Overview

overview

7

Static

static

3

2024-06-03...re.exe

windows7-x64

7

2024-06-03...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 16:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_b4109114f590a839ae5ee8dfbbc37958_bkransomware.exe
  • Size 712KB
  • Sample240603-tns44adb63
  • SHA256 e4f503672ebb94deb5047c22d6a6afe420c8e4a7a17e8d4a31ddae2584076611
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_b4109114f590a839ae5ee8dfbbc37958_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_b4109114f590a839ae5ee8dfbbc37958_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3664
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4236
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1988
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4944
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3080
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4568
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2776
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3360
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2856
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2040
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3908
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2932
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2908
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4680
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:780
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2896
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1580
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4440
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4428
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4868
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3136
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1056
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:3972
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1872
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3940

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 1adf00f710c6791fc2c06a04e98b545ab0e47c542acaf5d406268308e4e13ce9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 08b9aaf556135b113b4906fcd6bc2912fc65923c615863a4bec39798762242fd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 78bd78ca48081f328a77443fbe7c55c98cb1387a39c0df45424a6df569bc9bf7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 013b604dccc578225a110c0f4a08bbf011b47c368359e81547050ab3aee4cec1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 c9886771dd9b9c5ee67a41741530a8768d1c59a86d8a43e92e0e360cc4262b1c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 2d220ba0d06fca82327d99e570a211022528bf83c73bba2c8838d94aabdbb25a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 6360a720ed603106a2c7ffebc87c84daddac474e0ea6a056ae6fb4dd1c4a38cd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 e873a90d82b05435616da451b4422a3b9fca8081440394bced04a58c2019e955
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 833c6d6445f6e7ed1d27b71eb79cc23baad403878d1c432a02ad9878d45592e3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 c003a9f9afe9d352b2a1e361fc85be1d4c3471abf9e21cd3267f65abb13e5339
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 c9b28036932ca04150326adc89bb9e2ff718e98ba24599fb428d6fddc710973f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 f2d9149b8ed0d5a38132c37289565e5c47dd6556149dc8366c6ed1bfa33eb973
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 8146d42e8536f7db1e8eb7b3fa503a04035cfb474d84d0bf305c7a891b00048d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 3a7499c2037d0353730192310193a79fd94cf21d221bfaf6570960aab8b0ac4a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 d47c57ad215c0ad6542855ea66ec2b25a3597936e4575241540e506675df3460
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 d3f049452242aef4aafbbf7c90a841db38d46c8145a25fae3e3fa197abda3277
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 15a66ff3f67880d029e264e4dfb03fb3fe07e575442cae4ce01df53e1030e2c6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 c600b3e83732339989e4f97750cec0ecc18441a830bfc713dfacb82e609ea12b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 42e74e8feba99e6c52881fb7c02574e48b77a21b9edb8ffbaf72335bbccbaf74
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 d82fcfa22000e4b0ab81e9a790f869bf526ccbcef83072c1cd4b32f673a18333
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 b9da65d69f734cadc064d924bb46737a0669b71034d25409e7cd776eca4c958d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 f705fb4a13950dbc537a6d7e855c3817604bc605fd151e60f0ebca1902456dc6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 c41c95b37037017871cd4efd26345da8a35a772a1652e7117ac910f20581389f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 bc23818e3e7d398e715171aed4df0f8ded15eea306b5401a79842d267cb2c845
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 44e1420538294f5bda3e26a60f7e1dbc89a8a01eb095de4ea93c8aa22a092052
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 395c75bff83cc7e42cc57fa12de31806c78d618ca60651eeaaa2c37c2ca0b564
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 bb8d3132882a4dbae0448550ddad11b35846d38000eb1fca1c46bd57197ff0a0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 9fc90e2b60fa7a3055ca031387d3ccbed0a7ecb0201c1146db9b48621903ed8b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 d8566c2c7c84d7443c6b629139b8b913af00c6de5f19c0c9a66189ed57cddb16
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 87e4c88ed72a363af5e75e6a3405a86883ce4ef40df34a413a25808d82165b50
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 bf235eedcd68fe23f30a2ab3801a5c0fc877ad8a0cd4a8f0340dd948cca0312f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 1c1c4ef486927d163eebbe94088a321fbad2e20082482bb5cf87b6d10746fb5f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 b0156ef7d301c3d1227129524cd51702d28ce59159cafae97497635b2745ea85
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 023c4d10ed3a383f6fac37c481e532730473ba3a9071886003d98647a4ac15d2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 89e8bcabfff1044fde50aa99d5e0aa54efe96bcf74408a742af2c0ad76204372
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 1b109e5460bb54d5b114a5e6a0da1618b8b0ecafd28c5fb5ff7fb5e0bd8fe0e6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 d9db0e5922f7c7519dd0d043405164523f51364dbbac5faf9f909da152db20d6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 8876b802876ad3443ff1d20e996617152c9d1fd99b6fc4896704a39865ca5fb8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 774637fd4879597d9c81e0dc5ab6b0ca901483adcb6dfa3905a84fd052c7ab7c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 58cba9ce2c9b83f9144972a189796780860ed08465202f173bc5f244ec3fb889
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 d8d067dab36afbf3567d22538d7ffbe2076fa2eba6d97d6306fea5ddd2a887df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 ae3bc7c841792aaa70efb3836028922e77216effa5a0b3895881203b0f0bfc3e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 09a045251efcbd8217056fbb435b0ed411d6d5b8dd73ee827e26064f3641875c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 2ed56777d6925625b1901c4a7acefc9ea61b00e3063237884f1dc46afdf1f312
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 89bc49f9cfb8c5aa457b87d7762a0b2c0dc70f40b582a48a4cbde2d935e9ea1c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 bffb8db335e4e90d194c971880994d4d592d4d9cb6d6db499dc7ab979a00b618
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 70d2231eaac4821c200c74949ae93b4ef49e67ed10a2847b45585618d1b0f12b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 b5c1aac7426c1318af4da5ddf49a5834bb947fab804a014e7d6fb1af0fe67804
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 d235a52b14e284890b961bf366023302c226496eef9bff30759504ef23e48e4e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 cf5aa2f95b0b9ee5a67f98dc7c397c367cb15f6672c328b49269d5639542dd67
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 91e55e923b9916bbc04040305df2c6346740451ee7f5ff1098eef3189af30f27
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 7237dfb40c835d79154b5ab1dd8b3e73000d0b7319940eb7ec8742d00d22b4d9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 0b6e8f6d2f0b5ff8d88d1015b24a10206ee3007b43f39bfcfffc43900263c911
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 e4717a9b5c5e43b94c0f9aef1c972412d339c03da674a33bdb82feabc3a359a0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 fb41a437175de4d1394106ed4b7fc25ae6e984674e57107e8d7095e312df0570
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 5b3606bb07ba7267db7de7ea4a4666325b72a668fcf149564202d62e8a97dbca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 e8a1643dfaa1a94357efea12eab9cfa1c561012bbb245b6c114a89d1d760eb10
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 59cddbdf533b22f8457ac6e7476294872f088f543a3a4224f75f10b9f7ef2f28
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 23be1cb016f194e3fab8312204162a4d2c4468fac6c8f649de6006d871a28515
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/780-161-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/780-441-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/952-280-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/952-636-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1056-247-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1056-633-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1580-512-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1580-186-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/1988-34-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/1988-32-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/1988-26-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/2040-230-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2040-111-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/2480-235-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2480-630-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2776-69-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2776-185-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2776-63-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2776-72-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/2856-98-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/2856-89-0x0000000000D90000-0x0000000000DF0000-memory.dmp
            Download

            memory/2896-472-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/2896-179-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/2908-266-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/2908-146-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/2932-246-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/2932-135-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/3080-37-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3080-50-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3080-46-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/3080-48-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/3080-38-0x0000000000DA0000-0x0000000000E00000-memory.dmp
            Download

            memory/3136-629-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3136-231-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3360-87-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3360-80-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3360-81-0x0000000000D20000-0x0000000000D80000-memory.dmp
            Download

            memory/3360-85-0x0000000000D20000-0x0000000000D80000-memory.dmp
            Download

            memory/3360-74-0x0000000000D20000-0x0000000000D80000-memory.dmp
            Download

            memory/3664-0-0x0000000000400000-0x0000000000584000-memory.dmp
            Download

            memory/3664-1-0x0000000002330000-0x0000000002397000-memory.dmp
            Download

            memory/3664-8-0x0000000002330000-0x0000000002397000-memory.dmp
            Download

            memory/3664-104-0x0000000000400000-0x0000000000584000-memory.dmp
            Download

            memory/3908-234-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/3908-116-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/3972-635-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/3972-267-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4236-134-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4236-13-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4236-21-0x0000000000500000-0x0000000000560000-memory.dmp
            Download

            memory/4236-20-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4428-197-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/4428-627-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/4568-58-0x0000000000CB0000-0x0000000000D10000-memory.dmp
            Download

            memory/4568-60-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4568-52-0x0000000000CB0000-0x0000000000D10000-memory.dmp
            Download

            memory/4568-172-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4680-511-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4680-271-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4680-157-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4868-219-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4868-211-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download