Overview

overview

7

Static

static

3

2024-06-03...re.exe

windows7-x64

7

2024-06-03...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 15:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_1e1ddd0b80b6c56c5b935baf5c9d433d_bkransomware.exe
  • Size 1.8MB
  • Sample240603-s87mjsbd2y
  • SHA256 6eca428ac50143468947f6c99f589238b3027bbf5ace9708a442638cbd760573
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 21 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_1e1ddd0b80b6c56c5b935baf5c9d433d_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_1e1ddd0b80b6c56c5b935baf5c9d433d_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4804
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2700
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3908
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1892
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3864
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4676
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1420
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1120
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3544
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2564
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2340
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:1640
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2752
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1412
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3564
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3572
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3748
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:1728
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4564
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4020
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1948
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        PID:632
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:1256
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5068
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:1604
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
            2⤵
            • Modifies data under HKEY_USERS
            PID:1796

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
              • Size 2.1MB
              • SHA256 cfdba0f7c593f11ed9ab22302596c13a037df2941e7a638d3ab8098fc2049b68
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 797KB
              • SHA256 6e72534e3cfc4bbd6861e889842592cb930fe170c0485f71fc6dc342532cb069
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 334f80e6d8460c1601e42523642eaaa8997543e9f275fecd183076a53f234333
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 d8dd2495d081a6cc758747257a15c5e78b93b5095e7714a9810989a14b460518
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 49f3f2ff3c74f1897da30928694bcc40f8d40bdc18d56da23f49dd1dc2f35e6c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 582KB
              • SHA256 fb3378ac0efebea53a475e52c5decdc284f49418008a89920b2475a786ffdddf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 840KB
              • SHA256 6fd0367d52cf104a7fa15abf6ebf9625705de5561633ddb5c96d41cede0be696
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 cc315965d5ca7ec71390ba2a927a4b5d3a550ca2847f6b6c823c2a6df6a71493
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 910KB
              • SHA256 e05705cc2c94da7f950754502950dfb2c91d8d021ac9fa9d12e323e3fe3ebabb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 bf9a86c2500a1653f5fec4fcaa6bb107d41aa5a61eee01daabb256386db76d8e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 131ec725be90a5939e3c56f977c88d50df59ea495b9783014b40b42bfa456203
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 805KB
              • SHA256 2246d4f83db06661bf3c22c24827a59057fdec87816cdfbe7b189ef663bbee35
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
              • Size 2.2MB
              • SHA256 fbe9b20f80baa5058ecc22c25dca68a7dd8038480c1bbe7136bea415d8772c9f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
              • Size 1.8MB
              • SHA256 4cd063c18febc53b94917cc76ffc7931bdc121248e1b6a8271d54877769ec726
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 1.7MB
              • SHA256 4711abf19666f790a890debe64a2ab8b5f92dd89f7a5c8926b3fa8baa7b07e8c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 581KB
              • SHA256 0f6c77226c2332cdc6b22c24aecec7f443c0dcef592860f954ba3db10b26e8fc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 601KB
              • SHA256 276d2c4b66ecfa38d770a5e0db9e555479eb9e154af38b9b8b302df7dcde52ca
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 581KB
              • SHA256 f7cee2f47166992bc5420b74c05d3258b3b363553c8b3320c1e929fb496fed72
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 581KB
              • SHA256 6dcfe6a113b351c2de5d5fca67168342adc73fb9235ffd31e1ac8c9f9a10f4a7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 581KB
              • SHA256 bfd4f2b96a714c68c12bf7039c38be66e0fbf50b4e83b85a5e2c193b19a12bf6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 581KB
              • SHA256 9961dc875fbd2f296f15e8fbb680269e885bbe2a75f397d091b4693e5ce079d6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 717KB
              • SHA256 774981719458d99d29b30e8122cf25713f9e1e7d657e23a6ef68f31d17a67660
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 1020KB
              • SHA256 b49a88a0cadd97a13e8e0704438db6c421a604bb7a82f9e3666803177209bc32
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 581KB
              • SHA256 d50ea14da6edcdf87b3afacafcad98ee4dd217fef6b23030b8fc10abc5e99d16
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 581KB
              • SHA256 2efc8760d72ae8e39ae71155ce39467ffa6ed3a86aec8c39990bca8af5211277
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 581KB
              • SHA256 b9a531ae1007c1075f7022e541397b2250b624c770b2b20848e357aff696a69b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 581KB
              • SHA256 eb7d7b14239eb218393978ac217d091d7865f711cc4efc4921d4a57468f61dbc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jmap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
              • Size 581KB
              • SHA256 ce8c7a8891a9e7e050e718bc351cc2b50b5385e02720b516846b37391946bfc0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jrunscript.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
              • Size 581KB
              • SHA256 28a033395a182de6c971ea3db6a851b7dbc63f358cf982d1795cdf14a7a06d49
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jstack.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
              • Size 581KB
              • SHA256 aec2c0e76fc5f1d4dd9ee07e5840ffe9f81c4709bd8b3bb58f7d5dd3c8fa2aa4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jstatd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
              • Size 581KB
              • SHA256 0638a0288e239c3f22221cae0033d92b24a1ddb0502502954e9dd44bfe87d567
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              kinit.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
              • Size 581KB
              • SHA256 063f64bf318b84d4a1e46025acdad937d992d140886b5e9f0dd5b116fbaea887
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              native2ascii.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
              • Size 581KB
              • SHA256 74f313e63c2a00cc3a30aee63ab51774d20f0df2ca6e10fd64ab6738faba0ee7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              orbd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
              • Size 581KB
              • SHA256 080cbee93da381739c68d4892b8a55d80429b1085698b408956d58459dea7bb9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              pack200.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
              • Size 581KB
              • SHA256 94c4c52ca7e79deb1beff2a9f81e9f7a0bd3d78defb11f44d6d492ba415dc60c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              policytool.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
              • Size 581KB
              • SHA256 e49d1f1fa49273888881cf0452979a0646a512b6c9ea908de1b450fd704f9de9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              rmid.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
              • Size 581KB
              • SHA256 84a4cafccd35e0f7b399f13c4eeb3a47ab856420e8317627e256241d0bfce7dc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              serialver.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
              • Size 581KB
              • SHA256 32a8eaf3f7ee88e69048f790c28211f7d36a4dbd9a4a58912626abb9da5225d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 c942f5d71527820199f3b6c875ab7c12806c8e56a946aa2f85ba436552462042
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 588KB
              • SHA256 2f0be9f5c1cf57c1dedda6e975cb592492a2760a301bd016fb6fd394c82fee3f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 652337f739b5e28dace7aa33950e9bb9ec669e332f6f73e7bbd3e1136cfbc801
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 659KB
              • SHA256 538fa1f10c3347bcb4efbebf168f41a6bc57d0828bfdc5fa8fe5759afe8c383f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 b6102e42990e779f61e538ae8dff7150d4b266a2dfe89a8d45e5bb53e5d62fb0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 578KB
              • SHA256 72313702a2e9e9c6979e2c59b483b68b0462a2e1f596d8f2365dfd0356266f2a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 940KB
              • SHA256 3dddf39a26b23123331ebd7bac224ae5efa417c3b6b200b026a30eb366ccaf51
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 671KB
              • SHA256 ff69386d5ca653de637beed69caa5341d0d2a505e501247ad1dc95eeaa223805
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 2b667678ac0f0aee7ba50eb2352d368953c9c07b28e8a08b5cb630c06ecda68a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 ee1f8ac827c1f05b697429e9e7d145b1045c1d535c27d364e7af0cbf232a4433
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 f9a6c350fad7f4ada72bab6e49f316fa0a1cb9d3d891b660f890e3306cd3e229
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 885KB
              • SHA256 d775fba9269d6385b48580ae9d405faa65395589af81df3f196b6346bd6a849a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 f490adb594ac62773db57c671f54c784fa6f9ebc774dce664accbfc7269ba8c8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 661KB
              • SHA256 2865c6c607b3d0ad08cadaf843052390a5ef6af927a1bd1936d68937970f87de
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 712KB
              • SHA256 eb8306d508d3e04438d472c91462c8d557a8ece72eeff75bdd9a7bbe44f7dd93
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 584KB
              • SHA256 3fe341243c22f2cf6e2b06c4ade37e03354c98ecc4a067ce496126263e8f233c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 8e6e53f9f69e027f91d8433902f6ffb274df17a8f2c7a351d523c386c0a78799
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 8c19f202aeafdadd2cb273108d70eaef8a2d2afad162d478d78c00e6b7161297
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 e2397b1702039d59bce0b86085714224589a038e60d6efa24a871f96eb9e55fc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 877KB
              • SHA256 45268261c9e4b013f4c6968988edaf523a0da9cf8594bb10ff4e91213b28a012
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 635KB
              • SHA256 92b88344c93aa3efb88fc94e96c88c1f77f3da0da490c21cd64cf8d6b3a68c2e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/632-223-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/632-413-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/1016-225-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1016-414-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/1120-84-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/1120-82-0x0000000001A80000-0x0000000001AE0000-memory.dmp
              Download

              memory/1120-78-0x0000000001A80000-0x0000000001AE0000-memory.dmp
              Download

              memory/1120-72-0x0000000001A80000-0x0000000001AE0000-memory.dmp
              Download

              memory/1256-245-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/1256-415-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/1412-370-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/1412-217-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/1420-410-0x0000000140000000-0x000000014022B000-memory.dmp
              Download

              memory/1420-97-0x0000000140000000-0x000000014022B000-memory.dmp
              Download

              memory/1420-68-0x00000000001A0000-0x0000000000200000-memory.dmp
              Download

              memory/1420-62-0x00000000001A0000-0x0000000000200000-memory.dmp
              Download

              memory/1640-215-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/1948-412-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1948-222-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/2340-214-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/2564-411-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/2564-99-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/2700-255-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/2700-21-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/2700-12-0x0000000000710000-0x0000000000770000-memory.dmp
              Download

              memory/2700-22-0x0000000000710000-0x0000000000770000-memory.dmp
              Download

              memory/2752-216-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/3544-98-0x0000000140000000-0x00000001400B9000-memory.dmp
              Download

              memory/3544-86-0x0000000000D60000-0x0000000000DC0000-memory.dmp
              Download

              memory/3564-218-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/3572-219-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/3748-220-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/3864-38-0x0000000000930000-0x0000000000990000-memory.dmp
              Download

              memory/3864-44-0x0000000000930000-0x0000000000990000-memory.dmp
              Download

              memory/3864-47-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3864-213-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3864-59-0x0000000000930000-0x0000000000990000-memory.dmp
              Download

              memory/3908-26-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3908-393-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/3908-32-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/3908-34-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/3908-33-0x0000000000690000-0x00000000006F0000-memory.dmp
              Download

              memory/4020-198-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/4564-221-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/4676-49-0x0000000000510000-0x0000000000570000-memory.dmp
              Download

              memory/4676-57-0x0000000140000000-0x000000014024B000-memory.dmp
              Download

              memory/4676-55-0x0000000000510000-0x0000000000570000-memory.dmp
              Download

              memory/4676-406-0x0000000140000000-0x000000014024B000-memory.dmp
              Download

              memory/4804-0-0x0000000000400000-0x00000000005D9000-memory.dmp
              Download

              memory/4804-244-0x0000000000400000-0x00000000005D9000-memory.dmp
              Download

              memory/4804-6-0x0000000000760000-0x00000000007C7000-memory.dmp
              Download

              memory/4804-8-0x0000000000760000-0x00000000007C7000-memory.dmp
              Download

              memory/4804-1-0x0000000000760000-0x00000000007C7000-memory.dmp
              Download

              memory/5068-256-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/5068-417-0x0000000140000000-0x0000000140179000-memory.dmp
              Download