Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 10:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_01389fe606a84cf13568d5e33f8fafff_bkransomware.exe
  • Size 712KB
  • Sample240526-mtc7hafe2y
  • SHA256 87fe964d55370485adff6379cd663ed2d203d380f7a367e07ae0b92dc64fe050
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_01389fe606a84cf13568d5e33f8fafff_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_01389fe606a84cf13568d5e33f8fafff_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4444
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4528
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1184
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1444
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2784
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:60
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2244
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1836
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3180
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3252
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:844
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:1084
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1496
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2760
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4236
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1592
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1212
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:408
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4924
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2096
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:5028
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2328
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3972
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1648
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:5056
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3628

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 030410b1ab220d1d2e18c7fea11b72959ad1228e381a2d140e4d34b8e8f88c43
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 8fdc7c6e2101bbf3c07c6b95a91d96607e3be83132e52bd995b3c1e504c5228e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 89e1c752cac271bc352f9904978ea9b8b4e466ed9429805350f15b363a8f4dd2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 d32030fb29b4bb9d54accdaf296da22a3cb6a84c327e09bf5c896650c29c0fce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 183a69bda2b6b1095517f672f05293e855979e8d43c9835da5b6fff34622e2a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 4203f008fd6df45d1c1f286b7f32397a5b432dd816bfd67fab538e5f955c5876
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 9b4e0b7b1f041e284c42533901a22a0d3a64349f9078f88f668564bf5978b71f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 5709878621b13b817eeff2d29f2eefa9109f3afea4b31cece6e6850235891cbf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 2e1d36b4defcfb97a2380bab85e9afa20ebe2ee4e4d5a9e38c6e4a2ba29c9000
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 78b64b87efa2c9d2090ca4325b55f011c37d82ac079fac27c486c44103a6a0a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 c9e962f9e158aa3edad9932d2d71c3da7af6d1eefbe1037ef7443950099a6da5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 0a0948de94922b6406cddc78df23b533cc56916fe6370679c1aa2551786a1979
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 7753267a957c28f512b80f8cfd71665be526efd5ca837ca822c53f8f1633d57e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 47d2d36c8bef72775c50af46f7d525d08cabfc5183f7492d0522fd55e197a108
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 015e8393b47cbad76ecc44090f9529ec7c8bb0bca8daa1d5d1c600389c726ce3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 92eb75ff5eea6486292a06c74d7d15659c4f40d09aa582fdbd9191d842b303f0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 1ab60ab44aba0081dc674cb46caeb36a4e9ebd4bc67cda6a2b852e604ce03a00
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 04548762c3fa3d4a4e04ff3ededd4dac2dcac0f685b491710bcf462a75028068
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 ee4e04dcc9845c3b60a4765882f0f6be4161951783f9d959c1dcca86200738a6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 1ff325b79568380247d3e61444eb7e60f0bfe7ba3ea051f0fa1f6c4f00358b79
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 64ebe7eeca23c56abb9eadb82980069e6fcea18b0f9d1e8b0704f5192b270b6e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 cad02e94a5a94ed01ff213cbdb10dc59ca636563af745f1881688ba79fd91ab8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 39c71fc7a0c62b26cdbd7ece05889d799df26daf0063a29fed8fc33e6c5aa589
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 211c79f24ef0c9422529cc1a261ef92bedb454022c4a7cc1191fb6273695eb39
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 94eb32ccab0fbed007873dd393b00f7a8c001aa9b34cdbdb44d0afb0e0d1edae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 2a5303429ef93778b082b17afae6ecdc028e4a6ec67f454383ceb6d31e6bece2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 286b053b1c391ce07ceee7a9b3ac173c6604841a42a1265a2ebca18227074d8a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 62a7ec2727f287f5d2a62a08bfe08009659c1e2a4c709ff8aae83fc896f35908
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 c225a09f9664d996f49b6fdf2d6f974da88eb5db1ee85c707516334518369c42
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 97ac7c3591af43c25bc3af56df768a43cfec4b84b574f5603a06dc3257a83994
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 d3f4d3be8b4096a46c4738ad285fa66d78ef98774c79ce52ad9f457d3c7176a0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 b17c2bd57ba74583880cd2870213ca3132ded08ab31c6944d484ae3fe3acdb97
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 45f05c3b2695b9edeb56334262b10067e4af51757ee43ed5e0e7b7e26167461d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 3440fd57dd52e48cb2a9cbc95c0f4c5cc92147393d4c17045e020c5c170fa430
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 b45763a0460546c3d2143180f478d0974930999194a6adcb4f7419bda11a1771
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 a85a210f0d7813aa8594bfe670271431aafda69afb4ef135fb31b0edbbb80557
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 06ae39cba430a370e5a66c940a0b401e92f49eea00b9e32bcd124122382f72e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 39840e4438a7c30b2115d412029a40fe4fd9de2cfa1907e2dfd19212cbbf5d6f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 d5659b95690590bd10c8d9beb59447b1c8da2623b33e127e2766b93fe5144b3a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 419f9c571031e4f8048a89f64eab50a37122a1bf0dfa964d6c7dcdfe424fb836
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 5645793e821b3afd27baf0056b92ca0ed7470f623202101d86eb5d87ff53c1ee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 d38dc682c51bfbc5ea8f349d2f0a8ce385290fa6d5b5a50e398dff4a159d8efa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 63e2785b3970bbacbd25274d524ff496164b801f2f90f11cb321089463d595ba
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 2bf9b79b79d1201e4f41df29c919fa4935678119b36c26d1f8a94b37ced7c586
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 1acb196f18f82e7f220459d7558ccdccb32644d1d0cf9e92535a28ef18061326
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 bf73a1acf19af6dda0e484013d99a00156c1168af422a055ad4375292566920d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 423c6258b997b26b00a77d46292b70e0d2207de52d096879efed827da7fe84bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 4824ec08d88ade5cd347a38b9ee7d5007adb431036f9fa06946a67272d0d3e25
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 e66aeeee5f895499b9960f2082597ef492dec27b5a684b88a5a48e03183a726d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 69d8a0bb1513bc4a8aca17e5ec25d9b5b673d77e82b10db8e151169b4a832e82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 af9b216ebe0be7234df703975a36df7c0617214c8ebd5f908d126f340b31c487
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 5b5ae082753e363a6f150e1100b2e4e8d6f54b8676cef415d579dd5f2a85b6dc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 6f6a48f215be074f9f6b617167600f02c6b4f4af728e0cf1a22f3d64ff8c5218
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 980513e6b8a8de821c8c1e4d83553fa094501b256ad2569a6e6d31c6f0e59803
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 787f0057b6876945d0b04ca9d81512e5b2cc1b395f3b911c3de0949751a68c56
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 d2b82706106406cfbb32d2b4691b167ad3822f11e186dd04001ee74a180baca8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 6ae430c88d19a75dcb40fbfe087c73f083b657769ee3de796b1dea9b7c45859e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 4d35b7d949e38b982deb4d7120274ed8c93d651a7f1abbcf56e841b5263aa19a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 48aeb1d5433729e96304f0f7cd2c16426df7f4791c663c2953423198623cf4b1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/60-55-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/60-46-0x0000000000C90000-0x0000000000CF0000-memory.dmp
            Download

            memory/60-170-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/60-52-0x0000000000C90000-0x0000000000CF0000-memory.dmp
            Download

            memory/844-231-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/844-112-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/1084-243-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1084-130-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1184-24-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/1184-152-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/1184-30-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/1184-31-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/1212-474-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1212-183-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1496-255-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/1496-135-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/1592-470-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1592-179-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1648-264-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1648-518-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1836-95-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/1836-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/1836-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/1836-71-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2096-227-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2096-206-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2244-60-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2244-68-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2244-182-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2244-66-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2328-240-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2328-512-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2760-477-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2760-155-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2760-276-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2784-35-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/2784-58-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2784-56-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/2784-43-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2784-41-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/3180-88-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/3180-82-0x0000000000800000-0x0000000000860000-memory.dmp
            Download

            memory/3180-91-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/3252-108-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3592-519-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/3592-277-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/3972-246-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3972-515-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4236-438-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/4236-159-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/4444-6-0x00000000022E0000-0x0000000002346000-memory.dmp
            Download

            memory/4444-0-0x0000000000400000-0x0000000000584000-memory.dmp
            Download

            memory/4444-107-0x0000000000400000-0x0000000000584000-memory.dmp
            Download

            memory/4444-1-0x00000000022E0000-0x0000000002346000-memory.dmp
            Download

            memory/4528-124-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4528-11-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4528-18-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4528-12-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4924-195-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/4924-478-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/5028-229-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/5028-479-0x0000000140000000-0x0000000140147000-memory.dmp
            Download