Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 10:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_5f215d669ab31c88607c8c38a67e2f05_bkransomware.exe
  • Size 1.3MB
  • Sample240526-mpgdcsga87
  • SHA256 9497a0cdd2fb22f34e25c5497dad0f04eb37dbe357cc9ba978f18c3f8a7121a1
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_5f215d669ab31c88607c8c38a67e2f05_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_5f215d669ab31c88607c8c38a67e2f05_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4224
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4848
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2900
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:824
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4028
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3960
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4980
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2272
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3448
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4480
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1380
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:864
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:3516
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:464
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:2912
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4468
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3600
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2332
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2580
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4556
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:668
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2140
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1768
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:564
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:728

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 dae8ec57f6527ebf4d0c7ba78e4dced87426c1cfdfea0e6d44b7a0b15b4d4e29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.4MB
            • SHA256 79b1145203c0473d9651e3feb0b5ba91a6a2de5799bfdf8a8b81efba690edefc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 18f7aef2f6b0f7c549d8d141110e577c2b2f8418f85adf66da71603a174d9ca5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 8bd79f85352a107427bfa03a47a966719dda5dc9a9bd825f4ccaa18feb9953b3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 024fb11f8b8213da552766c7be0d979439a74c7b30e3c48e1de65c7716eb1a5e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 f4426ff336be5777a3563258fe7868eecefa7777e9e8ef5c5ac010833621b451
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 44daf902ba5d86d8553d2e3ab83a2e06a30b5dde7dffc4842fa790273dc6c3f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 8b653c441eb6182fc0a6e1bd81fb2c67993d5736529ee3ca801c2b677c95863a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 942f26a73f84d8f82a1daba41de13c451137574058c5060b1368caff8f6ca49f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 422954cbbb419781f39565c8c1f550e387fd9d1975d997bef8ce5627f143186e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 893798d2d7bdb65cd3b57afb37f3d042881e7cd70a6a102c4c24146d5bb2dd75
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 e1911a3798ed1053d6c6aca1caab45d88129e254b64f5c05c2d230bf4f70822b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 54c69f6e745806b463b7da5f19698e9ecc04bd1e7623e0a21e150bfa66a54931
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 ed0d13b542f06b2fa87ff606a6efa3cc8c3ee82682d1873abfd0342ac2c01419
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 be922507987dc5e499051f1d4b4a6f03117b2fb6da7c0a0a4d16029d1f03c9eb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 4f8851a0b905fa1cbc7955baf199644f9746c2ab5f58058e065b5fce82e53eca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 343f5eb6506541f87ac9f208a2301b7902815b6df8a587077104b7d2485dc3b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 a43893a3e3fda7f8309b84ed203222138f6002b0714d843a11c96061b9e4ade7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 f178430005ffdab689973f14a11c41e050ef3917026aba2d06b527f9add64d88
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 c236742385a04f0d70fc53124625fd639d4d4009058e63c5739995be9c9ff6e4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.2MB
            • SHA256 d0bee3a9cd8640533f4178401d49fa7e088a1b0b69a4052f882bca65efb7243c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.2MB
            • SHA256 f013bb4da29dc2815dd3ca2e3eb7cb08478eb03698aaa848ccf4fde06b68e4d2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.2MB
            • SHA256 cf31200cba914daf53a439dc406b8bccbcda724c06bc6e3f107a7814ac5975b3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 991bf63554c8410515ef0cf59fc2f8c37b7569a170e52d4d87c7eb130f339701
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.2MB
            • SHA256 dfa664794d80e03cde0297676fce7fe287997b2801753d32392f31af55068dc2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.2MB
            • SHA256 459f99dd3eceb3df7bd3acf024a030c38b291b4ca6c25f56caa404098d61e236
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.2MB
            • SHA256 997e4b592736f3cfaeddeb17a869d87e85d464bfed2600b0a2676716f7c5762b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 02e1c3e97f25cd1144c34d53b8a96ca0d730e904f95358f0702b93199c85f993
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.2MB
            • SHA256 f9846ccfb4dc14e2bb899c78c9f671bed4bd4a794f46cb7b0ca0040aabfdd100
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.2MB
            • SHA256 7cdeb1f0a565ada811e34b2bfa7e05adb58cfe0ccfca5d6f73db291d9c2383f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 14d16df90edf30b82ef0f60294534903a36e44bede59c4e36b49956a1ecced33
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.2MB
            • SHA256 b1ed42f5fdb556cf19482a25ea6d7a90bf493acdbd4826170e60e0b21a8f1110
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.2MB
            • SHA256 a63100e422ddd5a9ebc85a24eb5de9d8185ab08a4a82fca0111e619e3b3a6c8d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 5bf085691ea07cbbb44f45a5a9c9c252112abcc98e0b9dd2b43eef166c9a51f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 1fcba6a87ed60fc3e2453131ccec683d64b42a65fb5f49fe6c27b25cb15c877a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.6MB
            • SHA256 09443d21bd3887a6266638bd851e94c0b1d15274f9b6518476ebe3b9f438bb6c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 e303052494ddb3386a694839e34fab163dc86a41e2bd44946bcf266da45fcdac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 febf6fd5c7ab1ead7fa72ed7f4713bf0da829f6f28b2bb2442c8ee5e24ef521d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 35bdcebbf40ea5c678ac522262f0a1c9d51edf34b990d6492715f265007316c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 338f78e62bbcf89e2d7ed34970351618907aed1b8ddf4eeb4a0c94a831129096
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 75415e218198e57d0d8ae27b22c17bf67d3c6b1fbef92a4937a0b846c3a9d133
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 9be4bb6dc17d29717c06cb985ec2368c394c3dbaa560514cef8a7eba1602b523
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 9c101273b0d79381f9839ed6d48eb323339f43d6e66ea7c898c7bfde4982fab2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 1b27e583ded5770d3f4df992dacc295e3d7df23ea3162f10c3ccf4dee22301c5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.2MB
            • SHA256 0fd74ddfae7b8c94f52744f856e5be295710e7d989da044dc387a487c280ca7f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 4cbf7ecb0cc7b829ddbccd40646d0d61a9f85f2f20456472aff094c83b41a5fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 0989029f50c5023ff5cc0a69c6c03ff0d45df98e213080874a0a3643450a44fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 9752e108f998d68d8861fb5e69412f2fd5576078cffde4ffaa42a737a40bc8d0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 208bc3063a0e3b8d7a9c83b5038dbbd77374baf7e02315028982732cb10ed73c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 179ba150cb123f2fdf5dc0aaeb7b43ae130fedc6019efac39b4552d69dce9373
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 02aacf5c61cf36104b58f12d0a1dabb5a650bac9f93b431e85c817818125c34b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 3eea8cca28f2e99d6939053169156d655b7770ede95c21b1eda4a80a6d81e70f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 b27b5d73236b0e4e293e7eaa0852a027793843e24922e761355173e88934e730
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 27fd3a2b5b2fd0b2c786355170ce739290cdd86ebe12dd2ce6f48e8b2bbf5988
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 ab0adf08a1d5fe5a3cb4507be5285df6193977fa8c6adcf55c5044fc6e60aa53
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 3a3b65acdbb2a872627c574142681ff4c3d553dadae5831e15f08a60cd3be2a1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 16baa6066bd036478658939bf13d484cdb1624042f89dfeb24cd7824aa8617bc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.4MB
            • SHA256 68814d4f18168ec23b004956c59f272aeb951821d07a109aed0214034fcbaa80
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 b33147b30aab329fca097a777b00f3de8ae2aac49e4335e8dbc13d77cbdcf872
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/464-465-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/464-266-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/668-271-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/864-262-0x0000000000400000-0x000000000052E000-memory.dmp
            Download

            memory/1380-260-0x0000000140000000-0x0000000140142000-memory.dmp
            Download

            memory/1424-275-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1424-542-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1768-274-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/1768-541-0x0000000140000000-0x000000014015D000-memory.dmp
            Download

            memory/2140-272-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2140-540-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2272-68-0x0000000001A60000-0x0000000001AC0000-memory.dmp
            Download

            memory/2272-80-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/2272-78-0x0000000001A60000-0x0000000001AC0000-memory.dmp
            Download

            memory/2272-74-0x0000000001A60000-0x0000000001AC0000-memory.dmp
            Download

            memory/2580-270-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2900-25-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/2900-32-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/2900-468-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/2900-26-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/2912-267-0x0000000140000000-0x000000014012D000-memory.dmp
            Download

            memory/3448-85-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/3448-256-0x0000000140000000-0x0000000140150000-memory.dmp
            Download

            memory/3516-264-0x0000000140000000-0x000000014012C000-memory.dmp
            Download

            memory/3600-269-0x0000000140000000-0x0000000140199000-memory.dmp
            Download

            memory/3960-47-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3960-48-0x0000000000C60000-0x0000000000CC0000-memory.dmp
            Download

            memory/3960-538-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/3960-54-0x0000000000C60000-0x0000000000CC0000-memory.dmp
            Download

            memory/4028-42-0x0000000000A00000-0x0000000000A60000-memory.dmp
            Download

            memory/4028-45-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4028-81-0x0000000000A00000-0x0000000000A60000-memory.dmp
            Download

            memory/4028-36-0x0000000000A00000-0x0000000000A60000-memory.dmp
            Download

            memory/4028-83-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4224-6-0x0000000000AB0000-0x0000000000B16000-memory.dmp
            Download

            memory/4224-1-0x0000000000AB0000-0x0000000000B16000-memory.dmp
            Download

            memory/4224-0-0x0000000000400000-0x000000000061B000-memory.dmp
            Download

            memory/4224-466-0x0000000000400000-0x000000000061B000-memory.dmp
            Download

            memory/4468-268-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/4480-257-0x0000000140000000-0x0000000140166000-memory.dmp
            Download

            memory/4556-201-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4848-20-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/4848-22-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4848-11-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4848-467-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/4856-273-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4980-64-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4980-259-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4980-58-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4980-539-0x0000000140000000-0x000000014022B000-memory.dmp
            Download