Overview

overview

7

Static

static

3

2024-06-09...re.exe

windows7-x64

7

2024-06-09...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 18:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-09_3afbb118e8b4ac84f5b45bea159ef295_bkransomware.exe
  • Size 1.8MB
  • Sample240609-w5f7zaec24
  • SHA256 623f01afdb22acff2cee717aacb430463e074d7a8cada3b4275b3035b95ee0d3
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_3afbb118e8b4ac84f5b45bea159ef295_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_3afbb118e8b4ac84f5b45bea159ef295_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4728
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1772
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:2160
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:220
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1752
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3812
    • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2448
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4480
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4032
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3232
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:404
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4716
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:2008
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4364
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4476
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2896
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3944
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:3748
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3808
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:708
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3952
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3668
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4464
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2488
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:1532
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 900
          2⤵
          • Modifies data under HKEY_USERS
          PID:2156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3268

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
              • Size 2.2MB
              • SHA256 5c133fd23b4f5216c6ed99a0fc12abc8261e681b3c66204040b45d6d058c4abd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 781KB
              • SHA256 2b2df9f6416a05dd4aca6d716e6789085581a3802a39033746d72ea6e7626b75
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 06b8ee9d50ea71f8cb48892af984485589cc189ccec73df7c027cf281f518455
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 0dc16a486322ed38706779bf176d23c66c337f2624d53ca28c8ffc60fb35b94e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 37d762f96bb088c7a7a403d8034419c06f7010d60812f4bc7918de310b170841
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 582KB
              • SHA256 c508bafa4e3b5834d65afaa8725e3cd210d62a59586ef6ae2d0dbdb843dc4b42
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 840KB
              • SHA256 ef9f0a20e80955bc9b75f7e6f583e79ffc585a7327efe5b54cc8c310edb0c211
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 721ed4f9c9cc4dcb429e03775b3d02418a46a419ce3feefd0506c2870b81158a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 910KB
              • SHA256 10b6deced8580e85447ec7ed6ebcc706138ef496c7eeec5213407128945e047d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 25c1cf7851d0d9d307464dcb72ea05aceb23db1c1d69ae544443242834327a0d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 2f0c14559cde2b6bbbb8aa357c4e20f4c66f348bc43d43180b200a09444e2eb8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 0fe1be6e6a63a60576df1230a5308947d40919fe9b332a28c3d706e0c79c932d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 805KB
              • SHA256 403da836580107ccfae503aaab3f70dddf637d130438d571fa17960bda279d89
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 656KB
              • SHA256 5618cf45165857bd546ccaa90be796070ba1a7d31e39febf0bfdcf0b227ac51b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
              • Size 4.8MB
              • SHA256 e29ba709498e7e528f252982570fa4e484b925bd4b22955ad406dd1ccd3b7ada
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
              • Size 4.8MB
              • SHA256 2e7351fe5cce6e58b3ca6659c21bb16211105df5f44bffa6da64fd5b741c6613
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
              • Size 2.2MB
              • SHA256 62842113d88d3efec80809be40d3a36383e2f3785d2a8258081ed583d5e31373
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
              • Size 2.1MB
              • SHA256 2a0d253acbdb1597a142517740ccb478a6ba38ebe7ffe0b691458086031ea4bb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
              • Size 1.8MB
              • SHA256 31d95066a66450cb6caa235bb48d0b5a7c323edba6bf6db69daa0b54a82cec1b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 1.5MB
              • SHA256 715ee9fb11256ac2623c7134ba2ce250976d91d6da818944b97b6b3441cb04bf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 581KB
              • SHA256 07ea27e3e9bfc9bfdba2a43ece6517edbc487aad15d60e04370679599b4aaff4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 581KB
              • SHA256 138f0667e9e38e63754828fb99091f02399869113aa573d6124c600a8b25b2af
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 581KB
              • SHA256 058a4ffec40d3583b103bd2411a9c98a14cca3b917c3a7d00afca865d9cce17d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 601KB
              • SHA256 6905d5ebd309043b3c80deee3b38a490091330797e63cc06a9d67c029fbaa8d9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 581KB
              • SHA256 c41bfbd6ebea1fd6a28e86012a6b61df7f62519c853958d0d96780720b719304
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 581KB
              • SHA256 153cbe796ee85783f5359efe2554e3a44d2e540a97c13e6de127743c3ae145be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 581KB
              • SHA256 9aa4fe904a0f0c7b7118e6543eda5530e65736ffa1069d55f28927094897e52b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 841KB
              • SHA256 e9fafb743cc41f375f68dfcf936cff11fcf04a1ece1163d01c295c818f584e20
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 581KB
              • SHA256 42b5aa40211cf15feadd1c705574addd202d1c31950cd79a019db67ffee54ae1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 581KB
              • SHA256 0ef733c5f04cf630bd599e01733a7897f81208233a799bf47c564fda0021624b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 717KB
              • SHA256 c15a5b88ae908e486e2fd45a37a7dde7b01ea8d64116984a2116d330fe75b744
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 581KB
              • SHA256 eaf4c922dd27c870b5d595887038df0f15a59fbc3ac6a21a283d8dc6655d5f64
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 581KB
              • SHA256 d07395c1f871aa2fb8cbd1a5cc123eb17e47b08fde36ab2020988ef7f0c306ec
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 717KB
              • SHA256 5dda2ac6d8bdd2334aa00c9975bb25459386da7a5441437ea7f97782cbd4c98b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 841KB
              • SHA256 afd2cd1af77e8c8cfda1cf9aeda5462d21d049e8d99a65fdfae58c944cf2e36e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 06e17cdccfcadfc8c8a07074711f16c80f543d654ca048e4feb504a544e8dfd5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 696KB
              • SHA256 404af8faf9d1780b8cc4c07e2a6529386317f65dc2ab72b27d1690b7d9454592
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 588KB
              • SHA256 d0da31b7fd645fad3195cfb83c91dfe8acebf3b51c8a3036af87563c557bc8b7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 e35210acdde1e862ff498983bf2e44534a388ad4bd665b9cc583c1d7b0321f4f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 659KB
              • SHA256 d601b67f95838f55f24f90e840badab130f72dde7fe464091f875418e596f1dc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 77b3def898bda991eaa0cc370916c154a7bd1943ff6fc7756a2dc6d798650b65
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 578KB
              • SHA256 2adc8f2a14d3aed78b8a4c6f38adea54cdceae9312770061e687c4de12b50e0a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 940KB
              • SHA256 b0eb5cdc47ffe8fa7757fddb35a05874d005c11f91e092e6d3bc2d61c6db1664
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 671KB
              • SHA256 b360178c533a9b52aba921e7d8d24b10c4ba101da243b07643e56f8a27e55082
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 8f99365daf7c9e402b14deed22b62c92e31870de7d2114c1ae237a343fe96bd7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 a6a2618935464f4fc642a74a655d493b874bc99e0530ecd2be30e70fa0a07ed6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 016d95eb5a47f5ebe27018820978d87c6f8eaa57283c786c66069a1412a4719b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 885KB
              • SHA256 5d9e31ba80cc896b80b0c70b992fdf6e39212342ce9b5ec3ca2a9b09c5c1c9fd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 57c9ce63f28d3419b48ffafc152c7cf9235c852d52de4b7906dda0606d80bf7b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 661KB
              • SHA256 56e6f47b1508c85c100a38310cab68835fd41b8328c06509ae07bb26f3e76e8d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 712KB
              • SHA256 76e456844e1d73385b57568a71a780d55f56ff4c289becd7c00b152bcd1f9de6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 584KB
              • SHA256 7e93dbfe1cc5b46f41f16ca75a1ba0fabaa7ff3e950ce573df4734cb5a641521
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 f59cecd21e0fe5a4a1e7906bbba3a854f90bb84bf795bc9fe86e780bbc2abbee
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 772KB
              • SHA256 0437264381afa8235a911cbb7a462c614899a40f3f592a37929d1b3aab6bc952
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 5e12c1635c3ed9311f5661b21114f0aaebf2dc88e1641d6d62fc87c5dde19a6f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 f3e6f5ccfe0a9062c9bc62b016667e211503150b58a4238f6b9bfabcfa1e9949
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 877KB
              • SHA256 1c44bc10607a65bf40ed0fd21e1f2ac4048ccbdee1b19a06c9f3531c9096ca10
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 635KB
              • SHA256 3b0158abbd52744e34db866109e51db345ae82a6bd030e24abb1ddc2ec1f0724
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              office2016setup.exe
              • Path C:\odt\office2016setup.exe
              • Size 5.6MB
              • SHA256 d81428ef9426c060963a53cd8bcb50e1562121ac9222eed4f35194360acf1143
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/404-236-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/404-117-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/708-222-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/708-210-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/1752-37-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/1752-50-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/1752-48-0x0000000000EB0000-0x0000000000F10000-memory.dmp
              Download

              memory/1752-38-0x0000000000EB0000-0x0000000000F10000-memory.dmp
              Download

              memory/1752-46-0x0000000000EB0000-0x0000000000F10000-memory.dmp
              Download

              memory/1772-19-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/1772-13-0x0000000000740000-0x00000000007A0000-memory.dmp
              Download

              memory/1772-102-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/1772-12-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/2008-139-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/2008-260-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/2160-26-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/2160-128-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/2160-25-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/2160-34-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/2448-63-0x0000000140000000-0x0000000140245000-memory.dmp
              Download

              memory/2448-64-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/2448-186-0x0000000140000000-0x0000000140245000-memory.dmp
              Download

              memory/2448-70-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/2488-488-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/2488-261-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/2896-390-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/2896-174-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/3232-103-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/3232-224-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/3668-482-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3668-237-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3808-445-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/3808-206-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/3812-59-0x0000000000510000-0x0000000000570000-memory.dmp
              Download

              memory/3812-173-0x0000000140000000-0x0000000140237000-memory.dmp
              Download

              memory/3812-52-0x0000000140000000-0x0000000140237000-memory.dmp
              Download

              memory/3812-54-0x0000000000510000-0x0000000000570000-memory.dmp
              Download

              memory/3944-187-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/3944-441-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/3952-225-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/3952-479-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/4032-87-0x0000000140000000-0x00000001400B9000-memory.dmp
              Download

              memory/4032-91-0x0000000000710000-0x0000000000770000-memory.dmp
              Download

              memory/4032-209-0x0000000140000000-0x00000001400B9000-memory.dmp
              Download

              memory/4364-150-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4364-393-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4364-273-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4464-249-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/4464-484-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/4476-162-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/4476-337-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/4480-90-0x0000000140000000-0x00000001400CA000-memory.dmp
              Download

              memory/4480-88-0x0000000002270000-0x00000000022D0000-memory.dmp
              Download

              memory/4480-82-0x0000000002270000-0x00000000022D0000-memory.dmp
              Download

              memory/4480-76-0x0000000002270000-0x00000000022D0000-memory.dmp
              Download

              memory/4480-75-0x0000000140000000-0x00000001400CA000-memory.dmp
              Download

              memory/4580-274-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/4580-505-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/4716-129-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/4716-248-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/4728-0-0x0000000000400000-0x00000000005D9000-memory.dmp
              Download

              memory/4728-74-0x0000000000400000-0x00000000005D9000-memory.dmp
              Download

              memory/4728-7-0x0000000000BB0000-0x0000000000C17000-memory.dmp
              Download

              memory/4728-6-0x0000000000BB0000-0x0000000000C17000-memory.dmp
              Download

              memory/4728-1-0x0000000000BB0000-0x0000000000C17000-memory.dmp
              Download