216
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2500
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4508
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:212
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4416
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4600
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3200
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2780
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4584
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2628
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4748
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2280
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1580
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:552

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 85a8a502cea0a31c00d94ebe40eae32600a9986554f323cbf6af215b3e403866
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 bdef4929f465e53927bbfe7ace57a2e1ea7a8505b58dfa4226eb268fae75cce9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 6b176e4f161d4fb11dddbd6c987b683aa4b78735f0c4fee983b3ae45491fefc3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 e944ce4eed6c76341e9ce37281e1bf1723ea9757bb8cffb760ae52f2afa06356
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 d7ea8e93908d1b9f7a4982d6deb62fd564b3b741919eb362dd5c7d1a2ac2b216
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 e75cb8acbea3d27b3fea57717b3fd7043026d173a4e8ad19b4a0836e3a175a5b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 a52ecf747919e326dc3ce635ce00092abc8bc83a06ecc7baccdf72afe56cf1d1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 a11f419c15a5db4246e6a41e06315416b8b27dcf66f8d8da3fa9f8cbd9e6f526
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 8ac7723a267c5393f040e40f31eaabb862a17e8a0352d77f0a34411010827d51
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 5ec550e983c71ca95af5527a9f19adda5b05d10abe2b6428e839863f6c539ab6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 12bc067f2d795c982da56aa0a96bba5edd12c95cfec70da8d3359d53026f9d82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 ceada8a974815362bf89a43c24b9437c4c6bf5828584dda183edf45b654b9ac8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 33224dac3bb87b588ea27f8c01bf9435099951f603813a364ef0ff8eaafc1137
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 bd0aaf29bb31f64c5cac454e89b344aabfde1cf73d9ef41426bacc975d67ddb5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 1487cb126a3119538d4ea8ad3770ec19834d9dc208ac7dd8985bba593d5c7312
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 aea549de9d1cdcb66b8aaddd0589a2ab355b25b5190d76f8a20ac2bff840df95
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 290eedd7045d49ce598a0ba1c1e38a700832a0be3561b83fcccaea383b6b1d83
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 bb3e5ac198172d82f271e7591ee2ba2d8f9e244ee68dc316c2f8a5444d9810e5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 149e803f7e3e5272c1bc94b68d8a8a84d6f2b3b94d402f31eaa861e332c75882
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 12d0e915cf15158fe57444d48a0369d57314275f0b0bfb4cff222d6cb882962e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 2ac369f4dfe5a0b3e405702c8434f106ebe8e3dbb0f18e90751601d8901945f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 513078f7bd445110b1ccbfd6008e712e187de6793bb5cd371042b23f9a7c570e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 682a645814630c284c005094d79135711ddb340d289b56a2d90e7ace7180478e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 188687a64f0d4502d614d0b930f3b30b5b2b52cf11f5b8ef9aeeda95e96a8903
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 8d8ad725a664ba995eeb91899d00ddb1152c94ec711aa173b989cdc1847baa85
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 95e81b269f1403e7dbcc4d772b513308715ed2654afa004220332eebf6d88ce0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 9a5a17e4e41cc988b15e3fb453a6e28f6d78c949e7c7c9030059ba25ad38f3e0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 c370e3d3a30814a261c9c449a976b9a8d22717d619e6efabbc7eb35fde3fdb82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 c2e994789a645cfaa8e4f836ae3bb9a55c85dabf0664780fecfb6e413c901edf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 a8010a6ad8bef7e8d46851de3f0aa06009f9ebfa99d4922d6582a88b41cb0ee4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 ae4d9a03754576429f88895a651d96876fef8cd1c468950eaa93834401aa2240
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 025c2dc96b14d77466c1c029b1d4379bd0b725fdbcf3af210ed1792fdc26276b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 fbea113485c0ae101c6bcf91dc07da45f800ffa6b3172839dd1078893dcae5dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 152730811e8990b57f2f3f75231f5697a3595ecfa2d77fdb43f5e6accc5ddf4b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 bb3865f972b580ac57c1b92c55ae8e429dfff9012e1af49185de73c55e3e1923
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.6MB
            • SHA256 be09f2024b17aeb8c9aa940c7ccb1ec5c424939756526df07dd0478b3392934c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 05ff27d68c43af79e77813fc74ed356019a3e4491e3cbf749e61e799e3117ed2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 939771b02fc4bbd8f1c0961752a33d0fd7c4b54b2834b11ab6a935ac384b249f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 f0a4405138fed8e7b8abdec4d15804cf44679d15dbdcc8b070b03ccc35aae690
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 3a562313c2fecba655275c77e59962acef84df622fa9fe6a31fbd2ba8b6e7761
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 5cba534bc76be9eaf75c28bb76765d4706c008ad830c73de8f1ba5fcc407a02c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 ef22e7c5599b0ffa33168a4618cfb513db4a91b0844a02e4244842c2e88908f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 b4086cf09926d45b5cd289c5808358bfe501b06d18482841cfb41945c2eab4df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 7a28de8f1e9de7f2f13200fb54446864d6d48c2852793e861a2439f28244b2b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.2MB
            • SHA256 7c53c8e5d8cd6bc7cb7bcaebbe70636e813d637b5c050461da30ca4d64b392de
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 ed2c79baa8381f2cd2518108043ea36fbed6e324933d635cf5b46825cc334d51
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 3510a834bb3c722d8928c5bdbe3745decdd38d89c1c515adeacc50b1701eab8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 6637ee4038059283fc43fcbc0a26b36e30b779c98cde8c1edde292472cd8c9e1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 2fd30b01ca733dfcacc50ebed0422c7d75a85377ff8cdefeb84fa595298bc38b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 def1d5764c5993cbb35d7793ec31795fd9e9ddb11a8b3be67e90ebae1a77525d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 db117789746f419d1c20064688b50588d1bf7a449ec1b75ef67fdeabacbd1d51
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 597e99e5c111e090ddfa0d4cf21447919ea596a86d6ffbcb7a566a4df18f5226
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 1f1cdf1473eef1964aaf851bb515e3b5fa5da8c180247ea99403446d03e53638
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 9ef378161da462b173a7e90891e2446be39a212ecb291dc775be6e5eacd4d824
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 3fff3e4a6af475f2317bec3ae2e12c45a38c769c824f8161d2bf1281831c12b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 fd6d75d91f2ed7a68238ea9feb5b82218b61210f69d25a14c33fa3f5511d0fe1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 1cdde793bc9f77560062bc8c09a58dbebce7ecab80f516e525d53514ad361160
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.4MB
            • SHA256 f6af9c897a4b19d50bc636e73f0edeb7ba1a8c1aeebec440422276351a1663e3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 2e29dcad2a2c4e01dd54df1e47ce34dba96109436c776d803ac613e3b93299ae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/212-264-0x0000000140000000-0x000000014012C000-memory.dmp
            Download

            memory/1416-273-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2280-277-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/2280-513-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/2312-73-0x0000000001A80000-0x0000000001AE0000-memory.dmp
            Download

            memory/2312-87-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/2312-83-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/2312-79-0x0000000001A80000-0x0000000001AE0000-memory.dmp
            Download

            memory/2312-85-0x0000000001A80000-0x0000000001AE0000-memory.dmp
            Download

            memory/2500-262-0x0000000140000000-0x0000000140142000-memory.dmp
            Download

            memory/2544-278-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2544-514-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2584-266-0x0000000140000000-0x000000014012D000-memory.dmp
            Download

            memory/2628-274-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2828-49-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2828-509-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2828-50-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/2828-56-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/2932-512-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2932-275-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3012-260-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/3012-89-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/3200-272-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/3216-261-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/3628-59-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/3628-70-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3628-37-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/3628-46-0x0000000000E70000-0x0000000000ED0000-memory.dmp
            Download

            memory/3628-45-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4416-265-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4416-505-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4508-263-0x0000000000400000-0x000000000052E000-memory.dmp
            Download

            memory/4584-205-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4588-26-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4588-34-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4588-33-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/4600-267-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4748-276-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4948-1-0x0000000000AB0000-0x0000000000B16000-memory.dmp
            Download

            memory/4948-6-0x0000000000AB0000-0x0000000000B16000-memory.dmp
            Download

            memory/4948-441-0x0000000000400000-0x000000000061B000-memory.dmp
            Download

            memory/4948-0-0x0000000000400000-0x000000000061B000-memory.dmp
            Download

            memory/5064-502-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/5064-19-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/5064-11-0x0000000000760000-0x00000000007C0000-memory.dmp
            Download

            memory/5064-20-0x0000000000760000-0x00000000007C0000-memory.dmp
            Download

            memory/5088-510-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5088-82-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5088-68-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/5088-62-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download