Overview

overview

7

Static

static

3

2024-06-08...re.exe

windows7-x64

7

2024-06-08...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    11s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 11:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-08_00726bd3d3745df3e2288a51a5325583_bkransomware.exe
  • Size 712KB
  • Sample240608-nvkhmscc22
  • SHA256 ee8fe0051aa64975f0e9d6507315f82596b16a146c17225052ee850266193588
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_00726bd3d3745df3e2288a51a5325583_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_00726bd3d3745df3e2288a51a5325583_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1888
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:4956
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:4180
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3976
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4228
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:5052
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4524
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4912
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4932
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4964
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:440
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2056
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4052
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3204
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3236
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:208
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:1560
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3884
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1120
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:1588
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4420
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4524
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4272
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:868
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:1880

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 7ff2a124f9920a1101542afaab2788fe96013c0e42cd5a8499b16c792b911701
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 e0e0ccdb57e8f43676963221e04c9718b9c50a3744bf6119aca1cbf1eb63b710
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 37162dbeed13812300b7835205f6ca34dc6e3a47a8f32b011e1cff04e37842ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 5c54a64201441cd7fc24481d30f52f8799d9db9987e5fde43d10001c2d9aefe9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 5a312d550f785432c8ef5604d623784f12c7f36de93764aa8c95e2302b9bb71d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 e5269a58ce50fc788e83c557eaed23924cf5cbcbdb2bbddfd40ee8519522e2c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 863f26db197c00384b0c075ecccee4283a1b5f3bff195d1742d777f25603f286
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 c5907e59aaeacd81618b442f11ea5f82fd9a1a253f98ac6bffc8aa42dc9b2a91
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 92dd9700b857c56165b50c68bb1b26e01084fe3fc69920b732c42d9851b994bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 4d92ae81f51a8ce2603eac281bf3acdc7233c077fcacd741bad76d7991270f91
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 8184b567adc2dc9dea6a00a2612c3635cfc3e1951d794e8961711693db11b383
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 f58a26db37dcea0d6e672a90d95437f676e0a758ba6bb2fa985cd5d8973945bf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 63f1cb4c376f1c533e2154a87e1206c0edeac21b4c9b0ffaf229cd72dc4a760e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 b4e7f81c49fddd3a2255fd3e70af2cebe5406d08844fd3f357da2b6694d24bc7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 47a07aae6b17ee5795c06875548ad5e290ca413798342da692afe5a81951df1d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 e41a4016da8295f765168f1ac70271d8ff98c5129b0c973dbec468e9d4f92f71
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 821f2604cabc2ad03340f89f8d97c8b92edec68b92779a5bb1e17c0f6142fcc2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 21eaaac1abc64985d796e45191331235a53ab52cd1a0601e9757fd749a7cd281
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 11ddea8f42f68ab7748b1e0c83e4523e0b94fd7aa221a3e80d6ecff114af2986
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 01a4210fc561e80bd36ec77928b205393de12f9d2fc2cc6737b40a7ab3f1193b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 9c2e151320ae9cd68639b9b204cdb176b2ecb65849da8cb563b70037c9b9bdcf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 49682d0c1e76a49dceb33d44180b14126e16ee837992565a1e040db3817dd679
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 eccb2df1223b503721c81f7d3f45cf8ae894b3915bb39ddb438da575823acefb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 872f1e7dd1b2c1446ab391011b380c3d799d201757f72ef48a12cbbbbe1a4c8d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 e3922703f0117c1c2137c5eab3ca88cb152084e61ae26692078a098402856fe0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 104203b0e2896434a4d751f4d4bf8d151ca261561a8acb4d56ccdba49317a1cd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 15df4bce104a46d9ad891b7a1cc90b1642dee5e2696bec3d9eb16b96f0e33035
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 462253befde2c15f93864628bb9e1819d2f608d04038c4c2d2608f3555a39e4e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 7c6fa0e72489ddbc9c5a107aa41954a6385b3be4d0abecb644e44b1ffdd230f6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 242197b078d15cfcf3bd01d82d01bcc93a1c9e9817c3182fc7477220ee0434b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 b1e90d41bed915e52deb111c83558464796fadb176e4094e0ca5701c7de22d72
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 d171d51b462e3b1e06c717b1cdf82667faa2f833309cd6b8f16e770ca27519bd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 0852f67e8183da7c2501b45a29d9993dbab0813283823ed1a03a93c9f6d05d2c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 bc921747b4b8db69bdf27abfea6733d0b1a7a6ad41b4941c856e9813363d2d30
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 fc8162c2982d967d3886cc14909b5d6870788c1101bf7b65c3c84b0456d328b3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 c5bf0fc14a1277a2a1b97e2a0805bc244bbda68faffa42cfb6e051672bb9fc7c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 74da64640a7d8d29a9bd4347940b2664585c660339c97e47981a8b1678156db1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 872bc84d981d29ce8bc8e338fd4915614d3ae62505f077af65f5b43087dfb019
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 72da66f1c0a4e8a7696eadcecc04375556eba4973f24f75e944ae7faf60943f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 2a11ab4dbcf6f7e5287a0d8df1e3a5458aeecde7e088cd4121b2d85a08714347
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 daaebc6b0d6c6dfcad76a1985fddedbd6727fe60d97086fa6b160513567bcb15
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 0d43be0a76897dcd2fc35575c2ef1d9bf68dab0f00e370aafd56291ed8d60e31
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 44792186a43935aa03db5def6165c332f164bd06ff2dfd8cb219133108b94edf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 df71940a236ea3c199e56a94999a18366bacfb4002f5ecb11093739db243a770
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 73f2fd7dfd7d450511667ca132a76a3634d769e9f456bae72684b7704230c430
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 0c974aa3245f2771582a8a8d8a401b8ee98d0fcdf5fa5348c3802da2eff2e8b8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 6d48a9ee7de7a1ff865f1505b08f5aa03bf56e31f7b0103b03bd58d419e1df11
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 88e8804ef4da046a3d75f6c57bec71d113861959d7c8bc22a10196259dbf5362
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 da9672fd9a40a03ee028a5f0d3391c59da7b62547068981138dbf5deb30b30ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 e81c637837f92100f14701d6ceecfb9a505aa9eae1d239013dc706041b3b3fdf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 f8db211bdb124cb83929a8460268b949ce3de42dc8c794727dcc4848ad21e6b2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 fc7bc1a3ada81bc95a2bf811907f839eb1dd38cc968470af907ca91c7b8c5b22
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 d2c877b99d6b8ca4d65a8804cacf2c6695ca6999ca83d093f47d3ce5fdcec295
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 dc2434a4aef5169e567280d2c789f80dd3b5fd832434895e2af55c8cd9c242a4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 34cd0024ed897a080a771fb75d626d9ef9d64653fd708d2fde164f9e5e98a4c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 1972d3a30a2bd2269c44be1160d54fdb4e075c0b55335389bc16e70c451a4a9a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 adc2742f395df6d4aeb7b279a379dbd9579fa49160e4ad0c94d1f5cd422b9ec5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 9d38e9b3e1341a2047036fe1ba8be0774b7a440db6e5f9c55b528c040ddae6d4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 6aa17720c69df37ef7c5d8479da29830405b088f667710b828ce4a2a42cb6b09
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/208-607-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/208-195-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/216-60-0x0000000000DF0000-0x0000000000E50000-memory.dmp
            Download

            memory/216-46-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/216-71-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/216-38-0x0000000000DF0000-0x0000000000E50000-memory.dmp
            Download

            memory/216-47-0x0000000000DF0000-0x0000000000E50000-memory.dmp
            Download

            memory/380-652-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/380-278-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/440-247-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/440-134-0x0000000000400000-0x0000000000497000-memory.dmp
            Download

            memory/1120-222-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1120-210-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1588-645-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1588-233-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/1888-8-0x0000000000840000-0x00000000008A7000-memory.dmp
            Download

            memory/1888-0-0x0000000000400000-0x0000000000584000-memory.dmp
            Download

            memory/1888-84-0x0000000000400000-0x0000000000584000-memory.dmp
            Download

            memory/1888-1-0x0000000000840000-0x00000000008A7000-memory.dmp
            Download

            memory/2056-146-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/3204-163-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/3204-450-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/3236-489-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3236-174-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3884-643-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/3884-207-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/4052-271-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4052-157-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4052-642-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4180-34-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/4180-27-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4180-145-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/4180-35-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/4228-57-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/4228-52-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4228-50-0x0000000000740000-0x00000000007A0000-memory.dmp
            Download

            memory/4228-186-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/4272-651-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4272-265-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4420-646-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4420-244-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/4524-75-0x0000000000D00000-0x0000000000D60000-memory.dmp
            Download

            memory/4524-649-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4524-85-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4524-81-0x0000000000D00000-0x0000000000D60000-memory.dmp
            Download

            memory/4524-256-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/4524-99-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4912-94-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/4912-96-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/4912-87-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/4932-241-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4932-109-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4956-22-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/4956-131-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4956-20-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/4956-12-0x0000000000700000-0x0000000000760000-memory.dmp
            Download

            memory/4964-133-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/5052-198-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5052-72-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/5052-69-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/5052-63-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download