Overview

overview

7

Static

static

3

2024-06-03...re.exe

windows7-x64

7

2024-06-03...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-03_c67c4eba54d724d6dd8d0ac7444d6ee0_bkransomware.exe
  • Size 1.8MB
  • Sample240603-wwlfbsff97
  • SHA256 fdc6969c32df42d53070195f3d4806bfaf06bb375ea5b865a26892d12e6e9166
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_c67c4eba54d724d6dd8d0ac7444d6ee0_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_c67c4eba54d724d6dd8d0ac7444d6ee0_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3332
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4996
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4180
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:228
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2452
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5100
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3652
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1648
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:772
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:512
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:1264
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2968
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1868
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4928
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:5084
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4956
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3336
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4404
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1544
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3124
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4484
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1252
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1432
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:2632

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 91c1adc7c311b8de73fce927f98af028521b243b9a87fd38489d986f964df504
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 5dc822db0ddeec5189878e9ec60cc8ddcf7e3a3e58b84a6f5d7ff617160e9ac2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 d0af3d9e0269401a88360c2a3bcd8727c2c8aedf2691e0d7d1992c8519161d41
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 8925c61cf7fabbf481f67775c4369ab2778dcdbeb7c30e7c4485481af6e48e17
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 5be36c9bdef5928b26cb252e63ad18ae4ebcad6eb47005909de4f29ea596422d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 f4e9810cee30f2d7907b425fdb08a844440540326ff1de7f5a5cf2eb48e73324
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 db1074c4fdddbc6ace7162e642a03d63f52a35eee1e8c34f5e4a4dcf3e83eb8e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 4c8e251599c5dc6e8016c7d621041ec4537f098bfb94dcc4817a65cc476508d7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 4e9dedd61a6cb85819260e6e51686ccf2d5697fd08683302c45fc8ef01813fd1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 ef851a8fbce70456395255226ba04973f701347b6390cca4c27d683babd5bbb0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 d4d023bd3f757b8deaff6084319f5a9346fc3cbeb0121540e8b77307b0a12170
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 1daabd9066058dd0821aa4f974c84a59958be8bd82d3c8ef43a83107810d9f9f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 33f863008b5cb9230689b3f3ac8e30ae760e533cab4cda7f66b7acd2490a707d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 67a6cf0274abcd707ac026684fe27926c8cba61a43281bc14170a6b2430fbd58
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 5558a96af4415f3864ad1180034c1bb2d4551e7003d458f915088c8e50c92856
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 bfa67fd0147aa4169a715602c62bf04f29e6196233c9053a3a18a574482e09f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 dc33c0c526d03a94176f82b2d5bcd5156fa13618c738fc2eedf9ebd923c49ab8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 4da461d291ee89a5168cec531abde6866686386278c004ec2a79f8eecf1ba4a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 23c3cd741b6f3f8f9d15bebaf6170857e0c9f08292d1413da533e6d4f6b12588
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 d5a989e22753962f5f64e448807e4435543af3f9167797b0c1f8befdee3c7c18
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 f493ee00e6e447fb28375b16cdfe915dbed172ca7797f47ebc260de5cdfcba6c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 00ea743ed8341887ca9627310af1258be9aa5166511770b5cb3e4eefc09ed7a7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 df525d565b2bf06b59526dcf45dc18e8c2f5fe161267dc35ffa0176ac2d6be61
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 2eca33fc2dc9528419d53c1bacdcf509a4450445fcc6fbe8a0434253c5adc1f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 9f9cac8d860b01575aa03c41b899b91c5a7e54e8afaff06e59be7c35c2e88df7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 61b8d42f159720d5efbd7667931758cbea3477e35ea68f9c4094f1d5c163ec20
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 0b258011d6b317a4d4b01533ac35e5497d70020047646da4128ffb83a8d8fbf0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 f3a10c2a7e42c70cccc083b4755a88f0c3f92bccc583c0fbc2d32736b7ecf976
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 21128cc1b220d2aee06e085c4bbf2c2703e7ca36d4529e0c9436539ae4c7e0a1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 935ebaf069b4b311ce2f54662a16c53841f1c70b076891c1a401100766f470fe
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 132d1d76f6657295a296f2fe714ebcf379207a7e4e7109e4a12126344587b87e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 58873efa51c45fc605633a31322f7ef19306ef0b0d276867d7cec2c59de0779c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 12a9f0ad53167b99efdc7046478fe42346a8c0c684e5425ece26d37a3b4b8e4a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 e302d330e541b93e40753cf21809c9b68122ba9d9e25bddcf68b3bd397b5cd6a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 e609667522b0469b890c203996c251d890589985f749a0c10e7613ee7b359334
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 61a3ded0ad12eb4538ffb0809c5acd432689e06572a356a159c2164848e482e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 2a55985bc3f8845577f1d799a516e95ad31cbe023555cf58380b246055dcfea7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 54aea26fdbe86d8653cc5ca7eba9d3855e93605ff672fc4103181340664486c1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 6e4b06f1505db74b472546cbaefc4862c4aa365bf8c03c54a5395ded577f5573
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 44f2260f938f7662f2497580efa4c5efd786b6b38f92fdefc4ddfdb38d03d2e5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 f7dae7786750ec0bb59f4747ae9e8e83186f9534ca7b5673ac326f14396ef365
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 0efda3b068b7f790825f6cffb0900d2f858d047da16647c287169421a4e378a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 e42062998e58cd4439ccf3bc9cbbcd34097fa1d023408433886fbcce78aa18ef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 36b4442ca87886f5ef79049f43fe97bf49b893940cb5321f39d7eb106bcea1fc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 20cdb85c9342c56ab0307bda2769f3ddf65b2d93c7a5d7f3e44a14d81c36e43b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 d58ef08b676eaa1d72a24f362085ef2259f0e4d7592f18151cceb26c41dff46b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 dffcaeebf99ee1b49eef265263a786ebadb1a41a8f742085a205bb6a79864001
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 e70a42b3d71efb6ee993933b3a726e8f0808b184ebd58842af9b4649a8ee55ad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 60db62cb0a50a9d3a31c7dedeb38ccc115ffeae582229a4a73cf8be0c5b35992
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 f5a23af64bede357defb959c8d9b223a41a8574960317c6ce1b69038d205c3bd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 af5cafbfacef07febf87e4172729bf1d54151c347ab2f2329dfe6d4ae3640eac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 a3dd5ae4a94897c5397cb252834a940e4b322155ddec0731e558f1193f9e7511
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 173d3954e1f4208f611ea23a7f8a29e633e71d0d001296d2ba9ed7a5c9c06738
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 8db6f8b6107e5dc6c88a91e6984f082cebe5e7f59eb3147751d1c4f2739a84c1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 2cf1688a03c1efd22f0cd4237294cc1c893bbaed86aa3c416d78c2d338ddf204
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 fa44ad64acfc371c3f97147cf404285152f642a7ae752733d2cc0a169583e9fd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 209e8978a710db31780ae637e1d3294ef0b5a26c25a938aed4ebeb24d44849d2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 dfd2e10310568d6ffa744ed80fb24780654210176f65267b8a2ac2a96942edea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 89a0a6d21c30b85b75a879b1a246f5d2bed13fd5c49ec1f8a1e27a9da3bd4e64
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/512-229-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/512-125-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/772-217-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/772-102-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/1096-597-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1096-275-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1252-596-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1252-254-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/1264-129-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1264-241-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1544-218-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1544-591-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1648-202-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/1648-90-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/1648-91-0x0000000000D60000-0x0000000000DC0000-memory.dmp
            Download

            memory/1868-274-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1868-519-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1868-151-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/2452-53-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/2452-59-0x0000000000520000-0x0000000000580000-memory.dmp
            Download

            memory/2452-62-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2452-166-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2548-203-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2548-215-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2968-253-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/2968-140-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/3124-230-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3124-592-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3332-122-0x0000000000400000-0x00000000005D9000-memory.dmp
            Download

            memory/3332-1-0x0000000002310000-0x0000000002377000-memory.dmp
            Download

            memory/3332-8-0x0000000002310000-0x0000000002377000-memory.dmp
            Download

            memory/3332-0-0x0000000000400000-0x00000000005D9000-memory.dmp
            Download

            memory/3652-82-0x0000000002270000-0x00000000022D0000-memory.dmp
            Download

            memory/3652-76-0x0000000002270000-0x00000000022D0000-memory.dmp
            Download

            memory/3652-87-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3652-75-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3652-85-0x0000000002270000-0x00000000022D0000-memory.dmp
            Download

            memory/4180-34-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/4180-35-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4180-26-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4404-191-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/4404-590-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/4484-593-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4484-242-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4928-431-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/4928-155-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/4956-520-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/4956-180-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/4980-46-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4980-44-0x0000000000DC0000-0x0000000000E20000-memory.dmp
            Download

            memory/4980-38-0x0000000000DC0000-0x0000000000E20000-memory.dmp
            Download

            memory/4980-50-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/4980-51-0x0000000000DC0000-0x0000000000E20000-memory.dmp
            Download

            memory/4996-21-0x0000000000630000-0x0000000000690000-memory.dmp
            Download

            memory/4996-139-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4996-20-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4996-12-0x0000000000630000-0x0000000000690000-memory.dmp
            Download

            memory/5084-481-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/5084-170-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/5100-71-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/5100-64-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5100-179-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5100-66-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download