Overview

overview

7

Static

static

3

2024-06-08...re.exe

windows7-x64

7

2024-06-08...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 11:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_a0106ef6ef589e6ece31f54c50c13e23_bkransomware.exe
  • Size 1.5MB
  • Sample240608-ns6yvsbc5t
  • SHA256 dec2aa9e6e1bada59c47a825d123e5fc5514efab5f2e25a7c13a82ad0d7fade3
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_a0106ef6ef589e6ece31f54c50c13e23_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_a0106ef6ef589e6ece31f54c50c13e23_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1848
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1344
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1976
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2732
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1436
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4852
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1960
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:2892
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:1720
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:2208
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4604
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:3996
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2608
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3092
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:1576
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1568
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2256
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2896
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2996
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3880
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4700
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2652
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1212
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1932
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2176
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4408
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3872

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 f7a5e95badc1f47c85036a0277ecb673039bf0a4b3cc7c4cdbb31347255635e7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.5MB
            • SHA256 416e051b73b7922d6446bb44a2f0fe2f7d17e89cf6c66023e5e015688702dbee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.8MB
            • SHA256 64a6447226298294df23babda9135628916ac9c6c968505a7e5c52b92d4d51b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 3a4cd3ee9a3689ad5dfb8a7682410a012c223a017adc57b58253fbbe26890dde
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 d18824e03095860989e397cf9735bd5ea38ca3aa67490ce3a3226c922746471b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.3MB
            • SHA256 3200d611cdeee1b2a355a0516d205f21617b261a7c242f2aca737c406e8e76c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.6MB
            • SHA256 1e9a7090aca2bb8cf566005ca59321687b2038c5c9e0537b6f471205a347167b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 9874b073ee27ba1ace7ac4f648014c88e2a6dbeb21c5e8efbece90f89ec21e99
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.6MB
            • SHA256 8a62a0ad1d70b27f35016d02a3eda9d47be671960e84129de501f7e8c5a834ca
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 2cf9731ca51184d3011a7c59d9b18ac8c6bc84a344e38e4f71c92dd1e744a73e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 416e07ce5dcfb9d62b80c0ac2b0bb2838974918210a97ca486471fc169fbb2f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 e62b3612de88e970ff1ba10fbe2cd173233d60ebcca060d8a98528028bf07421
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.5MB
            • SHA256 4159e9f7540d12ede7fa471fa7511379d74ff57ef24fe0820f1c847228cb661d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.4MB
            • SHA256 9c4a19ce27b5db587b311c364e855da77a9117edcadfda471e24f9fe8edfb24b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 1b1ce02f10461dbdad30879226998e719f168f3a0058d878cc0ed088b45219b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 0a437404b5580f2a249eec17083ba1dfae63af5357c725628bbd385df0456897
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 2cb20e144b61abf806d79e0df910ca5882fa8660440798c69beb28d4f769a298
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 7221a64b7a9a06925513e53da92cf4c9b2bd8eda3a0750f70b0e227290a0b94f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 86bcf7622c96a36c18b3c85de9df3632dcfb93803c6b460475e289cfa6a564ae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 9749c57472feb6c91d2939968738324aa3c7411b11d805376b66547eb176a20b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.3MB
            • SHA256 bc7f98d7ea5e66945e230f85190961a6ee96c13e8058815547f0b53ca49e1066
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.3MB
            • SHA256 bdd88c2249e3c8a67963dbd00bbcb463ecfbc74e77e6cdcb25a80e137cf5c8a8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.3MB
            • SHA256 f6e3311c178212cdc2ea10bd474da18cc590adb03527fb0e141cceb0b098bea3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.3MB
            • SHA256 eab064489229ea05c02b232b4f9d6ff4d9504b3e7011acb74d5a5f2066204561
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.3MB
            • SHA256 a16394b70d1f48ee70b382ebc58beb46481aa42ae0f0a6dc02ee4aafed0bae32
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.3MB
            • SHA256 105b90637782d6d5f29ff71a67808791bc3328611bfd11124439f87c6c1ea848
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.3MB
            • SHA256 3948eb55bb2e0a2e820d33e04e891d92fc5164b4cc88a170aebede3fb2393602
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.6MB
            • SHA256 71dd80abab437e7750a08a457e1ddd3ee02845543fc38763200c1f0d03ec458b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.3MB
            • SHA256 c173d39f48ca7f3c25c05a6b4dba513eaa0f8a2309b96578010dd2d3152ca7ba
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.3MB
            • SHA256 044bf085d7fb7e4e71dce79eedfc66fada28a3dcbd6dd9a690f5089a199c90d5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.5MB
            • SHA256 ff74f538004655c176c2137dd5dd0568c7d34f758f1a022d3f79ce3fee4b90ff
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.3MB
            • SHA256 6c80fe7a1faf1efce3948e04eb10fd5d6b1338bd8ace199892b98683961dd4db
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.3MB
            • SHA256 8f54e65bbd0f90d3f53180e22673e96607b91531bf74ed7349d5d4646768d522
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.5MB
            • SHA256 c9d6bd3c4ca1e07336dade2d206b2503397227d336d5acbd71c34549ea9e138f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.6MB
            • SHA256 4c6b4460928df7f9609fd4d60edb4ff699ae08694272c5e76b65634d40d544b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.8MB
            • SHA256 09e294844c1ef592570ff60fe3ce3eb3e13a8284beb0ecc3f03220ea2b4ee964
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 7b70f62f22479f7cc880ce354b6e68b7fcb231be91c8c134f8a8fdb26f57a4b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.4MB
            • SHA256 50ff397f813b852f6c5526e1bb859cc692d47f64c18e2edbef6770c095cbf3fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.3MB
            • SHA256 aacc8dbff84f801fdf2bb3bb94da8e71a2a47b403e443fed6ab60ac72f4e3e43
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 4f59b96c2fe7ec3fdba5130ed174b5a4eb96e62f00f5d9212dff2be1841f0e81
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.4MB
            • SHA256 9dcc1d739f5dbb8d18e2ad7404512166a878348aae7b4ae055a48d9b370fd61d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 4b024733b9b4f43f3b67ec0b4711d00250331be987c695e7a99dea2ef983003a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.3MB
            • SHA256 c93103201842b30368d91be2c31b5522c377efad53604e7c4746c74e53905346
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.7MB
            • SHA256 3c34a59f529be488c2f9000f09f69e48a5a5cbb75ad8b2f5463daefead4be66e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.4MB
            • SHA256 9e4b41a174abd59b46145deb9f005cfc425a46ba54f2916d58018a67bd694d0d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 2b196628aa59092aa7fe349be79cb543400153a15390840d08d83e4a2b9893da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 469e3fd5bb9df857d26d55e89a45739d80abdf72ee8800c31fb2346987e53d86
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 2a1c4595605e71e9f861d6be79230e0e228bc795d84a4cb4b9b592e3d0d16fc2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.6MB
            • SHA256 67a63bc7096dba73404d113df916ac8135fe9c4fa05170f0339d522989a2217f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 ef4e327a94bca3ba46961a36a2ff436141a69dca944eb4368e74d576c2456210
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.4MB
            • SHA256 2cd3c7d3ea4c5746a99e9cb73912e6bcbac1ca46d2498ae6fb4799824bf12c83
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.4MB
            • SHA256 5ef1b5be39267df392f07e24bfa8eef3adba7f5186e0909dfe603d6b6ade8e9c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.3MB
            • SHA256 bde89fa77e4833265595eac73270138e51ac53702e02446bba7e7063fe33a22b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 883028908f775a1aa1fd07433cc664997ba139005ca117bc54a718af17c7033d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.5MB
            • SHA256 08b20722904490c5f5c1102d71a830b15ecd3fabc3c851dcec4d887600a9d0a7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 f3645fc29d43c7abb714a4ad460a0e375330a9bf4f4f1598ecd966681bcf3873
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 8c81e63c2217844bd1b780e66232e3c40ddb3d65ff2d479bceef4d434b932bf6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.6MB
            • SHA256 502b6f3c0e6720e5db5169b0f19f382eb33d0c71da917ae80b16335f50e9128c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.4MB
            • SHA256 2cf64e5f74a0289a8068f42b66718a7468490e736593a51655cf2c4c6be1cf89
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1212-249-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1212-560-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1344-90-0x0000000140000000-0x000000014016B000-memory.dmp
            Download

            memory/1344-21-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/1344-12-0x0000000000720000-0x0000000000780000-memory.dmp
            Download

            memory/1344-20-0x0000000140000000-0x000000014016B000-memory.dmp
            Download

            memory/1436-61-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1436-58-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/1436-39-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/1436-38-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/1436-45-0x0000000000940000-0x00000000009A0000-memory.dmp
            Download

            memory/1568-166-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1568-523-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1576-155-0x0000000140000000-0x0000000140157000-memory.dmp
            Download

            memory/1576-421-0x0000000140000000-0x0000000140157000-memory.dmp
            Download

            memory/1720-99-0x0000000140000000-0x000000014017A000-memory.dmp
            Download

            memory/1720-91-0x0000000000D50000-0x0000000000DB0000-memory.dmp
            Download

            memory/1720-216-0x0000000140000000-0x000000014017A000-memory.dmp
            Download

            memory/1848-8-0x00000000023E0000-0x0000000002447000-memory.dmp
            Download

            memory/1848-0-0x00000000023E0000-0x0000000002447000-memory.dmp
            Download

            memory/1848-7-0x0000000000400000-0x0000000000646000-memory.dmp
            Download

            memory/1848-71-0x0000000000400000-0x0000000000646000-memory.dmp
            Download

            memory/1932-563-0x0000000140000000-0x0000000140187000-memory.dmp
            Download

            memory/1932-253-0x0000000140000000-0x0000000140187000-memory.dmp
            Download

            memory/1960-69-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/1960-190-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/1960-63-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/1960-72-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/1976-35-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/1976-126-0x0000000140000000-0x000000014016A000-memory.dmp
            Download

            memory/1976-34-0x0000000140000000-0x000000014016A000-memory.dmp
            Download

            memory/1976-26-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/2176-274-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2176-564-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/2208-114-0x0000000140000000-0x0000000140191000-memory.dmp
            Download

            memory/2208-228-0x0000000140000000-0x0000000140191000-memory.dmp
            Download

            memory/2256-187-0x0000000140000000-0x00000001401C4000-memory.dmp
            Download

            memory/2256-550-0x0000000140000000-0x00000001401C4000-memory.dmp
            Download

            memory/2608-140-0x0000000140000000-0x0000000140156000-memory.dmp
            Download

            memory/2608-252-0x0000000140000000-0x0000000140156000-memory.dmp
            Download

            memory/2652-235-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2652-559-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2892-81-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/2892-88-0x0000000140000000-0x0000000140191000-memory.dmp
            Download

            memory/2892-75-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/2892-85-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/2892-83-0x0000000140000000-0x0000000140191000-memory.dmp
            Download

            memory/2996-199-0x0000000140000000-0x00000001401A3000-memory.dmp
            Download

            memory/2996-557-0x0000000140000000-0x00000001401A3000-memory.dmp
            Download

            memory/3092-151-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3092-273-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3092-555-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3880-210-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3880-213-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/3996-137-0x0000000000400000-0x0000000000558000-memory.dmp
            Download

            memory/4604-127-0x0000000140000000-0x000000014016C000-memory.dmp
            Download

            memory/4604-240-0x0000000140000000-0x000000014016C000-memory.dmp
            Download

            memory/4700-223-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4700-558-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/4852-178-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4852-57-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4852-55-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4852-49-0x0000000000710000-0x0000000000770000-memory.dmp
            Download